Your tool writes the code. Thousands of products now carry your mistakes.Founded by a software developer who runs an AI app.
If you sell a coding assistant, a review bot, an agent with repository access or an API, the code and actions it produces ship inside your customers’ products. We place technology E&O, cyber and intellectual property coverage for the vendor, not the builder.
Tell us the situation.
One licensed human replies the same business day — not five agents, not an auto-responder. If the policy you have is already the right one, we will tell you.
We use this to quote and service your insurance, and we do not sell it or pass it to lead networks. Privacy policy.
The person placing your tech E&O runs an app with an AI coach of his own.
Kevin Kelsey
Founder | Principal Agent
Boring’s founder, Kevin Kelsey, owns and runs TrainRec, a fitness app with a built-in AI coach, and has placed insurance for AI apps. Insuring his own taught him how an underwriter reads a model. Personal guidance from an AI reads more like the work of a professional than like software, technology E&O forms commonly exclude bodily injury, and not every form will add it back. So whether your app answers money, health, hiring or farming questions, the gap between what it says and what the policy covers gets read by someone who has had to close it for his own product.
Send us what you have. We’ll tell you if it’s right.
Your current policy paperwork, a renewal notice, or nothing at all. A licensed agent reads it and replies the same business day.
What developer tools company businesses actually need.
Technology E&O
Claims that your tool produced code with a flaw, deleted or changed something it should not have, or did not do what you sold.
Without it — Your customers are developers with lawyers and contracts, and one defect can reach thousands of their end users.
Cyber & tech E&O
Breach response, ransomware and the notification costs that follow. Technology errors and omissions sits on the same policy and covers the software or service itself failing a client, which is the half most tech companies find out about too late.
Without it — An agent with access to repositories, secrets and cloud accounts makes your own breach a breach of every customer’s environment.
Intellectual property and infringement
Claims that code your tool generated copies someone’s work or breaches an open-source license, and the indemnity you promise customers against those claims.
Without it — An IP indemnity in your terms is a promise to pay, and technology E&O forms commonly limit or exclude infringement, so it can be uninsured.
Directors & officers
Protects the personal assets of the people running the company when they are sued over a management decision. It applies to private companies and nonprofit boards, not just public ones, which is a common and expensive misunderstanding.
Without it — A funding round, an acquirer and a board will all ask whether the leaders are covered.
General liability
Third-party bodily injury and property damage. It is the line nearly every contract names by default.
Without it — The certificate large customers ask for first, to be read for professional services and technology exclusions.
Software developer coverage
If you also build custom software for clients rather than only selling a tool, that work has its own page and its own claims.
Without it — Project work is judged against a contract and a scope, and a tool is judged against a promise made to everyone.
What the regulators actually wrote down.
In Doe v. GitHub (N.D. Cal.), programmers sued GitHub, Microsoft and OpenAI over GitHub Copilot; in 2024 the district court dismissed their claims under section 1202(b) of the Digital Millennium Copyright Act for failure to plead that the generated code was identical to their own, and did not dismiss a breach of contract claim based on open-source licenses. The Ninth Circuit accepted an appeal (No. 24-7700).
Mealey’s, 9th Circuit Accepts Appeal In GitHub DMCA AI Case · checked 2026-11-01
On September 16, 2026 the Ninth Circuit affirmed dismissal of the DMCA section 1202(b) claims in Doe v. GitHub, holding that Copilot and Codex generated new code without copyright management information rather than removing it from copies of the plaintiffs’ code, rejecting identicality as a freestanding requirement, and holding that the plaintiffs had standing at the pleading stage.
Ninth Circuit, Doe v. GitHub, Inc., No. 24-7700 (Sept. 16, 2026), as summarized by Gibson Dunn · checked 2026-11-01
Microsoft announced on September 7, 2023 that if a third party sues a commercial customer for copyright infringement over its Copilots or their output, Microsoft will defend the customer and pay adverse judgments or settlements, as long as the customer used the guardrails and content filters built into the products and did not supply input it lacked the rights to use.
Microsoft On the Issues, Microsoft announces new Copilot Copyright Commitment for customers (Sept. 7, 2023) · checked 2026-11-01
The claims we actually see.
Ordered by how often we see them, not by how dramatic they are. Each one names the coverage that answers it — and the policy people wrongly assume already does.
Common
Code from your tool ships with a flaw in many customers’ products
Covered by Technology E&O
A customer’s loss from your tool’s code is a customer claim, and their end users may sue them and then you. The aggregate limit matters because one flaw can reach many customers.
Less common, severe
A customer is sued over code your tool generated and looks to your IP indemnity
Covered by Intellectual property coverage where offered, or media liability
Technology E&O often limits infringement claims, so a written promise to defend customers may sit with no policy behind it. Read the infringement wording and the contractual liability wording together.
Common
An agent with write access deletes or corrupts a customer’s work
Covered by Technology E&O, with cyber where data is exposed
Destroyed work is a financial loss, which is what tech E&O answers, but your terms may disclaim it. A disclaimer helps the defense and does not prevent the claim.
Common
Your tool leaks customer code or secrets
Covered by Cyber liability
Source code and credentials are not always counted as covered data in the cyber form, and the customer’s losses from a leaked secret can run past your own response costs.
What our developer tools company clients ask us.
We sell a coding assistant. How is our insurance different from a software developer’s?
A developer builds for a client and the claim is one project. A tool vendor sells the same product to everyone, so a defect, a weak default or a license problem repeats across customers. Insurers call this aggregation, and it affects the limit, the terms for related claims and the contract language more than it would for a services firm. If you also build custom software, that part sits on its own page.
We built our own product with AI tools. Is that the same page?
No. How an app built with AI coding tools is insured, including the incidents behind it, is in our guide on the builder’s side. This page is for the company that sells the coding tool, the review bot or the agent to others.
What happened in the GitHub Copilot lawsuit, and why does it matter to a tool vendor?
In Doe v. GitHub, programmers sued GitHub, Microsoft and OpenAI in federal court in California over Copilot. In 2024 the district court dismissed their claims under section 1202(b) of the Digital Millennium Copyright Act and let a breach of contract claim over open-source licenses stand. On September 16, 2026 the Ninth Circuit affirmed dismissal of the DMCA claims, holding that Copilot and Codex generated new code rather than removing copyright information from copies, and holding that the plaintiffs had standing. It does not settle every copyright theory, and the case shows how long such questions stay open. For a vendor the point is the defense cost of being litigated over, whatever the result.
Our terms promise to defend customers against IP claims. Is that insured?
Often not unless someone arranged it. Microsoft publicly promised in September 2023 to defend commercial Copilot customers sued for copyright infringement over its output and pay adverse judgments, if the customer used its filters and did not supply input it lacked rights to. Vendors of every size now offer a version, because enterprise buyers ask. A promise to defend is a contractual liability, and technology E&O forms commonly limit or exclude infringement and liability assumed by contract. Read the infringement section and the contractual liability section before you put the promise in writing.
Does tech E&O cover an AI agent that deletes a customer’s data?
Usually yes for the financial loss of the lost work, because that is the failure of your product to do what you sold. What matters is the wording on AI output and on data: whether the form excludes loss of data, whether your own terms limit liability, and whether the customer’s backups changed the loss. If the agent also exposes data to a third party, cyber is involved as well.
What will the underwriter ask a developer tools company?
What the tool does on its own: suggests code, edits files, merges changes, runs commands or holds credentials. Whether a person must approve each change. Which model or vendor powers it and whether customer code is used for training. How generated code is checked for licenses and for secrets. Your standard customer terms: liability cap, IP indemnity, disclaimers and uptime promises. Revenue, customer count by size, regulated customers, countries served, security certifications, incident history and prior claims.
Is a coding suggestion covered the same way as an AI-generated image or article?
Not necessarily. Generated code that fails is a technology failure and lives in tech E&O. Generated text and images that infringe or defame are media claims, and a software form may or may not include them. If your product does both, ask how each is treated and whether a generative AI exclusion on the general liability form sits over any of it.
Do code review bots and security scanners carry extra risk?
They carry a specific one: a missed vulnerability. A customer relies on the bot and then has a breach, and the allegation is that the review you sold did not catch it. The defense is clear scope in your terms and honest marketing, and the coverage is tech E&O with cyber alongside. If the bot is sold as a security product, the cybersecurity company page applies as well.
Do we need cyber insurance if we only sell software?
Yes if you hold anything of the customers’. An assistant with access to repositories, tokens or cloud accounts makes you a path into each customer’s environment, and your own breach becomes theirs. Cyber pays for response and for third-party liability, and the form should be read for whether source code and credentials count as covered data.
What if our tool is open source or free to use?
A free tool still draws claims if a company builds on it, and an open-source license disclaims liability but does not stop a lawsuit. Tell the underwriter how the free version differs from what you sell and where revenue comes from. A commercial layer, support contract or hosted service is what usually makes the exposure insurable.
We have users in Europe and Asia. Does coverage follow?
Check. Many technology E&O policies only defend claims brought in the US or Canada, and a customer abroad may sue under local law. The EU AI Act and data protection laws also affect what your cyber policy needs to answer.
Which NAICS codes does this page cover?
The 2022 NAICS codes most often used by tool vendors are 513210 Software Publishers, 541511 Custom Computer Programming Services, 541512 Computer Systems Design Services, 541519 Other Computer Related Services and 518210 Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services. An API or hosted platform often lands in 518210 and a downloadable tool in 513210. The underwriter prices the product behind the code.
Could bodily injury ever come from a developer tool?
Rarely and only through a customer, for example if code your tool wrote runs in a medical device or vehicle and someone is hurt. Technology E&O forms commonly exclude bodily injury, and contingent bodily injury, an injury someone says came from relying on your product, is available on some forms and not others. If your customers build safety critical software, raise it before you buy.
Where is the flagship example of an AI app with a bodily injury exposure?
Our founder, Kevin Kelsey, owns a fitness app with a built-in AI coach, TrainRec by Manifest Post. That page is the plain version of how a policy treats an AI that gives personal guidance, and the same attention to wording applies to a tool vendor’s IP promises.
Where does this fit among insurance for AI apps in other industries?
The coding tool vendor’s problem is repetition: one flaw, many customers. Other industries have different gaps, and each has its own page.
Also in this family
Guides on developer tools company.
- Insurance for an App Launching WorldwideAn app store launch puts your app in front of users in dozens of countries on the first day. Your tech E&O may only defend claims filed in the US or Canada, and your cyber policy has to handle European privacy rules, where health and fitness readings are a special category of data.
- Vibe-Coded App InsuranceA vibe-coded app carries the same liability as any other, and the documented failures are security ones: open databases, exposed keys and an agent that deleted data. Here is which policy answers which failure, what the AI tool providers say about who is responsible, and what to check before you buy.
Commercial insurance is 96% of what we do — it is not a department here, it is the whole business. Not ready to talk? The guides answer the questions this page raises in more depth. Already insured with us and need a certificate or a policy change? Ask the service team rather than starting a quote — it is faster and it goes to the people whose job it is. We also write home and auto, which is usually cheaper alongside the business policy than apart from it.
Handed a lease, a vendor packet or a client contract with insurance requirements? Paste it into the COI Requirements Decoder to see what each one means for your business, or read what the requirements mean.