Law Firm Insurance: The 2026 Liability Playbook

Most law firms meet commercial insurance not by asking “what’s my risk?” but through the professional duties they already owe. Every client matter carries a standard of care. A missed limitation period, a conflict that was not cleared, a disclosure of confidential information, or a misapplied trust-account balance creates an allegation that a generic business policy will not answer. By the time the firm reads its coverage, the duties that generate the exposure have already been set by the rules of the profession and the clients who hired it.

That reframe is the point of this playbook. It is not a catalog of what each policy does — that work belongs on the sister library, isthiscovered.org. This is the professional-liability map: five exposures that generate claims at a law firm, who can assert each one, and which line of coverage is supposed to answer it. The decisions left to the firm are narrower than the brochure suggests, and they are the ones that matter.

Where these hit your timeline. Few appear at bar admission. They attach to milestones.

Milestone	What enters	Why then
Solo practice, first client matter	Legal malpractice	Every engagement carries the standard of care; no other line answers negligent legal work
Client confidential information in your systems	Cyber	Model Rule 1.6’s confidentiality duty activates the moment the firm holds client data
First client funds held in trust	Crime / fidelity	The fiduciary duty over client funds under Model Rule 1.15 starts with the first deposit
First employee or applicant	EPLI exposure	Every hiring, pay, and termination decision is a potential claim — and nobody requires it
Office or physical premises	General liability	The lease demands it; any premises injury activates GL

1. A client says your legal work caused a loss

A client relied on your advice, a deadline was missed, or a conflict was not cleared — and the client says it cost them. This is the central exposure of a law practice, and the coverage that answers it is lawyers’ professional liability, the profession-specific name for professional liability written for attorneys. The duty behind it is the standard of care: Model Rule 1.1 requires competent representation, including the legal knowledge, skill, and thoroughness the matter demands. Model Rule 1.3 requires diligence and promptness, and the missed-deadline exposure it creates is law-firm-specific — a calendaring failure over a limitation period or a filing date can convert a winnable matter into a malpractice claim on its own. Model Rule 1.7 governs concurrent conflicts, direct adversity, and material limitation, and a representation undertaken without a cleared conflict is an exposure none of the firm’s other policies will answer.

What trips firms is the trigger. Lawyers’ professional liability is written on a claims-made basis, which means the policy responds when the claim is made, not when the work was performed. The retroactive date on the form decides how far back prior acts stay inside coverage, and a lapsed policy or a carrier switch that resets that date can reopen years of old representation. At a partner’s departure, a firm’s dissolution, or retirement, the only thing keeping old work inside coverage is tail coverage — the extended reporting period — or a successor policy that carries the retroactive date forward. Read what tail coverage actually does and whether you need malpractice tail coverage before a transition forces the question, and start from what insurance law firms need for the broader map.

2. Client confidential information is breached

Ransomware, a vendor failure, or an access misstep exposes files the firm held under privilege. Two enforcement paths hit the firm at once, and that is what makes this exposure different from the first. The client can sue or demand proof of coverage under the engagement letter — but a state attorney general can also act under state privacy and breach-notification law, whether or not any client complained. The contract is one trigger; the statute is another.

The duty behind both is Model Rule 1.6, which requires confidentiality of client information and reasonable efforts to prevent unauthorized access to or disclosure of client information. The coverage is cyber, and the line matters because a lawyers’ professional-liability form does not, by itself, answer a data incident. The cost of the firm’s own forensic, notification, and ransomware response is first-party cyber; the lawsuits that follow sit on the third-party side. The mechanics of what cyber responds to live on the sister library, isthiscovered.org.

3. Client funds or trust-account money is mishandled

A deposit that was not segregated, a disbursement that was not reconciled, or an employee who diverted trust-account balances. The duty behind it is Model Rule 1.15, which requires the safekeeping of client property — separate accounts, records, and accounting for client funds, and prompt delivery of property the client is owed. The fiduciary control the firm holds over client money is distinct from anything in a professional-liability or general-liability form.

The coverage is crime and fidelity insurance, which answers employee dishonesty, forgery, and the theft of client funds — including third-party social-engineering fraud that tricks staff into wiring trust money out. A lawyers’ professional-liability policy covers the firm’s negligent legal work; it does not cover a stolen trust-account balance. The trust account is the control point, and the exposure exists from the first client deposit the firm holds.

4. An employment claim names the firm

A firing, a reduction in force, or a dispute over pay. The former employee — or a candidate the firm never hired — alleges discrimination, harassment, or retaliation. The coverage is EPLI.

This one is unlike the others, and the difference matters: nothing requires it. No client, no court, and no bar rule demands EPLI. It is a judgment call, and that is exactly why it is underbought. The exposure starts at the first hire, because every hiring, pay, discipline, and termination decision is a potential claim that none of the firm’s other policies will answer — general liability, workers’ comp, and lawyers’ professional liability all exclude employment acts. The EEOC identifies retaliation as the most frequently alleged basis of discrimination, which compounds quietly: whatever the firm does after an employee complains can become a second claim even when the first fails. The policy’s most-used benefit is paying for a defense that ends in no finding of wrongdoing. See what EPLI covers if a termination claim names a partner.

5. Someone is injured at your office

A client injured in the reception area, a delivery driver hurt on the premises, or property damage to a neighboring tenant. The coverage is general liability for bodily injury, property damage, and certain advertising injuries — and the boundary between it and the professional-liability form is read from the policy, not assumed. A visitor’s slip-and-fall is a GL matter; a client’s allegation that the firm’s legal work was negligent is not.

What makes general liability non-optional at most firms is the lease. Commercial landlords require general liability, commonly at $1 million per occurrence, and name the landlord additional insured. This is the one exposure where the contract and the stakes are both comparatively predictable.

The decisions that are actually yours

Strip away the duties and a pattern emerges across the five. The same three questions decide almost every line, and buyers conflate them constantly:

Exposure	Legally required?	Someone will require it?	Prudent even if not?
Legal malpractice	Partly — some jurisdictions require coverage or disclosure	Yes — client engagement, court appointments	Yes — standard of care from every matter
Cyber	Partly — state breach and privacy law	Yes — client engagement letters	Yes — privileged and personal data held
Crime / fidelity	No	Sometimes — client or trust-account rules	Yes — fiduciary control of client funds
EPLI	No	Sometimes — partners or major clients	Yes, at first hire
General liability	No	Yes — your landlord	Premises exposure

Those are different reasons to buy the same policy, and they point at different limits. The genuine decisions — the ones a brochure will not make for the firm — are narrower still. Read the claims-made trigger before switching carriers. Lawyers’ professional liability responds when the claim is made, so a changed retroactive date or a lapsed policy can open a gap over years of old matters. Arrange tail coverage before a departure, dissolution, or retirement, because once the policy ends without it, prior representation walks out of coverage. Decide where cyber ends and legal malpractice begins, because underwriters draw that line in the policy definitions and a data incident is the wrong moment to discover the gap.

A short checklist

1. Opened your first client matter → confirm your legal-malpractice form covers your actual practice areas and record the retroactive date.
2. Holding client funds in trust → evaluate crime and fidelity coverage over the trust account before the first deposit.
3. Storing confidential client data → get a cyber quote and check whether your professional-liability form extends to a data event.
4. Made your first hire → get an EPLI quote and decide on numbers, not on category.
5. Signing a lease → confirm the general-liability limit and the additional-insured endorsement before you take the keys.
6. Partner departure, firm dissolution, or retirement → arrange tail coverage or carry the retroactive date forward before the policy ends.

---

Sources are linked below. This playbook frames the liability exposures; the coverage mechanics — forms, certificates, mandates, claims — are on isthiscovered.org, and each exposure above links to its own question page for the sourcing behind the claim.