Your users are children, and the claim is a record, not an injury.Founded by a software developer who runs an AI app.
We insure AI tutors, homework helpers, grading tools, learning platforms sold to schools and apps built for kids with technology E&O and cyber that fit the claims children’s software draws: children’s data, student records, and what a tutor said to a minor. School district contracts decide what you must carry, so we read them first.
Tell us the situation.
One licensed human replies the same business day — not five agents, not an auto-responder. If the policy you have is already the right one, we will tell you.
We use this to quote and service your insurance, and we do not sell it or pass it to lead networks. Privacy policy.
The person placing your tech E&O runs an app with an AI coach of his own.
Kevin Kelsey
Founder | Principal Agent
Boring’s founder, Kevin Kelsey, owns and runs TrainRec, a fitness app with a built-in AI coach, and has placed insurance for AI apps. Insuring his own taught him how an underwriter reads a model. Personal guidance from an AI reads more like the work of a professional than like software, technology E&O forms commonly exclude bodily injury, and not every form will add it back. So whether your app answers money, health, hiring or farming questions, the gap between what it says and what the policy covers gets read by someone who has had to close it for his own product.
Send us what you have. We’ll tell you if it’s right.
Your current policy paperwork, a renewal notice, or nothing at all. A licensed agent reads it and replies the same business day.
What edtech or kids app businesses actually need.
Technology E&O
Claims that your platform failed the school or the family: a grading tool that scored work wrongly, a tutor that taught something false, an outage during exams.
Without it — A district will not sign until it sees technology E&O, and a general liability policy written for a software company will not answer a claim about what your product got wrong.
Cyber & tech E&O
Breach response, ransomware and the notification costs that follow. Technology errors and omissions sits on the same policy and covers the software or service itself failing a client, which is the half most tech companies find out about too late.
Without it — Children’s data and student records are the assets that make a breach expensive: notification to every family, a regulator inquiry under COPPA or a state student privacy law, and the district’s own costs you agreed to repay.
Sexual abuse and molestation coverage
Claims that an adult connected to your service harmed a child, such as a live tutor, a moderator or a mentor on a platform where adults and minors talk.
Without it — General liability and tech E&O commonly exclude it. Some district contracts ask for it by name whenever a person from your company can reach a student, so ask before a tutor marketplace goes live.
General liability
Third-party bodily injury and property damage. It is the line nearly every contract names by default.
Without it — Schools and districts ask for the certificate first. Read it for a professional services or technology exclusion, which is where a claim over your product’s output usually gets pushed off it.
Media liability
Covers claims arising from what you publish (defamation, copyright and trademark infringement, invasion of privacy and misuse of a person’s likeness) on an annual policy for creators, podcasters, publishers and authors.
Without it — Lesson content, videos, quizzes and licensed textbooks are published material. A claim that a lesson copied a publisher’s work is a media claim, not a software one.
What the regulators actually wrote down.
The FTC announced its final amendments to the COPPA Rule on January 16, 2025. They require separate verifiable parental consent before children’s personal information is disclosed to third parties for targeted advertising or other purposes, limit retention to as long as reasonably necessary for the purpose collected, and add biometric and government-issued identifiers to the definition of personal information.
Federal Trade Commission, FTC Finalizes Changes to Children’s Privacy Rule Limiting Companies’ Ability to Monetize Kids’ Data (January 16, 2025) · checked 2026-11-01
The amended COPPA Rule was published in the Federal Register on April 22, 2025, took effect June 23, 2025, and set a general compliance date of April 22, 2026, with a few provisions excepted.
Federal Register, Children’s Online Privacy Protection Rule (April 22, 2025), 16 CFR Part 312 · checked 2026-11-01
The FTC did not adopt the changes it had proposed for education technology companies operating in a school environment when it finalized the COPPA amendments.
Federal Trade Commission, FTC Finalizes Changes to Children’s Privacy Rule (January 16, 2025) · checked 2026-11-01
On May 22, 2023 the FTC announced an action against the education technology provider Edmodo, alleging it collected children’s personal information without verifiable parental consent, used it for advertising, and outsourced its COPPA compliance to schools and teachers, which the FTC called an unfair practice. The order carried a civil penalty of 6 million dollars, suspended because Edmodo could not pay, and would require deletion of models or algorithms built from data collected without consent or school authorization.
Federal Trade Commission, FTC Says Ed Tech Provider Edmodo Unlawfully Used Children’s Personal Information for Advertising and Outsourced Compliance to School Districts (May 22, 2023) · checked 2026-11-01
FERPA lets a school share education records with a contractor as a school official only if the contractor performs a service the school would otherwise assign to its own employees, is under the school’s direct control for the use and maintenance of the records, uses the personal information only for the purpose it was disclosed, and meets the criteria in the school’s annual FERPA notification.
U.S. Department of Education, Student Privacy Policy Office, FAQ: Who is a “school official” under FERPA? · checked 2026-11-01
California’s Student Online Personal Information Protection Act applies to an operator with actual knowledge that its site, service or app is used primarily for K-12 school purposes and designed and marketed for them, and bars that operator from targeted advertising, from building a profile of a pupil except for school purposes, and from selling a pupil’s information, while requiring reasonable security and deletion when a school asks.
California Business and Professions Code section 22584 · checked 2026-11-01
The claims we actually see.
Ordered by how often we see them, not by how dramatic they are. Each one names the coverage that answers it — and the policy people wrongly assume already does.
Most common
Children’s personal information is collected, kept or shared without proper parental consent
Covered by Cyber, regulatory defense and privacy liability
COPPA fines are not always insurable, and some cyber forms limit regulatory coverage to a sublimit, a smaller cap inside the main limit. Read what the form pays for a regulator’s investigation of how you handled kids’ data, not only for a hack.
Common
A school district claims you used student records beyond what the contract allowed
Covered by Cyber and technology E&O, if the contract liability is not excluded
Many policies exclude liability you took on only by contract. A district’s data agreement that makes you repay its notification and legal costs may sit outside the cyber form unless it says otherwise.
Less common, severe
An AI tutor tells a student something false, harmful or unsuitable for their age
Covered by Technology E&O, with the AI output wording confirmed
A claim about content shown to a minor can be argued as injury, advice or a media claim, and each policy can say it belongs to another. The generative AI exclusion on some forms removes it entirely.
Common
A breach exposes student records held for a school
Covered by Cyber, first-party response and privacy liability
The district will want to be told fast and may require specific notice periods in the contract. The cyber policy has its own notice clock, and missing either one is a separate problem.
What our edtech or kids app clients ask us.
Why is this one page for edtech and kids apps?
The exposure is the same in both: the user is a minor, a parent or a school stands between you and that child, and the regulator treats the child as the protected party. An AI tutor sold to a district and a game for eight-year-olds both face COPPA, both hold data that cannot be casually shared, and both are judged on what they showed a child. The difference is who writes the insurance requirements, and the answer to that is below.
What will the underwriter ask an edtech or kids app?
Expect questions on the age of your users and whether you collect anything from children under 13, how parental or school consent is obtained, and what the AI decides versus suggests when it grades or tutors. They will ask which model or vendor powers it, whether a person reviews flagged content, whether conversations are logged and for how long, and whether any adult can contact a child through the product. Add your user and student counts, revenue, the states and countries you serve, your district contracts and their insurance clauses, any past complaint, and whether a regulator has contacted you.
What does COPPA require, and did it change?
COPPA is the federal law on collecting personal information from children under 13 online. The FTC finalized amendments in January 2025 that require separate parental consent before children’s data is disclosed to third parties for targeted advertising, limit how long it can be kept, and widen the definition of personal information to include biometric identifiers. The amended rule took effect in June 2025 with a general compliance date of April 22, 2026, which has passed. Confirm your consent flow and retention schedule against the current text.
We sell to schools. Does COPPA still apply?
Often the school can consent on the parents’ behalf, but only for the school’s educational purpose. The FTC’s Edmodo case alleged that using children’s data for advertising went beyond what a school could authorize, and that telling schools they were solely responsible for COPPA compliance was itself an unfair practice. Do not read your district contract as moving the legal duty off you.
What is the FERPA school official rule, and why does an insurer care?
FERPA protects student education records. A school can hand records to a vendor as a school official only if you do a service the school would otherwise do itself, stay under its direct control for how the records are used, use them only for the purpose they were shared, and fit the school’s annual notice. If your product also trains its own models on those records, you may be outside the exception, and a claim that follows is one the insurer will want to know you understood.
Does California have its own student privacy law?
Yes. The Student Online Personal Information Protection Act, in California Business and Professions Code section 22584, applies to an operator that knows its product is used primarily for K-12 school purposes and was designed and marketed for them. It bars targeted advertising to students, building a profile of a student except for school purposes, and selling student information, and it requires reasonable security and deletion when a school asks. Many other states have comparable laws.
A school district sent a contract with an insurance clause. What do they usually ask for?
Commonly technology E&O, cyber, and general liability, often with limits the district sets and itself as an additional insured, which means named on your policy so it can claim directly. Some also ask for sexual abuse and molestation coverage when anyone from your company can contact a student. Send us the clause before you sign it, because meeting it is usually a matter of picking the right forms, not of changing your product.
Our AI tutor can give a wrong answer. Is that covered?
A wrong answer to a student is a technology E&O claim in principle, but the wording matters. Ask whether the form covers claims from AI-generated output in plain words, because some forms and some general liability endorsements now exclude generative AI. A tutor that adapts to one child and gives personal guidance tends to read to an underwriter more like instruction than like software, so describe it exactly as it works.
What if the AI chats with a child like a companion?
The risk is different and harder. A chatbot that holds an open conversation with a minor draws claims about emotional harm and unsuitable content, and several lawsuits already allege this. If your tutor can drift into open conversation, tell the underwriter what limits it and whether a person reviews flagged chats.
Does tech E&O cover a student who says our app hurt them?
Often not for physical or emotional injury, because technology E&O is written for financial loss and many forms exclude bodily injury. The same gap exists for fitness apps, where a user follows a plan and gets hurt. The fix is contingent bodily injury, a grant for an injury someone says came from relying on your app’s output rather than from anything you physically did. Ask whether the market you are quoted offers it.
Which NAICS codes does this page cover?
The 2022 NAICS codes an edtech or kids app company may fall under are 513210 Software Publishers, 541511 Custom Computer Programming Services, 518210 Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services, 519290 Web Search Portals and All Other Information Services, 611691 Exam Preparation and Tutoring, 611710 Educational Support Services, and 611699 All Other Miscellaneous Schools and Instruction. Which one applies depends on whether you sell software or deliver instruction yourself.
We want to offer the app to schools abroad. Does our insurance follow?
Not automatically. Many technology E&O policies only promise to defend claims brought in the US or Canada. Children’s data is regulated in Europe and the UK as well, and those regimes can reach an app that never opened an office there. Check where claims can be brought before you launch.
We built the app quickly with AI coding tools. Does that matter?
It matters to the underwriter, who will ask who reviewed the code that handles children’s data and how it is tested. Say plainly what was generated and what a person checked. A weak answer on security review is a common reason a quote narrows.
Where do the other AI app industries fit?
Each industry has its own claim, so each has its own page. The hub lists them all.
What do you need to quote an edtech or kids app?
What the product does for students in a sentence or two, the ages of your users, how many users and how many schools, your revenue, which states you serve, and whether a person can reach a child through it. Send any district contract with an insurance clause and your current policies so we can see what is excluded today. The fitness app page shows how we handle an app that carries a different kind of exposure.
Guides on edtech or kids app.
- Insurance for an App Launching WorldwideAn app store launch puts your app in front of users in dozens of countries on the first day. Your tech E&O may only defend claims filed in the US or Canada, and your cyber policy has to handle European privacy rules, where health and fitness readings are a special category of data.
- Vibe-Coded App InsuranceA vibe-coded app carries the same liability as any other, and the documented failures are security ones: open databases, exposed keys and an agent that deleted data. Here is which policy answers which failure, what the AI tool providers say about who is responsible, and what to check before you buy.
Commercial insurance is 96% of what we do — it is not a department here, it is the whole business. Not ready to talk? The guides answer the questions this page raises in more depth. Already insured with us and need a certificate or a policy change? Ask the service team rather than starting a quote — it is faster and it goes to the people whose job it is. We also write home and auto, which is usually cheaper alongside the business policy than apart from it.
Handed a lease, a vendor packet or a client contract with insurance requirements? Paste it into the COI Requirements Decoder to see what each one means for your business, or read what the requirements mean.