Commercial Liability Insurance Exclusions and Gaps

Last updated: October 20, 2026

Key Takeaways

• Exclusions are policy limits on coverage; gaps are losses the policy never reaches.
• Usual exclusions often include intentional acts, professional services, pollution, employer obligations, workers’ compensation, contract liability, and some cyber losses.
• The riskiest gaps often sit between policies, where businesses expect another policy to respond.
• Start the review with the declarations page, then move through the insuring agreement, definitions, exclusions, conditions, endorsements, and manuscript wording.

Commercial liability insurance exclusions and gaps are the losses most likely to be denied when a claim looks covered on paper. This guide on commercial liability insurance exclusions and gaps is for business owners, managers, and finance leads who already have a commercial general liability policy, an umbrella or excess policy, or both, and want to understand where coverage stops. It assumes you know your policy declarations page is not the whole contract and that your operation has ordinary business risks such as customer injury, property damage, advertising claims, or vendor disputes. This article on commercial liability insurance exclusions and gaps is information, not financial advice; insurance wording, laws, and minimum requirements vary by country and change often, so a qualified adviser should review your own situation. See the NAIC and ISO for general policy and form background.

What exclusions and gaps actually are

Exclusions are the parts of the policy the insurer refuses to cover; gaps are losses that sit outside the policy because no insuring agreement reaches them. That distinction matters, and a qualified insurance professional or attorney should review the wording for your facts. An exclusion usually removes a risk that would otherwise fall inside the policy, while a gap can exist because the policy never picked up the loss in the first place. A standard commercial general liability policy, often shortened to CGL, is built around third-party bodily injury, property damage, and certain personal and advertising injury claims. It is not a catch-all contract. See the IRMI glossary and ISO CGL overview.

The most common mistake is to read the marketing language and skip the form language. A declarations page can show limits such as $1 million per occurrence or a $2 million aggregate, but those limits only matter after the claim qualifies under the policy form. A claim for faulty workmanship, for example, may be excluded by a “your work” exclusion, while a data breach may be a gap because cyber liability usually needs separate coverage. Those are different failures. One is an explicit refusal; the other is simply a missing door.

Another trap is assuming that “liability” means “everything I might owe somebody.” It does not. Contractual liability, employment practices, pollution, professional services, product recall, and directors’ and officers’ claims are often handled in separate policies or not covered at all. Even within a CGL, small wording changes can alter the result. A policy form from ISO, the Insurance Services Office, is not identical to a manuscript form drafted for a carrier’s own use. The same loss can be treated differently under different forms, so consult a professional before relying on a comparison.

The practical test is simple: ask whether the loss fits inside an insuring agreement, then ask whether an exclusion takes it back out, then ask whether an endorsement changes either answer. If any answer is “no,” you may have a gap. That is why reading only the exclusions page misses the point. The gap can live in the definition section, the conditions section, the endorsement schedule, or the policy period itself.

Which risks are usually excluded from commercial liability insurance?

The usual exclusions are intentional acts, expected or intended injury, professional services, pollution, employer’s liability, workers’ compensation obligations, contractual liability beyond the policy’s narrow carve-backs, and many cyber-related losses. That list is not universal, and country-specific forms can differ, but those categories show up often enough that they deserve attention before renewal, not after a denial.

Intentional acts exclusions are straightforward: if a business or its people meant to cause the harm, the liability policy usually will not pay. Expected or intended injury language can be broader than it sounds, because some carriers argue that a known consequence counts even if the exact damage was not planned. That can matter in assault claims, trespass, or certain nuisance disputes.

Professional services is a major blind spot. If the business gives advice, design, engineering, appraisal, coding, consulting, or managed services, the claim may belong under errors and omissions insurance or professional liability insurance, not the CGL. The problem is not just a formal title; the policy may define professional services by function. A contractor who also designs a roof layout can trigger a professional-services exclusion even if the company thinks of itself as a “builder,” not a consultant. Consult a qualified adviser, because the exact answer depends on the wording and facts.

Pollution exclusions are another area where the wording is more important than the label. Many forms exclude discharge, dispersal, seepage, migration, release, or escape of pollutants. Those words can reach fuel leaks, mold-related allegations, fumes, dust, or contaminated runoff depending on the facts and the jurisdiction. Some policies have narrow exceptions, but a surprise environmental claim is rarely handled well by a standard liability form.

Employment-related claims are also commonly outside a CGL. Discrimination, harassment, retaliation, wrongful termination, and wage disputes are usually handled under employment practices liability or other specialized forms, and workers’ compensation laws often sit in their own legal lane. A slip-and-fall claim by a customer is not the same as an employee injury on the job, even if both happen in the same store on the same day.

Cyber claims deserve special caution. A liability policy may cover bodily injury or property damage caused by a computer-related event, but that does not mean it covers the privacy investigation, ransomware demand, system restoration, notification costs, or regulatory defense that many businesses actually face. A cyber endorsement can help in some programs, yet the exact trigger, sublimits, and exclusions vary widely.

Where the coverage gaps hide in plain sight

The most dangerous gaps are the ones that sit between policies, because businesses assume someone else will respond. A gap is often the result of a definition, a timing rule, a territorial rule, or a limit structure rather than a bold exclusion. The loss is real; the policy simply does not connect to it.

A common example is the claims-made gap. A claims-made policy responds when the claim is made during the policy period, and often only if the wrongful act happened after the retroactive date shown in the policy. If the business changes carriers, forgets to renew tail coverage, or misses a reporting deadline, the claim can fall through the cracks. The paperwork matters as much as the event date.

Another gap appears when a policy limit is technically available but already used up. A $1 million per-occurrence limit sounds generous until defense costs, settlements, and multiple claimants eat into it. Some policies defend outside the limits; others erode the limit with defense expenses. That difference can change the value of the same policy by a wide margin. The declarations page will not spell out that practical consequence.

There are also gaps tied to location and jurisdiction. A policy may apply to the U.S. and Canada, or to a specific territory, or only to work performed in certain places. A business with remote contractors, trade shows, online sales, or temporary operations outside its home country can find that a familiar claim falls outside the territory clause. International work often needs its own review, especially where local compulsory insurance or admitted-carrier rules apply.

Subcontractor and additional insured issues create another common blind spot. A company may assume a subcontractor’s policy will respond because the subcontractor promised to carry insurance. If the subcontractor never added the company as an additional insured, or if the certificate of insurance was only evidence of a policy existing on a date and not proof of current coverage, the transfer may fail. A certificate is not a contract amendment. That is a painful lesson when a supplier injury claim arrives 18 months later.

Deductibles and self-insured retentions, or SIRs, can also behave like gaps in practice. A self-insured retention is the amount the insured must pay before the insurer owes a duty to pay. If the business cannot fund the SIR promptly, the claim may stall. Some policies even require the insured to handle defense until the retention is exhausted, which creates cash-flow strain that a plain limit number hides.

How do you spot a coverage gap before a claim happens?

You spot a coverage gap by matching the work the business actually does to the exact policy language, line by line, not by assuming the class code or policy name is enough. The review should start with the declarations page, then move to the insuring agreement, definitions, exclusions, conditions, endorsements, and any manuscript wording. A 30-minute scan is not enough for a serious business; a careful review usually takes longer because the dangerous parts are buried in definitions.

1. List every real exposure in plain business terms. Write down the work performed, the products sold, the locations used, the jurisdictions served, and the kind of claims that could arise. Include at least one example for each: customer injury, property damage, advice errors, data loss, employee conduct, subcontractor failure, and contract breach. Verify the list reflects actual operations this year, not the version from 3 years ago. A problem shows up if a risk category exists in the business but nowhere on the list.
2. Pull the full policy form, not just the declarations page. Get the base form, all endorsements, and any manuscript endorsements attached to the policy number. Check the effective date, policy period, retroactive date if there is one, and named insured exactly as shown. A mismatch in the named entity or an endorsement dated outside the policy term can signal a gap. If only a summary or certificate is available, that is a warning, not a substitute.
3. Read the insuring agreement first. Identify what the policy actually promises to pay: bodily injury, property damage, personal and advertising injury, products-completed operations, or another defined loss. Verify the claim type fits those words before looking at exclusions. If the loss never enters the grant of coverage, an exclusion review will not save it. A problem exists if the claim depends on an assumption the insuring agreement does not mention.
4. Check the definitions that control the claim. Focus on “occurrence,” “property damage,” “bodily injury,” “professional services,” “pollutants,” “your work,” “your product,” and “occurrence,” because those terms often decide the outcome. A definition can narrow coverage more than an exclusion does. Verify whether the definition includes electronic data, leased premises, or temporary work sites. If a key term is undefined, the wording is ambiguous and needs review by a qualified adviser.
5. Read every exclusion with the exceptions that follow it. Many exclusions are softened by exceptions, carve-backs, or limited grants back in. For example, a contractual liability exclusion may still allow an insured contract exception; a pollution exclusion may have a building-heating exception; a work-product exclusion may allow damage to other property. Verify the exception actually applies to the claim facts. A problem appears if you stop at the exclusion heading and never read the exception text.
6. Compare limits, sublimits, and defense treatment. Consult a qualified insurance professional or attorney before you rely on a comparison, and check whether defense costs erode the limit. Record the per-occurrence limit, aggregate limit, any sublimit for products-completed operations or cyber coverage, and whether the policy uses a deductible or a self-insured retention. Verify whether the insurer defends above or within limits. A red flag appears when one claim could exhaust multiple coverages or when defense costs count against the same dollar cap.
7. Test the policy against three real claim scenarios. Use one customer injury, one contract dispute, and one non-physical loss such as a defamation or data incident. Ask whether each claim fits the form, survives the exclusions, and lands inside the right policy period. Verify the answer with the exact wording, not intuition. If any scenario needs a verbal explanation more than one sentence long, the policy deserves a deeper review.
8. Document what is missing and who owns the fix. Mark each uncovered exposure as “outside policy,” “needs endorsement,” “needs separate policy,” or “needs legal review.” Include renewal timing because some changes can only be made at renewal or with a 30-day underwriting lead time. If no one is assigned to close the gap, the review has not really been done.

That process sounds tedious because it is. It can also be the way to find a coverage hole before a loss forces the issue. The point is not to turn every risk into an insurable one; the point is to know which risks are intentionally retained, which are transferred elsewhere, and which have been overlooked.

What should you check before renewal or when a claim is likely?

You should check the endorsement stack, the claim-reporting terms, the entity schedule, and the relationship between your liability policy and every other policy carrying the same risk. Renewal is often the best time because underwriting can still change wording, add endorsements, or correct entity names. After a claim begins, options narrow quickly.

Start with the endorsement schedule. Endorsements can add insureds, delete exclusions, change definitions, restrict territory, or introduce manuscript conditions. A single endorsement can override a comforting base form. If a broker sends only a renewal quote and not the revised form set, the business may not know that the policy changed in a material way. One page of marketing copy is not enough.

Then check notice terms. Some policies require the insured to report claims, suits, or circumstances “as soon as practicable,” while claims-made forms may require notice within the policy period or a specific reporting window. A missed notice deadline can be fatal even if the underlying loss would otherwise fit. The exact wording matters more than the calendar reminder in someone’s inbox.

Next, match the named insured and additional insured structure to the way contracts are written. If the operating company is different from the parent, or if multiple LLCs share a trade name, a claim can end up attached to the wrong legal person. The policy may not follow the brand name on the storefront. That problem shows up often in franchises, holding-company structures, and asset-sale transitions.

Check whether defense costs are inside or outside the limit. This one line can change how much of the policy is available for settlement. A policy that pays defense outside limits keeps the limit intact longer; a policy that erodes the limit may be exhausted by legal fees alone. That difference is not academic when a bodily injury case drags on for months.

Finally, check how other coverages interact. A general liability policy may have an exception pointing to workers’ compensation, automobile liability, pollution coverage, marine coverage, or professional liability. A business that assumes overlap can end up with a dispute between carriers instead of payment from one of them. The safe move is not to guess which policy should pay; it is to verify which policy actually says it will.

The mistakes people actually make, and what they cost

The biggest mistake is treating the certificate of insurance as if it were the policy. A certificate is usually a snapshot, not the contract itself. When the claim arrives, the certificate cannot rewrite the exclusions, limits, or conditions. The cost is often months of delay and a denial that surprises everyone except the carrier.

A second mistake is assuming every “liability” policy covers every liability. That belief is especially costly in businesses that provide advice, software, design, or installation services. The consequence is a denied claim or a slow handoff to a professional liability policy that may not have been kept in force. The correct alternative is to map the business activity to the policy form, not the label on the binder.

A third mistake is ignoring entity structure. Many businesses operate through a parent, an operating company, a property company, and one or more special-purpose entities. If the policy names only one legal entity, another entity’s loss may not be covered. The cost can be severe when a lease, contract, or lawsuit names the wrong insured. The fix is to align the named insured schedule with the actual legal structure.

A fourth mistake is letting subcontractor paperwork stand in for real risk transfer. A subcontractor may carry a policy, but if it excludes the work performed, or if the additional insured status is missing, the promised protection evaporates. The consequence is direct exposure to the primary business. The alternative is to review the actual endorsement wording, not just the certificate.

A fifth mistake is underestimating the policy period and reporting rules. A claim made after cancellation, or after the retroactive date, can be outside coverage even when the underlying work was done years earlier. The cost is often a fully uninsured legacy claim. The remedy is to understand whether the form is occurrence-based or claims-made and to handle any transition with care.

A sixth mistake is assuming one endorsement fixes everything. An endorsement can solve one hole and open another by narrowing territory, adding an exclusion, or changing who counts as insured. The consequence is accidental trade-off. The better alternative is to read the endorsement in context and ask what it removed, not only what it added.

When does the standard policy structure not fit?

The standard commercial liability structure does not fit when the business sells advice, carries cyber risk, works across borders, relies on complex contracts, or faces pollution and product exposures that sit outside a basic CGL. In those situations, the issue is not that the policy is “bad”; it is that the wrong policy form is doing the wrong job.

A professional-services business is a classic mismatch. Design firms, consultants, IT providers, accountants, real estate professionals, and managed service firms often need a policy built for negligent advice or failure to perform professional duties. A CGL may still matter for premises claims or advertising injury, but it may not answer the main risk. If the loss is a bad recommendation rather than a broken chair, the standard form is often the wrong first place to look.

Product businesses face a different mismatch. Product liability can appear inside a CGL, but recall costs, warranty obligations, and pure economic loss are often outside it. If a product must be removed from shelves, replaced, or repaired because it is defective, consult a professional, because the policy may not treat that as covered property damage. The line between damage to third-party property and cost to fix the product itself is crucial.

Technology and data-driven businesses face a third mismatch. The policy may address bodily injury or property damage from a computer event, but it often will not cover privacy law defense, forensic investigation, notification, extortion, or business interruption tied to a network outage. A cyber policy, crime policy, or technology E&O policy may be relevant depending on the facts and jurisdiction. That does not make the CGL useless; it just means it is only one layer.

Cross-border work also breaks the standard model. Territory, local admitted requirements, and jurisdictional differences can change what is valid or enforceable. A U.K. form, a U.S. ISO form, and a policy issued for an EU entity are not interchangeable. If the business has staff, customers, or contractors in more than one country, the policy wording needs a review by someone who understands that geography.

The honest limitation is this: no single liability policy is designed to erase every loss a business can suffer. Some exposure is meant to stay with the business, and some belongs in a different policy category altogether. A reader who wants certainty from one form is looking in the wrong place.

What does a good coverage review look like?

A good coverage review ends with a short list of confirmed protections, known exclusions, and unresolved questions, not with a vague feeling that “it should be fine.” The output should fit on a few pages even if the policy stack is 50 pages long. Clarity beats volume.

One sign of a good review is that each major exposure has a label. For example: premises liability under the CGL, professional services under a separate E&O form, cyber under a standalone policy, auto under commercial auto, and employment claims under EPLI. That map helps the business see where it is intentionally carrying risk and where it is relying on insurance.

Another sign is that the review distinguishes between a gap and an exclusion. A gap means the policy never picked up the risk. An exclusion means the policy picked it up and then took it back out. That difference affects whether you seek an endorsement, a new policy, contract language, or a business-process change. A pollution claim, a data breach, and a contractual penalty may each need a different answer.

A third sign is that the review includes timing. If the business changes operations mid-year, acquires a company, expands into a new state, or starts using subcontractors, the policy may need adjustment before the renewal date. A 90-day wait can be enough to let a silent gap become a real uninsured loss.

If the review cannot answer one of these questions in plain language — What is covered? What is excluded? What is missing? — then the review is incomplete. That is the point at which a qualified insurance adviser, broker, or attorney familiar with the policy form should interpret the language against the actual facts.

Should I assume my commercial liability policy covers everything?

No, because a commercial liability policy covers only the risks its insuring agreement, definitions, and endorsements actually reach. That answer is blunt, but it is the one that prevents the most expensive misunderstanding. A policy can be useful and still leave major exposures untouched.

The safe habit is to treat coverage as a map, not a promise. Read the map for the routes it draws, the roads it closes, and the detours it quietly requires. Then compare that map with the business you actually run, not the business you intended to run when the policy was first written. If the two do not match, the gap is real even before a claim is filed.

A final warning is worth saying plainly: this is information, not financial advice, and a qualified adviser should review your own policy wording, jurisdiction, and business structure before you rely on any interpretation. A business that waits until a claim file is open usually learns about exclusions the hard way.

FAQs

Is an exclusion the same thing as a gap?

No. An exclusion removes a risk that would otherwise be inside the policy, while a gap is a risk the policy never captured in the first place. The difference matters because exclusions may sometimes be narrowed by an endorsement or exception, but a true gap often requires a different policy form.

Can a certificate of insurance prove I am covered?

No. A certificate usually shows that a policy existed on a certain date and names some basic details, but it does not change the policy wording. The operative document is the policy itself, including endorsements and declarations.

Does general liability usually cover professional advice?

Usually not. If the claim is about bad advice, design error, coding mistake, consulting failure, or another professional service, the business may need a separate professional liability or errors and omissions policy. The exact answer depends on the policy language and the facts.

Why do claims-made policies create more gaps?

Claims-made policies can fail if the claim is reported late, if the retroactive date cuts off older work, or if the policy is not renewed or replaced correctly. The timing rules are stricter than with an occurrence form, so legacy exposures need special attention.

Drafted with AI; not yet reviewed by a person.