Most UK business owners assume their business interruption insurance works like a financial parachute: disaster strikes, you file a claim, the insurer covers the revenue you lost whilst you got back on your feet. That assumption held up reasonably well in an era of burst pipes and warehouse fires. It holds up far less reliably when the disaster is a cloud provider going down for six hours, a SaaS platform suspending your account, or a ransomware attack locking your entire operation out of its own systems. The gap between what policyholders expect and what standard BI policies actually pay out in a tech outage is, frankly, significant.
I’ve spoken to enough UK founders who’ve had unpleasant post-incident conversations with their brokers to know this is not a fringe concern. Understanding what your policy genuinely covers is not optional any more.
What business interruption insurance is actually designed to do
Business interruption insurance (often called BI insurance or business income insurance in policy documents) is designed to replace the income a business loses when it cannot trade due to physical damage. That last phrase is the one that causes problems. Traditional BI policies are typically triggered by an insured physical loss, meaning a fire, flood, or theft that causes material, tangible damage to your property or premises. The policy then covers lost revenue, fixed overheads, and sometimes additional costs incurred whilst you get back to normal trading.
The Financial Conduct Authority’s guidance, and the Supreme Court ruling on the FCA’s BI test case in January 2021, clarified a great deal about coverage disputes arising from the pandemic. That ruling confirmed that non-damage triggers can be legitimate grounds for BI claims under certain policy wordings. But it also reinforced just how dependent your outcome is on the precise language in your own policy document. No two policies are identical, and the difference of a single clause can mean the difference between a six-figure payout and a politely worded rejection letter.
Cloud outages and SaaS failures: where most standard policies fall short
Here is the core problem with a business interruption insurance UK tech outage claim: if AWS, Microsoft Azure, or Google Cloud goes down and takes your entire operation with it, there is usually no physical damage at your premises. Your servers are not on fire. Your roof has not caved in. From a standard policy’s perspective, nothing insurable has happened to you.
Some policies include what is called a “contingent business interruption” (CBI) extension, which covers losses caused by damage at a supplier’s or customer’s site. These extensions were written with physical supply chains in mind: your timber supplier’s warehouse burns down, so you cannot manufacture. Whether a cloud provider’s outage qualifies as contingent loss under that wording is genuinely contested, and most insurers argue it does not unless the CBI clause specifically names digital or technology suppliers.
SaaS platform failures follow the same logic. If your accounting platform, CRM, or project management tool goes offline and halts billable work, a standard BI policy will almost certainly not respond. The insurer’s position is clear: no physical damage, no trigger. I’d strongly recommend checking whether your current policy even mentions technology service dependency, because the majority do not.
Cyber insurance and the overlap question
This is where UK businesses often assume they are covered twice, when in reality they may be covered nowhere. Cyber insurance policies do typically cover business interruption losses arising from a security incident, but the definition of “security incident” matters enormously. A ransomware attack that encrypts your files and halts operations is usually covered under a cyber BI extension. An external cloud outage that is nothing to do with your own security posture may not be, because the triggering event was not a breach of your systems.
The gap between your BI policy (no physical damage) and your cyber policy (no breach of your own systems) is where a pure cloud infrastructure outage tends to land. Both policies point at the other as responsible, and the outcome for your business is the same either way. This is not a hypothetical scenario: the July 2024 CrowdStrike incident, which caused widespread IT failures across thousands of businesses globally including many UK firms, produced exactly this kind of coverage dispute.
If you are thinking about how broader technology risk sits within your business, the question of AI liability for UK businesses using third-party models raises very similar contractual and insurance questions about who bears responsibility when an external platform fails you.
What actually does get covered: the policy types worth knowing
Not all BI coverage is inadequate for tech risks. A few things to look for when reviewing or purchasing cover:
Cyber business interruption extensions. A well-structured standalone cyber policy will include a BI component that covers revenue loss from ransomware, data breaches, and sometimes system failures caused by external security incidents. The waiting period (often 8-12 hours before the clock starts for BI losses) and the indemnity period (usually 3-12 months) vary significantly. Read both carefully.
Technology E&O policies. For tech businesses specifically, Errors and Omissions cover can include first-party BI protection when your own software or infrastructure fails and causes client losses. This is different from general BI insurance and is worth exploring if you sell or operate technology services.
Named perils vs. all-risks wordings. An all-risks BI policy with a specific technology or systems failure extension is more likely to respond to a cloud outage than a named-perils policy that only lists fire, flood, and theft. Broader wordings cost more. They are usually worth it for businesses whose revenue depends on continuous digital operations.
The Association of British Insurers publishes guidance on business insurance categories that is worth reading before you sit down with a broker. Understanding the terminology before that conversation means you are far less likely to walk away with a policy that sounds comprehensive and turns out not to be.
Questions to ask your broker before your next renewal
Rather than waiting for an incident to find out what you are not covered for, I’d treat your next renewal as an opportunity to stress-test the policy against realistic scenarios. Specifically, ask your broker to answer these in writing:
Does the policy respond if a named third-party cloud infrastructure provider has an outage that halts our operations entirely? Does the cyber policy’s BI extension cover external platform failures that are not caused by a breach of our own systems? What is the minimum downtime before the BI clock starts, and is that period realistic for how quickly our revenue impact materialises? Is the indemnity period sufficient for a realistic recovery timeline, particularly if recovery involves migrating to a new platform?
If your broker cannot answer these questions with reference to specific policy clauses, that itself tells you something. This is also a sensible moment to revisit how cloud-native your business has become. If you have moved finance functions to cloud-based platforms, which many UK SMEs are doing at pace as I discussed in a related piece on UK SMEs moving finance to cloud-native ERP platforms, your exposure to third-party digital downtime is materially higher than it would have been five years ago.
Documenting your losses before an incident, not after
One practical step that significantly improves your chances of a successful claim, whatever the policy type, is having clean records of your normal revenue run rate. Insurers calculating BI losses will look at your financial history to establish what you would have earned during the interruption period. If your records are inconsistent, seasonal without explanation, or hard to reconcile, the insurer’s loss adjuster will make conservative assumptions that do not work in your favour.
Keeping clear monthly revenue records, documenting your key technology dependencies (which platforms, which contracts, what SLAs your suppliers provide), and maintaining an incident log if something does go wrong all strengthen a claim considerably. The growing expectation around financial transparency for UK businesses is pushing better record-keeping broadly, and BI claims management benefits from the same discipline.
The short version is this: business interruption insurance was not built with cloud infrastructure in mind, most standard policies will not respond to a tech outage without specific extensions, and the assumption that either your BI or cyber policy has you covered is often wrong. Get the answer in writing before you need it.
Frequently Asked Questions
Does standard business interruption insurance cover a cloud outage in the UK?
Most standard BI policies require a physical damage trigger, such as fire or flood, to activate. A cloud provider outage typically does not meet this threshold, meaning a standard policy is unlikely to pay out. You need a specific technology or cyber BI extension for that kind of coverage.
Will my cyber insurance cover lost revenue from a ransomware attack?
Most standalone cyber insurance policies include a business interruption component that covers revenue lost during a ransomware incident. However, there is usually a waiting period of 8-12 hours before the clock starts, and indemnity periods vary. Check your policy wording carefully, as coverage for external platform failures not caused by a breach of your own systems is often excluded.
What is contingent business interruption insurance and does it cover SaaS failures?
Contingent BI insurance covers losses caused by damage at a supplier’s or customer’s site. It was originally designed for physical supply chain disruptions and most insurers do not consider a SaaS or cloud platform outage to qualify unless the policy specifically names digital or technology suppliers. This is worth confirming with your broker.
How do I work out if my UK business is underinsured for tech-related interruptions?
List every cloud platform, SaaS tool, or digital service your business depends on to generate revenue, then check whether your BI and cyber policies explicitly address failure of those third-party systems. If the policies are silent on external technology dependency, you almost certainly have a coverage gap worth addressing at your next renewal.
What documentation should I keep to support a business interruption claim after a tech incident?
Keep monthly revenue records that are easy to reconcile, a log of which technology systems were affected and when, any communications from the platform provider about the outage, and a record of additional costs you incurred to work around the disruption. Loss adjusters use historic financials to calculate what you would have earned, so clean, consistent records materially improve your claim outcome.