--- title: "Does the Applicant have a formal process to ensure its products or services do not infringe the intellectual property rights of others?" url: https://insuranceposture.com/questions/services-and-contracts/applicant-formal-process-ensure-products-services-not-infringe-intellectual category: "Services and contracts" canonical_key: q_pro_007 evidence_state: attested updated: 2026-08-24 --- # Does the Applicant have a formal process to ensure its products or services do not infringe the intellectual property rights of others? URL: https://insuranceposture.com/questions/services-and-contracts/applicant-formal-process-ensure-products-services-not-infringe-intellectual Section: Services and contracts Evidence state: Attested, not tenant-verifiable Most infringement is inherited rather than intended: a component, a library, a snippet that arrived with obligations attached. ## What the carrier is actually asking The carrier is asking whether a formal process checks that your products and services do not infringe others intellectual property: patent, copyright, or trademark. It covers clearance before launch and component licensing in what you ship. ## Why it is underwritten Infringement claims are expensive to defend regardless of merit and are commonly excluded or sub-limited in cyber policies. Open source components carry licence obligations that attach on distribution, and code generation tools have introduced a new provenance question that most processes do not yet address. ## Where the answer lives in Microsoft 365, Entra ID, and Azure This is a development and legal process, so it is attested. Component inventories are the most concrete artefact. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | Development | Software bill of materials or component inventory with licences | A current inventory, since obligations attach per component. Attested | | Development | Licence policy: which licences are permitted for which use | A policy that distinguishes internal use from distribution, since obligations differ | | Legal | Clearance for product and feature names | Trademark clearance before launch rather than after a demand letter | | Development | Policy on code generation tools and their output | A position on provenance of generated code, which is a live and unsettled area | | Contracts | Indemnities received from suppliers and given to customers | The allocation of infringement risk, in both directions | **Copyleft obligations attach on distribution** Some open source licences require you to release your own source when you distribute software containing them. Development teams frequently do not distinguish internal use from distribution, and the obligation is discovered during due diligence or after a complaint. ## What a defensible yes requires - A component inventory exists with licences identified. - A licence policy distinguishes internal use from distribution. - Names and branding are cleared before launch. - A position exists on generated code provenance. - Supplier indemnities are held where you rely on third-party components. ## How this answer goes wrong The process covers deliberate use of third-party material and misses the dependency tree, where a permissively licensed library depends on a copyleft one several levels down. Nobody chose it and the obligation attaches anyway. ## If this answer turns out to be wrong Technology E&O questions describe what you promised your own clients, and the policy language decides how strictly your description of that is held. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [whether an answer is a warranty or a representation](https://insuranceposture.com/glossary/warranty). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Is a software bill of materials required? Increasingly expected by customers and regulators, and it is the practical foundation for answering this question at all. ### What about code generation tools? An unsettled area. Have a documented position on their use and on provenance, because customers have started asking contractually. ### Is IP covered by cyber insurance? Sometimes partially through media liability, often excluded or sub-limited. Read the wording if you develop and distribute software. ### How deep should the check go? To the full dependency tree. Direct dependencies are the visible layer and transitive ones carry the same obligations. ## Related questions - [Does the Applicant use, disseminate or display material or content of others?](https://insuranceposture.com/questions/governance-and-workforce/applicant-disseminate-display-material-content-others) - [Does the Applicant have a privacy review process (attorney) for published content / media?](https://insuranceposture.com/questions/governance-and-workforce/applicant-privacy-review-process-published-content-media) - [Do the Applicant's client contracts address guarantees or warranties?](https://insuranceposture.com/questions/services-and-contracts/applicant-s-client-contracts-address-guarantees-warranties) - [Do the Applicant's software products or services address any specific high-exposure activities (IT security, e-commerce, finance/banking, medical/healthcare, media broadcasting/streaming, ERP/CRM/SCM, custom programming)?](https://insuranceposture.com/questions/services-and-contracts/applicant-s-software-products-services-address-specific-high-exposure) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.