Cyber insurance in Ireland: what it covers and how to compare

Somebody tells you to get cyber cover: a client’s procurement team, say, or a line in your renewal letter. The broker pages all carry the same bullet list, and none shows the wording. If the insurer’s questionnaire is already on your desk, the AI questions on it have a guide of their own.

This page works from the paper instead: the public Republic of Ireland wordings from Travelers and CFC linked below, Chubb’s Irish proposal form and AIG’s Irish service sheets, set against the Irish statutes that change how those documents behave once something goes wrong.

What cyber insurance covers in Ireland, clause by clause

Both Irish wordings cited here split into two halves. First party pays your bills: incident response, forensics, notification letters, restoring data, lost income, a ransom negotiation. Third party, sold as cyber liability insurance, pays when a client, a regulator or a card scheme comes after you.

The labels differ by insurer, and that is where comparisons go wrong. Pick an incident below and you’ll see which clause in each Irish wording would be the one to argue from. A misdirected email is in the list because, as the guide on accidental disclosures explains, it’s a breach too.

If I could show a broker only one row, it would be the invoice one. A lookalike email domain that fools your client may never touch your systems at all, and one wording asks for a breach while the other doesn’t.

What cyber insurance does not cover: GDPR fines, panels and a second 72 hours

Neither wording promises to pay a Data Protection Commission fine. Travelers pays fines “only to the extent they are insurable”; CFC excludes them “unless insurable by law”. The State Claims Agency’s cyber guidance for public bodies is blunter: fines and penalties are “unlikely to be insurable”.

The CFC wording carries a second catch. For the first 72 hours after you discover a cyber event you may spend without consent, but outside firms must come from its approved claims panel. After that, costs need the claims manager’s written consent. So your own IT people may not be on the job.

Definitions decide these claims, much as they decide whether your own apps leak data to AI, and nobody reads them until the bad day. Ask for the panel list before signing. I wouldn’t want to find out mid-incident that my own IT firm can’t bill the insurer.

Is your business a consumer under the Consumer Insurance Contracts Act?

Ireland’s Consumer Insurance Contracts Act 2019 borrows its definition of consumer from section 2 of the Financial Services and Pensions Ombudsman Act 2017. That definition reaches well beyond households. It takes in sole traders, partnerships and charities, and limited companies too, if turnover in the previous financial year was €3 million or less.

Most of the organisations that buy cyber cover because a client demands it, small practices and clinics among them, sit under that line without knowing it. Try the test below with last year’s accounts open.

I can’t tell you whether a given clause in your schedule survives the Act; that takes a solicitor reading your documents. What the statute does is shift the starting point, and a firm that never checks its status gives that away for nothing.

The cyber insurance proposal form: what you must answer, and what you needn’t volunteer

Section 8(2) confines a consumer’s duty to “providing responses to questions asked by the insurer”, with no duty to volunteer anything more. Section 8(3) obliges the insurer to ask specific questions and forbids general ones. An ambiguous question is read in your favour, and an obviously incomplete answer the insurer didn’t chase is waived.

Chubb’s Irish short proposal form, ROI0268-MD 09/22, still ends with a declaration of “fair presentation of the risk, by disclosing all material matters”, the British standard. For a consumer, that sentence and section 8(2) pull in opposite directions. Section 10(1) entitles you to a copy of the completed form.

Where a consumer answers in good faith but gets it wrong, section 9 grades the outcome: an innocent mistake means the claim is paid, a negligent one gets a proportionate remedy, and only fraud lets the insurer avoid the contract. The controls the form asks about are below; tick what you could prove tomorrow.

Training is the cheapest box to fill. A written rule on what staff may paste into AI tools counts as part of it, and our AI policy template is a start. I wouldn’t sign the declaration on a form like this one without a line underneath noting that you answered as a consumer.

MFA lapsed? Section 19 and the conditions in a cyber liability policy

Every cyber policy carries conditions you have to keep meeting, such as MFA staying on and backups staying offline. Often it’s your IT provider doing that, not you. For a consumer, section 19 of the 2019 Act replaced the old law of insurance warranties, and it changes what a lapse costs.

Say MFA was off on an unused admin account, and the loss came through a forged invoice that never went near it. Under 19(5) the lapse shouldn’t touch the claim. Even so, I’d switch that account off before renewal, because the insurer can still dispute whether the lapse raised the risk.

Cyber insurance cost in Ireland: the only published figures

There is no Irish rate card, and anyone quoting you an average is guessing. AIG publishes the premium bands it uses to decide which free services an Irish CyberEdge client gets. One broker, LHK Group, published an estimate in May 2026. That’s the whole public record, and the calculator uses both.

Chubb’s Irish factsheet promises “no minimum premiums”, scaled by the scope of cover and the limits. Whether you get cover, and on what terms, turns on your answers on the questionnaire. Two quotes at the same premium can hide very different sublimits, so I leave the premium until those line up.

Cyber insurance brokers in Ireland: who is selling, and who pays

Irish cyber cover is placed through intermediaries. The Travelers and CFC wordings linked below sit on a broker’s website, MIG’s, and Chubb’s form asks for “the client’s” security contact, which tells you who is expected to fill it in. CFC calls itself “the Coverholder identified on your Policy Certificate”: the insurer is named there.

Under regulation 57 of the Insurance Distribution Regulations 2018, distributing insurance here without registration in the State or another Member State is an offence, fined up to €500,000 on indictment under regulation 58. Under 34(4), a broker claiming “a fair and personal analysis” must have compared “a sufficiently large number” of contracts.

Regulation 34(6) also entitles you to a short, stand-alone insurance product information document, and 34(9) says it must summarise the excluded risks and the main exclusions. Brokers see the same rules from the other side, which is why the page for broking offices in Ireland exists. The email below asks for all of it:

You can check point 2 yourself on the Central Bank’s register by searching the firm’s name under “Insurance / Reinsurance Intermediaries”. A broker who answers all four by return is one I’d be glad to deal with.

Is cyber insurance worth it? Irish breach figures from the DPC and CSO

The DPC received 6,521 breach notifications in 2025, and its annual report says “half of all notifications arose as a result of correspondence being sent to the wrong recipient”. That’s an email to the wrong client, or a PDF with someone else’s details in the file’s hidden properties.

The CSO’s survey of Irish enterprises in 2024 tells the same story from the other side.

Outages and human error are the claims a small Irish firm is likeliest to make, so judge a quote on those clauses, not the ransomware headline. The State Claims Agency’s test for buying travels well: a big loss still possible after your controls, and hard to fund.

NIS2 isn’t in Irish law yet: the Commission referred Ireland to the Court of Justice on 8 July 2026, and the NCSC says its portals aren’t open. Most small firms will meet it first in a bigger customer’s supplier questionnaire.

Cyber policies and AI: what the Irish wordings say

Clause 1.23 of the Travelers Irish wording is headed Artificial Intelligence. It says cover isn’t excluded “solely because” a breach or fraudulent instruction was made or facilitated through “artificial intelligence, deepfake, or similar technology”. It adds nothing, but it closes off an argument before anyone can make it.

Every mention is about attacks made with AI or content made by it. None deals with your own staff pasting client files into somebody else’s AI tool. The CSO counted 20.2% of Irish enterprises using AI in 2025, and 9.3% using it to generate text.

Whether that paste is a covered privacy breach turns on the definition of privacy breach, and a broker’s verbal yes is worth nothing to me here. What each provider keeps is documented, and worth knowing before you answer the broker:

How to compare two cyber insurance quotes

Take the two quotes, the two wordings and the two product information documents, and fill this in from the documents, not from the summary email. The rows follow the order of this page. If you get stuck on the AI rows, our other guides go further.

Most comparisons are lost on the last row. The headline limit is the number brokers print, but the extortion or crime sublimit is the one that pays, and it sits in the schedule. Given the choice, the dearer quote with a crime sublimit I can live with beats the cheaper one without.

The headline limit is sometimes set for you. For contractors to public bodies, that same SCA guidance suggests €1 million of cyber cover on low-risk ICT work and €5 million where personal or financial records could be exposed, so read the tender before you pick a limit.

Before you sign: the paper to keep and the leak to close

Keep the completed proposal form, the wording and the product information document together. If a claim is disputed, those decide it, and the FSPO takes complaints free once the insurer’s own process is exhausted. I’m reading public wordings and statutes here, not advising on your policy; that part belongs to a solicitor.

No Irish policy yet answers the AI paste question, so to my mind the cheaper fix is keeping the client’s name away from the tool. Nonimo for Irish firms swaps names and identifiers for markers on your own computer before text goes to AI, which gives you a true line for the questionnaire.

If your own software calls a model, Nonimo Gateway does the same to API requests on your servers.

The guide to what an AI gateway is explains where that layer sits. Everything else about the product is on the Nonimo home page.

Sources

• Consumer Insurance Contracts Act 2019, Irish Statute Book: sections 8, 9, 10 and 19.
• European Union (Insurance Distribution) Regulations 2018, S.I. No. 229 of 2018: regulations 34, 57 and 58.
• Financial Services and Pensions Ombudsman Act 2017, revised, Law Reform Commission: the consumer definition in section 2 and the €250,000 limit in section 60.
• FSPO, how to make a complaint: free service, provider’s process first.
• Central Bank of Ireland register search: checking insurers and intermediaries.
• Data Protection Commission, Annual Report 2025: 6,521 notifications, half misdirected correspondence.
• CSO, ICT Security 2024: incident rates and staff training.
• CSO, Artificial Intelligence 2025: 20.2% of enterprises using AI.
• Travelers International CyberRisk, Ireland, TRV2742 08.25: insuring clauses, clause 1.23, fines definition. CFC Cyber Private Enterprise v3.2, 06/24, is on the same broker’s site.
• CFC Cyber Proactive Response v4.0, Republic of Ireland: privacy breach and cyber event definitions, exclusion 18, the 72-hour condition.
• Chubb Cyber ERM Short Proposal Form, ROI0268-MD 09/22: control questions and declaration.
• Chubb Cyber ERM factsheet, Ireland: no minimum premiums.
• AIG Cyber Loss Control Services, small, IRL0566AR and midsize, IRL0567AR: premium tiers I and II; tier III is on the large-premium sheet, IRL0568AR.
• LHK Group, cyber insurance for SMEs, 22 May 2026: the €1,500 to €3,000 estimate.
• State Claims Agency, State Indemnity Guidance SIG 09: Cyber and Data Breach Risks: fines unlikely to be insurable; when to buy; €1 million and €5 million contractor limits.
• GDPR, Regulation (EU) 2016/679: Article 33, the 72-hour notification.
• European Commission, NIS2 referral of 8 July 2026: Ireland referred to the Court of Justice.
• NCSC, NIS2: transposition deadline missed, portals not open.

Checked on 7 November 2026.