In preparing this article, the team drew upon ISED’s Key Small Business Statistics 2024, the Insurance Bureau of Canada’s business-coverage guide, the Canadian Centre for Cyber Security’s baseline controls for small and medium organizations, and the Canadian Intellectual Property Office’s IP-strategy guide.
A startup’s day-one coverage should address legal or contractual requirements and losses that could immediately threaten the business. Insurance and risk controls should reflect your business’ data, people, contracts, activities, and assets. Revisit coverage before making big changes.
What Business Insurance Does a Startup Need?
Start by identifying risks that could stop the business from operating or create a liability it couldn’t fund. For example, consulting firms are typically asked to have professional liability before signing the first consulting agreement. Businesses making products may need commercial general liability with product-specific language. Businesses with personal information should have cyber controls and may need cyber insurance. Other activities that can trigger insurance needs include hiring employees, leasing space, using vehicles, raising money, and having a board.
Insurance needs vary by industry, vehicles used, staffing models, formal contracts, and province. While insurance isn’t necessarily a legal requirement for all startups, landlords, clients, lenders, platforms, and investors often require proof of insurance before dealing with you.
Choosing the Best Insurance for Your Business: Dos and Don’ts
To allow your broker to obtain comparable quotes, provide them with a written inventory of your exposures, including:
- legal entity;
- locations of operations;
- revenues by activity and country;
- clients, products and professional services;
- employees and contractors; and
- property, vehicles, data, payment systems and previous claims.
Do: Use Insurance to Meet a Defined Risk or Contract
Insurance will not signal the company’s stability, inspire investor confidence, or drive growth. What it can do is provide financial help for covered events, including legal defence costs, property damage, business interruption and cyber response costs. It can also help fulfil an insurance obligation required by a landlord or customer.
Read More: See How a Business Owner’s Policy Works
Don’t: Default to Generic Small Business Insurance
Packaged policies are convenient to buy, but may not provide appropriate coverage for all areas of operation. For instance, a software company may not own much property, but may need technology errors and omissions coverage. Likewise, a policy designed for a typical office operation would not cover a contractor’s specific exposures, such as tools, commercial auto, installation and completed operations.
Tell your broker and insurer everything your business does to make money. You might think being classified as a “technology company” will cover everything, but you’ll have a problem if an operation isn’t accepted for coverage.
Separate Business Coverage From Personal Founder Protection
| Coverage | Exposure it may address | Question to ask |
|---|---|---|
| Commercial general liability | Third-party bodily injury or property damage | Does this include product liability, completed-operations liability, tenant liability and contractual liability? |
| Professional or technology E&O | Claims of financial loss resulting from services, advice or technology failure | Is this a claims-made policy? If so, what retroactive date applies? What exclusions apply? |
| Directors and officers liability | Claims alleging wrongful acts in a director or officer capacity | Which entities and people are insured? How are defence costs treated? |
| Employment practices liability | Employment-related allegations | Are applicants or contractors covered? Are wage claims or prior acts excluded? |
| Key person life or disability | Financial loss resulting from the death or incapacity of an essential person | Who owns the policy, receives the benefit and documents the amount? |
| Cyber insurance | Incident response, restoration, business interruption and third-party liability resulting from a cyber event | Which incidents, vendors, data, waiting periods and security conditions apply? |
Directors and officers insurance does not protect a founder’s assets from every lawsuit, and key person insurance is owned by the business to make up for its loss. Individual disability or life insurance helps cover the founder’s household needs. Business insurance is not personal insurance and vice versa.
Don’t: Just Buy the Cheapest Policy Online
Ask each broker to quote from the same written submission and identify differences in limits, deductibles, exclusions, defence costs, sublimits and endorsements. A certificate of insurance shows that a policy existed at a point in time, not the full contract.
Do: Time Your Insurance Around Key Milestones
| Milestone | New exposure | Review before the milestone |
|---|---|---|
| Register or work from home | Commercial property, business-related visitors and activities may not be covered by your home insurance | Home insurer notice, business property, CGL and professional liability |
| Sign the first client | Indemnification, insurance limits, data commitments and service promises | CGL, E&O, cyber, territorial scope and certificate terms |
| Launch a product | Product injury, recall, performance and IP allegations | Product liability, completed operations, E&O and contract review |
| Raise funds or form a board | Governance, securities and investor allegations | D&O application, insured entities, prior acts and reporting duties |
| Hire the first worker | Payroll obligations, employment-related claims, injuries, damages and workplace safety | Provincial workplace rules, EPLI, benefits and employment practices |
| Collect sensitive data | Cyber breach, extortion, outage and regulatory investigation | Security controls, incident plan, vendor terms and cyber insurance |
Read More: Explore Business Insurance Options
Do: Pair Cyber Insurance With Security Controls
The Canadian Centre for Cyber Security has a list of basic cyber security recommendations for smaller organizations, including identifying systems and data, assigning responsibility, creating an incident response plan, updating software, using robust authentication, encrypting data, controlling access, backing up data and training staff.
When completing cyber insurance applications, ensure the information provided is accurate. If certain security measures or controls are not in place, do not represent that they are. Organizations should identify conditions, vendors or time frames for breach notification that could affect whether a claim is paid.
Read More: Use the Small-Business Data Breach Prevention Guide
Protect IP Risk Through Contracts, Controls and Appropriate Coverage
CIPO recommends that startups have written agreements with employees, partners, freelancers and contractors about IP ownership and assignment.
If you hire a freelancer or contractor to produce an item that has copyright, it may belong to the creator unless you have a written agreement assigning the copyright to you.
Have a lawyer review agreements involving valuable IP, including terms concerning licences, assignments, confidentiality and indemnity.
An IP, media liability or E&O insurance policy may cover specific claims or legal defence costs but will not establish IP ownership.
Read More: Read About Insurance Gaps in Outsourced Work
Do: Coordinate Policies Instead of Assuming They Stack
Definitions, exclusions, other-insurance clauses and sublimits may result in policies providing duplicate coverage or leaving a costly gap. Confirm with your broker:
- whether defence costs are paid inside or outside the policy limit;
- which policy would respond to each of the main risks facing the operation;
- the retroactive date and any run-off or extension provisions for claims-made policies;
- that all operating entities requiring coverage are named insureds;
- whether the territorial limits cover employees, customers, information and potential claimants outside Canada;
- whether additional insured endorsements and contractual insurance requirements can be provided before accepting them; and
- when you must report changes in the operation’s size, scope, revenue, services, ownership, staff, locations or countries.
Read More: Read the Home-Based Business Insurance Guide