The Colour Series: Looking Ahead at PI and D&O Risk

How is ESG liability changing the D&O landscape vs traditional PI risks?

ESG liability is fundamentally shifting the D&O landscape by introducing long-tail, reputational and regulatory exposures that go far beyond the scope of traditional PI risks. While PI claims typically focus on technical errors or professional negligence, ESG-related D&O claims scrutinise leadership decisions around sustainability, climate disclosures, diversity and supply chain ethics. Directors now face personal liability for greenwashing, failing to meet climate targets, or ignoring social governance standards-often under intense public and shareholder scrutiny. This evolution demands stronger board oversight, transparent ESG reporting and proactive risk governance, making ESG a strategic boardroom issue rather than just a compliance checkbox.

What new professional risks are emerging that traditional PI might not cover?

Emerging professional risks that traditional PI might not fully cover include exposures linked to AI-assisted work, where responsibility for machine-generated advice is unclear; cybersecurity lapses that cause financial harm beyond pure data loss; ESG-related obligations such as environmental misstatements or greenwashing claims; regulatory enforcement actions tied to privacy (e.g., POPIA/GDPR fines) that aren’t client-loss driven; and expanded reliance on outsourced or gig-economy professionals where liability is shared or ambiguous. Traditional PI is built around classic negligence in advice or design, many of these modern risks blur the boundaries between technology, governance, compliance and conduct, creating gaps without tailored extensions or complementary cover like cyber liability or D&O.

How are cyber incidents blurring the lines between professional and directorial liability?

Cyber breaches are blurring the lines between PI and D&O liability. Professionals may face PI exposure for technical failings like poor advice or inadequate safeguards, while directors can be hit with D&O claims over governance lapses or misrepresented cyber resilience. When roles overlap or policy exclusions exist, insurers may dispute coverage. This makes clear role definition, coordinated policies, and proactive cyber risk management across functions absolutely essential.

If a D&O policy includes a cyber exclusion but has a carve-back for governance failures, coverage may still apply where the claim targets board-level oversight rather than the cyber incident itself. For example, if directors are accused of ignoring known cybersecurity risks or failing to implement adequate controls, the carve-back could trigger D&O coverage despite the exclusion.