Non-affirmative cyber risk: phase 2 classes of business

On 29 January 2020, Lloyd’s published Market Bulletin Y5277 containing an update in respect of its approach to non-affirmative cyber risk. Lloyd’s strategy for the oversight of cyber risks will ultimately require all policies to exclude or provide affirmative coverage for cyber risks.

Timetable for implementation

Phase 1 was announced by Lloyd’s in Market Bulletin Y5258 on 4 July 2019 and covered first-party property damage policies incepting on or after 1 January 2020. Bulletin Y5277 sets out a timetable by which policies in phase 2 classes of business must comply.

Policies issued on or after 1 July 2020 must either affirm or exclude cyber cover in the following lines:

  • Accident & Health
  • Contingency
  • Space
  • Political Risks, Credit and Financial Guarantee
  • BBB/Crime
  • Property Cat XL
  • Property Pro Rata
  • Property Risk XS
  • Agriculture & Hail
  • Livestock Excess of Loss.

The bulletin announces that remaining classes will now be dealt with in two further phases, 3 and 4, scheduled for scheduled for 1 January 2021 and 1 July 2021 respectively.


Since Bulletin Y5258 came out last year, a great deal of work has been done on model policy language across several lines of business to help underwriters and managing agents prepare for the change. The work for phase 2 will continue to be challenging.

Many of the challenges will be technical wording issues. The Lloyd’s strategy follows regulatory concepts of cyber risk and cyber-related risks which are very broad. Model wordings however typically need to be drafted to try to operate with reference to more specific concepts to be useful for the relevant class of business.

Furthermore, affirmative language may negate widely used exclusions and broaden cover more than was intended. It may be however that some reinsurers will in their treaties mandate the use in direct covers of particular model language. The uncertainties that changes to policy language introduce may therefore strengthen a trend for private coverage dispute resolution mechanisms in wordings.

Along with all this will be challenges in getting all parts of the distribution chain to a shared understanding of the intended operation of cover. And while new wordings that provide greater clarity to customers about what is excluded are surely fairer and better from a regulator’s perspective, some may ask whether they will nevertheless be harder to sell if other markets do not move in lockstep.

These issues are not straightforward but nor are they going away. Those in the relevant classes of business who have yet to start grappling with the implications of phase 2 need to start now.

Related items: