Business Insurance and Coverage Disputes: CGL, E&O, Cyber, and D&O

Summary. Insurance is the only asset most businesses own that pays out precisely when everything else is going wrong, and it is the asset owners understand least. This article explains the policies a business actually needs, how each responds, and where coverage fights come from: the CGL policy including the much-overlooked Coverage B for personal and advertising injury that funds many IP and defamation defenses; occurrence versus claims-made triggers, retroactive dates, and tail coverage; and the duty to defend, which is broader than the duty to indemnify and turns on the allegations rather than the facts, along with reservations of rights, independent counsel, and allocation. Sections on technology E&O, cyber, D&O, EPLI, and the contractual insurance requirements in every lease and vendor agreement follow, with claim-handling guidance, a worked example, an FAQ, and related reading.

A software company is sued by a competitor for false advertising, trade libel, and trademark infringement. The general counsel budgets $600,000 for the defense and does not tender the claim to the company's general liability carrier, because "we don't have IP insurance."

The company had Coverage B of a standard CGL policy the whole time. "Personal and advertising injury" includes, among other things, oral or written publication of material that slanders or libels a person or organization or disparages its goods, products, or services, and the use of another's advertising idea in the insured's advertisement, and infringement of copyright, trade dress, or slogan in the insured's advertisement. The complaint alleged conduct falling at least potentially within those definitions, which is all it takes to trigger the duty to defend.

The company paid for its own defense for eleven months and then tendered late. It recovered part of the fees and litigated about the rest.

Insurance is the least glamorous line on a budget and the highest-leverage one in a bad year. This article is about knowing what you already have.

The short answer

The core policies a business needs:

Two rules govern almost every coverage dispute:

1. The duty to defend is broader than the duty to indemnify. It is triggered by the potential for coverage based on the allegations, and it applies to the entire suit if any claim is potentially covered.
2. Notice matters. Claims-made policies require the claim to be made and reported during the policy period (or an extended reporting period). Late notice defeats coverage that would otherwise have existed.

Part I: The CGL policy

The standard form is an industry document, and reading it in order tells you how it works: Insuring Agreement → Exclusions → Definitions → Conditions. Coverage is broad on page one and shaped almost entirely by the exclusions.

Coverage A: bodily injury and property damage

Covers sums the insured becomes legally obligated to pay as damages because of bodily injury or property damage caused by an occurrence — defined as "an accident, including continuous or repeated exposure to substantially the same general harmful conditions" — during the policy period, in the coverage territory.

Key exclusions:

• Expected or intended injury.
• Contractual liability, with a large exception for liability assumed in an "insured contract," which is why indemnity obligations in leases and vendor agreements are frequently covered. This exception is the reason to check whether an indemnity you sign falls within the definition. See Indemnification and Limitation of Liability.
• Employer's liability (workers' compensation covers it).
• Pollution, broadly written and heavily litigated.
• Auto, aircraft, and watercraft.
• Damage to your product, your work, and impaired property — the "business risk" exclusions. This is why a CGL policy does not pay to redo defective work; it pays for the resulting damage to other property. Understanding this distinction prevents most disappointed expectations in construction and manufacturing.
• Recall.
• Personal and advertising injury (covered under Coverage B instead).
• Electronic data as property damage, which is why cyber policies exist.

Coverage B: personal and advertising injury

The most valuable and least understood part of a CGL policy for a technology or consumer business.

"Personal and advertising injury" is defined to include injury arising out of one or more of these enumerated offenses:

• False arrest, detention, or imprisonment;
• Malicious prosecution;
• Wrongful eviction from, wrongful entry into, or invasion of the right of private occupancy of premises;
• Oral or written publication of material that slanders or libels a person or organization or disparages a person's or organization's goods, products, or services;
• Oral or written publication of material that violates a person's right of privacy;
• The use of another's advertising idea in your "advertisement"; or
• Infringing upon another's copyright, trade dress, or slogan in your "advertisement."

What this means in practice. Claims for defamation, trade libel, disparagement, false advertising with a disparagement component, certain right-of-publicity and privacy claims, and copyright or trade dress infringement in advertising are potentially covered. That is a substantial slice of the disputes a modern business faces.

What it does not cover. The standard exclusions to Coverage B are extensive: knowing violation of another's rights; material published with knowledge of falsity; material published before the policy period; criminal acts; breach of contract; quality or performance of goods (failure to conform to statements); wrong description of prices; infringement of patent or trademark (other than trade dress or slogan in an advertisement); insureds in the business of advertising, broadcasting, publishing, or telecasting; electronic chatrooms or bulletin boards; unauthorized use of another's name or product in a domain name or metatag; and violations of statutes restricting the sending of communications (which is how insurers exclude TCPA and similar claims).

The recurring litigation concerns whether a claim "arises out of" an enumerated offense and whether the alleged conduct occurred "in your advertisement," defined as a notice broadcast or published to the general public or specific market segments about goods, products, or services for the purpose of attracting customers. Courts have divided, and the outcome frequently turns on how the underlying complaint is pleaded.

Practical instruction: tender every claim. The cost of tendering is a letter. The cost of not tendering is the entire defense. Tender false advertising, defamation, trade dress, right of publicity, privacy, and unfair competition claims to the CGL carrier as a matter of routine.

Part II: Occurrence versus claims-made

The single most consequential structural distinction in commercial insurance.

Occurrence policies (CGL, property, auto, workers' comp) respond to injury or damage that happens during the policy period, regardless of when the claim is made. A 2019 policy covers a 2019 injury reported in 2026.

Claims-made policies (E&O, cyber, D&O, EPLI) respond only if the claim is first made against the insured during the policy period and, in a claims-made-and-reported policy, is also reported during the policy period or within a short extension.

Three features of claims-made policies must be understood:

The retroactive date. Coverage applies only to wrongful acts occurring on or after the retroactive date. Switching carriers and accepting a new retroactive date destroys coverage for everything before it. Always negotiate for the retroactive date to be maintained (full prior acts is best), and treat a carrier's proposal to move it as a material reduction in coverage regardless of the premium.

Extended reporting period (tail). An option to report claims for a period after the policy ends for wrongful acts occurring before it ends. Essential when:

• A professional practice or business is sold or dissolved;
• Coverage is not renewed or the carrier is changed with a new retroactive date;
• A key professional retires.

Tail coverage is typically priced as a percentage of the expiring premium (often 100 to 200 percent for one to three years), and the right to purchase it, the length, and the price should be negotiated at binding, not at expiry. In a business sale, who buys and pays for the tail is a deal term. See Buying and Selling a Small Business.

Prior knowledge and warranty statements. Claims-made applications ask whether the insured knows of circumstances that could give rise to a claim. An inaccurate answer supports rescission. Answer carefully, and report circumstances under the expiring policy before renewing rather than carrying them silently into a new one.

Part III: The duty to defend

It is broader than the duty to indemnify

The foundational principle. Gray v. Zurich Insurance Co., 65 Cal. 2d 263 (1966), is the leading articulation: the carrier must defend a suit that potentially seeks damages within the coverage of the policy, and the duty arises from the allegations rather than from the ultimate facts. As the courts put it, the duty to defend is measured by the potential for coverage, and any doubt is resolved in favor of the insured.

Two corollaries:

The complete defense obligation. If any claim in the suit is potentially covered, the carrier must defend the entire action, including uncovered claims. Insurers then seek allocation of ultimate indemnity, not of defense costs, in most jurisdictions.

Extrinsic facts. Jurisdictions split on whether the carrier must consider facts outside the complaint that would establish potential coverage. Texas applies a strict eight-corners rule (the four corners of the complaint against the four corners of the policy), with a narrow exception recognized in more recent decisions; California and many other states require the carrier to consider extrinsic facts known to it.

Reservation of rights and independent counsel

A carrier that defends while disputing coverage issues a reservation of rights letter. That creates a conflict: the carrier's appointed defense counsel could steer the case toward an uncovered theory.

The remedy is independent counsel, paid by the carrier but selected by the insured. California codified it at Civil Code § 2860 following San Diego Navy Federal Credit Union v. Cumis Insurance Society, Inc., 162 Cal. App. 3d 358 (1984), which is why such lawyers are universally called Cumis counsel. The statute limits rates to those the carrier ordinarily pays in the community and imposes qualification requirements. Other states reach similar results through common law with varying triggers.

Not every reservation creates the right. The conflict must be one where the outcome of the coverage issue can be controlled by counsel defending the underlying case. A reservation based purely on a legal question the defense cannot influence, or on the policy limit, generally does not.

Settlement, consent, and bad faith

• Consent to settle. Most liability policies bar the insured from settling without the carrier's consent, and bar the carrier from settling without the insured's consent in some professional lines ("hammer clauses" penalize an insured who refuses).
• Bad faith. An insurer that unreasonably denies coverage, fails to investigate, or refuses a reasonable settlement within limits exposing the insured to an excess judgment may face extracontractual liability, and in many states the remedy is the entire judgment, not just the policy limits. This is the reason carriers settle within limits when a reasonable opportunity presents itself, and the reason insureds should document demands within limits carefully.
• Cumulative or "stacking" issues arise where injury spans multiple policy periods. Montrose Chemical Corp. v. Admiral Insurance Co., 10 Cal. 4th 645 (1995), addressed continuous injury triggers, and long-tail claims (environmental, construction defect, product) generate their own allocation jurisprudence.

Part IV: The specialty lines

Technology and professional errors and omissions

Covers claims arising from the performance of professional services or the failure of technology products to perform as intended. It fills the CGL's largest gap for a services or software business, because the CGL excludes claims arising from the quality or performance of the insured's own work.

Look for:

• Definition of professional services broad enough to cover everything you actually do.
• Contractual liability coverage (many E&O forms exclude liability assumed by contract, which is a problem given how much of a technology company's exposure is contractual).
• Third-party IP infringement coverage, and whether patent is excluded (it usually is).
• Breach of warranty and failure to deliver coverage.
• Cost of corrections / mitigation coverage.
• Subcontractor acts included.

Cyber

Splits into first-party and third-party coverage, and the first-party side is where the money usually goes.

First-party: breach response (forensics, legal, notification, call center, credit monitoring), business interruption and contingent business interruption from a vendor's outage, digital asset restoration, cyber extortion and ransom, and reputational harm.

Third-party: network security liability, privacy liability, regulatory defense and fines where insurable, PCI assessments, and media liability.

What to check: the sublimits (breach response and ransomware are often sublimited well below the aggregate); the waiting period for business interruption; whether contingent business interruption covers your actual vendors; whether the panel of approved forensic and legal vendors includes people you would choose; whether social engineering / funds transfer fraud is included or requires a crime policy; and the warranty questions about your controls, because an inaccurate answer about MFA deployment is a rescission risk. See Data Breach and Incident Response Toolkit.

Directors and officers

Three insuring agreements:

• Side A: covers individual directors and officers where the company cannot indemnify them (insolvency, or where indemnification is legally prohibited). The coverage individuals care most about; consider a separate Side A DIC policy.
• Side B: reimburses the company for indemnification it provides.
• Side C: entity coverage, typically limited to securities claims for public companies and sometimes broader for private ones.

Watch the insured versus insured exclusion (and its carve-backs for derivative suits, bankruptcy trustees, and former officers), the conduct exclusions (fraud and personal profit, which should require a final, non-appealable adjudication in the underlying action rather than merely an allegation), severability of the application and of exclusions, and the priority of payments provision ensuring individuals are paid first.

Private companies need D&O more than they think: the claims come from investors, former employees, competitors, and regulators, not from public shareholders.

Employment practices liability

Covers discrimination, harassment, retaliation, wrongful termination, and related claims. Note the standard exclusions: wage and hour claims are typically excluded or covered only for defense costs with a modest sublimit, which is a significant gap given that wage-hour is the largest employment exposure for most businesses. See Wage and Hour Law Under the FLSA and Workplace Harassment and Hostile Work Environment Claims.

Also check whether third-party EPLI (claims by customers and vendors alleging discrimination or harassment by your employees) is included.

Property, business interruption, and the coverages people forget

Commercial property covers the insured's own buildings, contents, inventory, and improvements. Two choices drive whether a loss is actually made whole:

• Replacement cost versus actual cash value. ACV deducts depreciation and routinely leaves a business unable to rebuild. Buy replacement cost, and understand that most replacement cost policies pay ACV first and the depreciation holdback only when repair or replacement actually occurs.
• Coinsurance. If the limit is less than the stated percentage (commonly 80 or 90 percent) of the property's value, the insurer pays only a proportionate share of every loss, including partial losses. Underinsurance therefore penalizes small claims, not just total ones. Review values annually; construction cost inflation has left many policies badly underinsured.

Business interruption covers lost net income and continuing expenses during the period of restoration. The recurring disappointments: the waiting period (often 72 hours), the requirement of direct physical loss or damage to covered property (which is why pandemic closure claims overwhelmingly failed), and a period of restoration that ends when the property could reasonably be repaired, not when the business actually recovers its customers. Extended period of indemnity coverage addresses that last gap and is worth buying.

Contingent business interruption responds when a supplier's or customer's premises are damaged. Confirm whether the endorsement covers only named locations or any supplier, because a named-location form is worthless when the failure is three tiers down the supply chain.

Coverages businesses routinely lack and later wish they had: employment practices liability; cyber with an adequate ransomware sublimit; crime coverage including social engineering / funds transfer fraud (which is excluded from most cyber forms and is the most common actual loss a small business suffers); umbrella limits sized to the largest contractual requirement rather than to habit; key person and buy-sell funding life insurance where the business depends on one or two people; and employment practices third-party coverage for customer-facing businesses.

Part V: Contractual insurance requirements

Every commercial lease, vendor agreement, and construction contract contains an insurance article, and it is usually copied from a form nobody has read against the actual policies.

Additional insured status

A contract commonly requires the counterparty to name you as an additional insured. What that actually delivers depends on the endorsement.

• Blanket versus scheduled. A blanket endorsement covers anyone the named insured is required by written contract to add; a scheduled endorsement lists specific entities. Blanket is easier to administer; scheduled is more certain.
• Ongoing operations versus completed operations. Many endorsements cover only ongoing operations, leaving you unprotected for claims arising after the work is done. In construction and installation contexts, require both.
• Scope. Modern endorsements limit coverage to liability caused in whole or in part by the named insured's acts or omissions, and only to the extent permitted by law. Older forms were broader. Read the actual endorsement, not the certificate.
• Primary and non-contributory. Without this, your own carrier and theirs will fight about who pays first, and your policy may end up contributing. Require it expressly and confirm the endorsement exists.

Certificates of insurance are not coverage

A certificate of insurance is an informational document that expressly disclaims conferring rights. It proves a policy existed on the date issued and nothing more. It does not amend the policy, and the "30 days' notice of cancellation" language on most certificates is not binding on the carrier.

What to do instead: require delivery of the actual endorsements (additional insured, waiver of subrogation, primary and non-contributory) for material relationships, require renewal certificates automatically, and put a contractual obligation on the counterparty to notify you of cancellation or material reduction.

Waiver of subrogation

Prevents the counterparty's carrier from suing you after paying its insured's claim. It must be permitted by the policy (most allow it if agreed in writing before the loss) and should be reciprocal. Cheap to obtain, valuable in a loss.

Getting the requirements right

Common errors in insurance articles: requiring limits that are unavailable or uneconomic for a small counterparty; requiring an "occurrence" form for professional liability, which is not sold that way; requiring coverages irrelevant to the work; and failing to require the coverages that matter (cyber for a data-handling vendor, professional liability for a design professional, auto for anyone driving).

Match the requirements to the actual risk, require evidence of the endorsements rather than a certificate alone, and have your broker review the article. See Cloud and SaaS Agreements and Commercial Leases for Small Businesses.

Part VI: Handling a claim

The first week determines a large share of the outcome.

1. Notice immediately, to every potentially applicable policy. Do not decide which policy applies; tender to all of them. Notice under a claims-made policy is a condition of coverage, and late notice is the most common reason valid claims are denied.
2. Notice of a "circumstance." Most claims-made policies permit reporting circumstances that may give rise to a claim, which locks coverage into the current policy period even if the claim arrives years later. Use it before renewal.
3. Comply with the notice provisions exactly: to the address stated in the policy, in the manner stated, with the required content. Notifying your broker is not always notice to the carrier; confirm.
4. Preserve evidence and issue a hold. See Litigation Hold and Evidence Preservation Checklist.
5. Do not admit liability or settle without consent, which is a policy condition and a common ground for denial.
6. Read the reservation of rights letter carefully, identify what is reserved, and assess whether independent counsel is available.
7. Cooperate, which is also a policy condition, while coordinating with coverage counsel on privileged material.
8. Track defense costs and whether they erode the limit. Many professional and cyber policies are wasting or burning limits policies where defense costs reduce the amount available to pay a judgment. That changes settlement strategy fundamentally.
9. Push back on denials in writing, with the policy language, the allegations, and the applicable rule on the duty to defend. A substantial share of first denials are reversed on a well-supported second submission.
10. Consider coverage counsel separate from defense counsel whenever the amount at stake justifies it. The interests differ.

A worked example

Fernwood Analytics (fictional), a 60-person SaaS company, faces three claims in one year.

Claim 1: a competitor's suit alleging false advertising, trade libel, and trade dress infringement in Fernwood's marketing campaign.

Coverage: CGL Coverage B. Trade libel and disparagement are enumerated offenses; trade dress infringement in an advertisement is expressly within the definition. The trademark infringement count is excluded, but because at least one claim is potentially covered, the carrier must defend the entire action. Fernwood should tender immediately and expect a reservation of rights as to indemnity.

Claim 2: a customer's suit alleging that a defect in Fernwood's platform caused three weeks of order processing failures and $2.1 million in lost revenue.

Coverage: Not the CGL — this is the insured's own product failing to perform, squarely within the business risk exclusions, and pure economic loss is not "property damage." This is technology E&O. Fernwood should check whether its E&O form excludes contractual liability, because the customer's claim will be pleaded in contract, and whether the retroactive date predates the software version at issue.

Claim 3: a ransomware incident encrypting production systems for four days, with exfiltration of customer records.

Coverage: Cyber, on both sides. First-party: forensics, legal, notification for the affected records, credit monitoring, business interruption for the four days subject to the waiting period, and ransom if paid with carrier consent. Third-party: liability to customers and regulatory defense. Fernwood must use the carrier's panel vendors or obtain consent, and must check the sublimit on ransomware, which in its policy is $500,000 against a $5 million aggregate.

What Fernwood learns: three claims, three different policies, and the one it would not have thought to tender (the CGL, for the competitor suit) was the one with the broadest defense obligation. It also learns that its cyber sublimit for ransomware is inadequate, that its E&O retroactive date was reset two carriers ago, and that nobody had confirmed whether defense costs erode the E&O limit. All three are renewal conversations to have before the next incident, not after.

Checklists

Annual insurance review

• Inventory every policy: line, carrier, limits, retention, policy period, retroactive date, and whether defense costs erode limits.
• Confirm no gap between retroactive dates and the start of the relevant operations.
• Reconcile limits against contractual requirements in leases and material customer contracts.
• Confirm additional insured, primary and non-contributory, and waiver of subrogation endorsements are actually in place where promised.
• Review sublimits, especially cyber ransomware and breach response.
• Review exclusions against the business's actual activities (new products, new states, new data types, AI features).
• Confirm EPLI wage-and-hour treatment and consider a separate sublimit.
• Confirm D&O conduct exclusions require final adjudication and that severability is present.
• Report any known circumstances before renewal.
• Confirm tail rights and pricing are stated in the policy, not left to negotiation later.

On a claim

• Tender to every potentially applicable policy immediately, in the manner the policy requires.
• Diary the notice, and confirm receipt.
• Issue a litigation hold.
• Do not admit liability, settle, or incur significant defense costs without consent.
• Analyze the reservation of rights and the availability of independent counsel.
• Track whether defense costs erode limits.
• Respond to any denial in writing with policy language and the duty-to-defend standard.

Frequently asked questions

Does our general liability policy cover intellectual property claims? Partly, and more than most businesses realize. Coverage B reaches copyright, trade dress, and slogan infringement in your advertisement, plus disparagement and privacy offenses. Patent and (outside advertising) trademark are excluded. Tender anyway; the duty to defend is triggered by potential coverage.

What is the difference between occurrence and claims-made? Occurrence policies respond to events during the policy period whenever the claim arrives. Claims-made policies respond only to claims first made (and usually reported) during the policy period, subject to a retroactive date.

What is tail coverage and when do I need it? An extended reporting period for claims-made policies. Buy it when you sell or close the business, when a professional retires, or whenever you change carriers and cannot preserve the retroactive date.

The carrier is defending under a reservation of rights. Is that bad? It is normal. It means the carrier is defending while preserving coverage defenses. Assess whether the reservation creates a conflict entitling you to independent counsel at the carrier's expense.

Do defense costs count against our limit? In CGL, usually not — defense is outside the limit. In most professional, cyber, and D&O policies, yes, and that materially changes strategy. Check every policy.

Our claim was denied. Is that the end? Frequently not. Respond in writing with the policy language and the allegations, addressing the duty to defend separately from indemnity. Consider coverage counsel. Denials are reversed regularly, and an unreasonable denial can expose the carrier to bad faith liability.

A vendor sent a certificate of insurance. Are we protected? Not necessarily. A certificate is informational and disclaims conferring rights. Ask for the actual additional insured, primary and non-contributory, and waiver of subrogation endorsements.

Does cyber insurance cover a ransom payment? Usually, subject to a sublimit, carrier consent, and sanctions screening. Confirm the sublimit is adequate; ransomware sublimits are frequently a small fraction of the aggregate.

Do we need D&O if we are private? Yes. Private company D&O claims come from investors, former employees, competitors, and regulators. The absence of public shareholders removes one source, not the exposure.

What is the highest-return insurance decision a small business makes? Reading the policy once, with a broker or coverage counsel, against a list of what the business actually does. Most coverage gaps are discovered at claim time and were visible at binding.

Should we use the same broker for everything? Usually yes for coordination, but insist that the broker present the actual policy forms and endorsements rather than a proposal summary, and that material changes between expiring and renewal terms be flagged in writing. A broker who cannot explain why the retroactive date moved, or why a sublimit appeared, is not doing the part of the job that matters.

Closing thought

Insurance failures are rarely about the premium. They are about three quieter things: a policy nobody read, a claim nobody tendered, and a retroactive date nobody noticed when the broker moved the account to save eight percent.

The discipline is modest. Keep a one-page schedule of every policy with limits, retentions, retroactive dates, and whether defense erodes the limit. Reconcile it annually against what the business now does and against what the contracts now require. Report circumstances before renewal. And when something goes wrong, tender to everything, immediately, in writing.

The competitor's lawsuit that arrives on a Tuesday is not the moment to discover you were insured for it all along.

Related articles

• Indemnification and Limitation of Liability — the contractual obligations insurance backs.
• Insurance Coverage Toolkit — the full placement-to-claim roadmap.
• Commercial Leases for Small Businesses — the lease insurance article.
• Cloud and SaaS Agreements — vendor insurance requirements.
• Data Breach and Incident Response Toolkit — using cyber coverage in an incident.
• Workplace Harassment and Hostile Work Environment Claims — EPLI's core exposure.
• Wage and Hour Law Under the FLSA — the exposure EPLI usually excludes.
• Product Liability for Manufacturers, Distributors, and Sellers — where CGL Coverage A matters most.
• Buying and Selling a Small Business — tail coverage as a deal term.
• False Advertising and Lanham Act Section 43(a) — the claims Coverage B may fund.

This article is provided for general informational purposes and does not constitute legal advice. Policy language varies by carrier and form, and coverage law varies significantly by state. Consult qualified coverage counsel and a licensed broker about any particular policy or claim.