Business Insurance Requirements for Tech Startups: The Complete Guide

Business insurance requirements for tech startups: what you actually need, and when

A client sends over an MSA. Page 14, section 9.2: "Vendor shall maintain commercial general liability insurance of not less than $1,000,000 per occurrence." You read it twice. You have no insurance. You have a Delaware C-corp, two engineers, and $340,000 in the bank. The contract is worth $180,000 a year.

That clause is the moment most founders discover that business insurance requirements for tech startups have almost nothing to do with what's legally mandated and almost everything to do with who is asking you to sign something.

I've been through this twice — once as a founder who nearly lost a contract over a certificate I didn't have, and once helping a portfolio company sort out a claim that their policy didn't cover. The second one cost them roughly $60,000 out of pocket. Here's what I wish someone had told me both times.

What kind of insurance do startups need?

Strip away the marketing and startup business insurance is a coordinated set of policies protecting your company, its leaders, and the people doing business with it. Not one product. A stack.

In practice, most tech startups end up with something like this:

• General liability (CGL) — third-party bodily injury, property damage, and things like libel or slander. The one every client contract names.
• Tech errors & omissions (E&O) — you shipped a bug, the customer lost money, they sue. This is the policy that actually matches what a software company does all day.
• Cyber liability — breach response, notification costs, ransomware, regulatory fines. Non-negotiable if you touch customer data.
• Directors & officers (D&O) — protects your board and your executives personally. Investors will push for this; some term sheets require it outright.
• Workers' compensation — the only one on this list that is frequently mandatory by law rather than by contract.

Four of those five exist because someone else demanded them. That's the pattern worth internalizing early.

Legal requirement vs. contract requirement

Founders conflate these constantly, and it leads to bad decisions. The distinction matters because the two have completely different clocks.

Trigger	What it demands	Who enforces it
You hire your first W-2 employee	Workers' comp (state-dependent)	State regulator, with fines
You sign a client MSA	Usually CGL, often cyber and E&O	The client, via contract
You sign an office lease	CGL, sometimes $1M–$2M limits	Landlord
You raise a priced round	D&O, per investor due diligence	Your lead investor
Enterprise procurement review	COI on file before contract signature	Their legal team

Notice how little of that is statutory. Workers' comp is the legal one. Everything else is a business relationship telling you what it wants.

What insurance does an IT company need?

Here's where the generic startup advice falls apart. A 12-person B2B SaaS company and a 12-person IT consultancy have similar headcounts and almost opposite risk profiles.

The consultancy touches client infrastructure, deploys to their environments, and can plausibly take down a production system with a bad migration. The SaaS company serves many customers through one codebase, which means a single bug has a wide blast radius but no physical access.

Both need E&O. But the consultancy should be looking at higher limits, because the failure mode is louder and more visible to the customer.

The AI problem nobody's underwriting properly yet

If your product involves a model — yours, or one you're calling through an API — you've got a coverage gap that standard tech E&O was not written for.

Hallucinated output that a customer acted on. A model that produces biased recommendations and someone files a discrimination claim. Training data that turns out to be scraped from somewhere it shouldn't have been. Most standard policies are quiet on all three, and quiet is not the same as covered.

I watched a company discover this the hard way. They had E&O, they had cyber, they felt fine. Then a client claimed their recommendation engine had systematically disadvantaged a protected class in hiring decisions. Their carrier's response was, essentially, that's not the exposure we priced. They settled it themselves.

Ask your broker directly: does this policy respond to algorithmic output liability? If they hesitate, get it in writing.

How much is a $1,000,000 liability insurance policy?

You won't get a real number from a blog, and anyone who gives you a firm figure without asking about your revenue, headcount, and what you actually do is guessing.

That said, here's the honest shape of it. For a small software company with modest revenue, a $1M general liability policy typically runs in the low hundreds to low thousands of dollars annually — it's one of the cheaper pieces of the stack. Cyber liability usually costs more. E&O costs more still, because it's priced against the size and nature of the work you do. D&O scales with your board composition and your fundraising.

The line item that surprises founders is never CGL. It's the bundle.

Why the quote varies so wildly

Revenue is the biggest lever. A company doing $500K and a company doing $5M are not buying the same policy even if both ask for $1M limits. Then: how many employees, do you handle PHI or payment card data, do you have subprocessors, what's your largest customer contract value.

The mistake I made early on was shopping on price alone. I found a policy about 40% cheaper than the two alternatives. Then I read the exclusions list properly and realized it carved out the exact thing I was worried about. Cheap and useless is worse than absent, because you think you're covered.

Three carriers come up constantly when founders compare notes — Vouch, Next, and Corgi — and each has a phone number and a quote flow worth sitting through. Get at least three quotes and read the exclusions on every one before you compare premiums.

At what point do I need business insurance?

Sooner than you think, and later than you fear. The honest answer is: the moment another party makes it a condition of doing business with you.

For some founders that's month two, when the first real client sends an MSA. For others it's year two, when a Fortune 500 procurement team flags your policy limits before countersigning. The trigger is rarely internal.

A rough stage map

• Pre-seed, no employees, no contracts — you can probably wait, though a cheap CGL policy is not much money and removes a recurring headache.
• First real client contract — CGL almost certainly. Read section by section what they demand.
• Handling customer data — cyber liability stops being optional.
• First W-2 hire — check your state's workers' comp rules that week, not next quarter.
• Priced round or outside board members — D&O, before the round closes.

The failure mode isn't being uninsured. It's being asked for a COI on a Thursday and needing it by Monday. Underwriters don't move that fast, and a delayed contract is a real cost.

What to do this week

Open your largest client contract and search for the word "insurance." Read the clause. Note the limits and the coverage types named.

Then check one thing: does the clause ask for coverage your business actually has, or coverage that matches a template written for a construction company? Plenty of MSAs demand general liability when what the client actually cares about is your software failing. Getting that clause renegotiated is often easier than buying your way around it.

The part nobody tells you is that insurance stops feeling like a tax once you've watched it pay out. I spent years resenting the premium. Then I watched a claim get handled and realized what I'd actually bought was the ability to stop thinking about it.

That's the whole product. Not protection from risk — protection from the version of you at 2am who can't stop running scenarios.