Does the Applicant have a formal process to ensure its products or services do not infringe the intellectual property rights of others?
Most infringement is inherited rather than intended: a component, a library, a snippet that arrived with obligations attached.
What the carrier is actually asking
The carrier is asking whether a formal process checks that your products and services do not infringe others intellectual property: patent, copyright, or trademark. It covers clearance before launch and component licensing in what you ship.
Why it is underwritten
Infringement claims are expensive to defend regardless of merit and are commonly excluded or sub-limited in cyber policies. Open source components carry licence obligations that attach on distribution, and code generation tools have introduced a new provenance question that most processes do not yet address.
Where the answer lives in Microsoft 365, Entra ID, and Azure
This is a development and legal process, so it is attested. Component inventories are the most concrete artefact.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Development | Software bill of materials or component inventory with licences | A current inventory, since obligations attach per component. Attested |
| Development | Licence policy: which licences are permitted for which use | A policy that distinguishes internal use from distribution, since obligations differ |
| Legal | Clearance for product and feature names | Trademark clearance before launch rather than after a demand letter |
| Development | Policy on code generation tools and their output | A position on provenance of generated code, which is a live and unsettled area |
| Contracts | Indemnities received from suppliers and given to customers | The allocation of infringement risk, in both directions |
Some open source licences require you to release your own source when you distribute software containing them. Development teams frequently do not distinguish internal use from distribution, and the obligation is discovered during due diligence or after a complaint.
What a defensible yes requires
- A component inventory exists with licences identified.
- A licence policy distinguishes internal use from distribution.
- Names and branding are cleared before launch.
- A position exists on generated code provenance.
- Supplier indemnities are held where you rely on third-party components.
How this answer goes wrong
The process covers deliberate use of third-party material and misses the dependency tree, where a permissively licensed library depends on a copyleft one several levels down. Nobody chose it and the obligation attaches anyway.
Frequently asked
Is a software bill of materials required?
Increasingly expected by customers and regulators, and it is the practical foundation for answering this question at all.
What about code generation tools?
An unsettled area. Have a documented position on their use and on provenance, because customers have started asking contractually.
Is IP covered by cyber insurance?
Sometimes partially through media liability, often excluded or sub-limited. Read the wording if you develop and distribute software.
How deep should the check go?
To the full dependency tree. Direct dependencies are the visible layer and transitive ones carry the same obligations.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture