Professional indemnity and other insurance for a QA vendor

Why insurance matters in a testing contract

A testing vendor can cause harm in several ways. A tester with access to a staging environment that holds copied personal data could expose it. An automation script with stored credentials could leak them. A missed defect in a payment flow could reach production. A vendor employee could damage equipment on your premises.

Your contract sets who is liable for each kind of loss. Insurance determines whether the vendor can actually pay. The UK Model Services Contract includes an insurance obligation alongside its liability terms for this reason, and US interagency guidance on third-party risk management lists insurance coverage among the areas a buyer should review during due diligence.

This page explains what to ask for and how to check it. It is general information, not legal or insurance advice. Insurance products, names and legal requirements differ by country, so confirm the specifics with your own advisers.

The policies to ask about

Policy	What it usually covers	Why it matters for testing
Professional indemnity (also called errors and omissions)	Claims that the vendor's professional service was negligent or fell short	A missed defect or faulty test advice that causes you a loss
Cyber liability	Data breaches, security incidents, sometimes incident response costs	Testers handle code, credentials and sometimes personal data
General or public liability	Injury or property damage to third parties	Vendor staff working on your premises or with your devices
Employer's liability	Claims by the vendor's own employees	Often a legal requirement where the vendor employs staff

Policy wording varies widely. Two policies with the same name can cover different events. Ask what each one covers for the kind of work the vendor will do for you, not only what it is called.

Sizing limits against the contract

There is no standard amount, and this guide does not suggest one. Work through these questions with your legal and risk advisers:

1. What is the liability cap in the contract? Required insurance limits should support the cap you agree. A cap backed by little or no insurance may not be recoverable in practice.
2. What are the carve-outs? Many contracts place data protection, confidentiality and IP claims outside or above the general cap. Cyber cover should reflect those carve-outs. See the liability clause in the contract clause builder.
3. What harm could a failure cause? Consider the personal data the vendor may see, the systems it can reach, and the cost of an incident in your product.
4. Per claim or in aggregate? A per-claim limit applies to each claim; an aggregate limit is the total for the policy period across all claims, including other clients' claims.
5. How long after the contract? Ask whether the policy covers claims made while it is in force or events that happened while it was in force, because that decides whether a claim raised after the contract ends is covered. Ask the vendor to keep cover for a period after the contract ends, as the model clause in the toolkit does.

Higher required limits can raise the vendor's costs, and those costs may appear in the price. Ask vendors to confirm they can meet your requirements before you shortlist, so this does not surface late.

Verifying certificates

A logo on a proposal or a sentence saying "fully insured" is not evidence. Ask for a certificate of insurance for each policy, issued by the insurer or broker, and check:

• Named insured. It should be the legal entity that signs your contract. A group parent's policy may not cover a subsidiary, and a sister company's policy will not cover the entity you contract with.
• Limits. Per claim and aggregate, in the currency you expect.
• Policy period. It should cover the contract start, and you should diary the renewal date.
• Scope and exclusions. Ask the vendor or broker to confirm in writing whether the policy covers services provided to clients, breaches caused by the vendor's staff, and subcontracted work. Note any exclusion that applies to your use.

The due diligence checklist includes both checks, with the evidence to keep on file.

What to put in the contract

The insurance clause should require the vendor to:

• Maintain the named policies at the agreed limits for the term and for a set period afterwards.
• Provide certificates at signature and on each renewal.
• Notify you promptly of cancellation or a material reduction in cover.
• Ensure subcontractors carry suitable cover, or that the vendor's policies extend to them.

Pair it with the limitation of liability clause, so the two are consistent. The guide on how to verify ISO 27001 and SOC 2 covers the security evidence that usually sits alongside insurance in due diligence, and software testing statement of work covers the rest of the contract pack. The selection path shows where these checks fit before signature.