Law Firm Insurance: Coverage Types and Limits by Firm Size

TL;DR: Law firm insurance is a stack, not a single policy: lawyers professional liability, general liability, cyber, employment practices, workers' compensation, crime, and umbrella coverage, sized to headcount and practice mix. This guide gives recommended limit ranges by firm size, premium benchmarks from published carrier data, and the state rules on malpractice coverage. Use the coverage matrix to pressure test your current policies before renewal.

Search for law firm insurance and the results are carrier product pages built to produce a quote request, not an answer. The question a firm owner actually has is more specific: which policies does the firm need, at what limits, and what should the whole stack cost at this headcount. Carriers rarely answer that in writing because the answer depends on underwriting, and underwriting is negotiated.

We sit on the other side of the transaction. Our team reviews the financial statements of more than 120 law firms, so we see the premium lines, the gaps that surface after an incident, and the renewal increases that arrive without warning. That vantage point shapes the recommendations below.

This guide maps the full stack of business insurance for law firms: the core coverage types, recommended limit ranges by firm size, premium benchmarks from published carrier data, and the state rules that govern malpractice coverage. Treat the ranges as starting points for a conversation with a broker who works with law firms, not as a substitute for underwriting.

What Insurance Does a Law Firm Need?

Most law firms need six core policies: lawyers professional liability (malpractice), general liability, commercial property with business income coverage, cyber liability, workers' compensation, and employment practices liability. Firms handling client trust funds should add crime coverage, and firms above roughly ten attorneys typically add umbrella and management liability layers.

Lawyers professional liability insurance, shortened to LPL and also sold as legal malpractice insurance or attorney malpractice insurance, is the anchor. It responds to claims that the firm's legal work fell below the standard of care, and it is written on a claims-made basis, which means the policy in force when the claim is reported is the one that pays. Everything else in the stack protects the business around the practice rather than the practice itself.

General liability and commercial property usually arrive bundled in a business owner's policy, or BOP. Most office leases require the general liability piece before you get keys. Business income coverage, often included in the BOP, replaces operating cash when a covered event closes the office, and it deserves more attention than it gets because law firm cash flow rarely carries months of slack.

The employment side has two components. Workers' compensation is required by law in every state except Texas once you have employees, and employment practices liability (EPLI) covers discrimination, harassment, wrongful termination, and retaliation claims, which become a live exposure the day you hire your first W-2 employee. Group health, dental, and vision sit outside risk transfer but land on the same financial statements, and firms averaging 50 or more full-time equivalent employees take on coverage obligations under the IRS employer shared responsibility provisions.

Three more policies enter at specific triggers. Hired and non-owned auto coverage matters as soon as anyone drives a personal car to court or client meetings, because personal auto policies exclude business use. Crime coverage, including employee dishonesty and social engineering, becomes a priority for any firm holding client trust funds or advancing case costs. Directors and officers coverage joins the conversation for firms with outside investors, MSO structures, or formal boards.

Law Firm Insurance Limits by Firm Size

The matrix below shows our recommended starting ranges by firm size. Calibrate upward for practice area risk, client contract requirements, trust account balances, geographic exposure, and the personal assets of the partners. Limits are shown as per claim / aggregate where that convention applies.

‍

Two structural notes on the table. The umbrella row sits over general liability, auto, and employer's liability only; it does not extend malpractice limits, so firms that need more LPL capacity buy a separate excess LPL layer. And some state bars attach fidelity bond requirements to firms holding client trust funds, so confirm the trust account rule in your jurisdiction before assuming crime coverage alone satisfies it.

Is Malpractice Insurance Required for Lawyers?

Only Oregon and Idaho require lawyers in private practice to carry malpractice insurance. Oregon provides coverage through its state bar's Professional Liability Fund, and Idaho requires at least $100,000 per occurrence and $300,000 aggregate. Most other states require attorneys to disclose their coverage status to the bar or to clients.

Oregon has run the mandatory model since the 1970s. Every Oregon licensee in private practice buys coverage through the Professional Liability Fund, which provides $300,000 in aggregate limits plus a $75,000 claims expense allowance at a 2026 assessment of $3,500 per licensee. Idaho took the open-market route in 2018, requiring attorneys to buy at least $100,000 per occurrence and $300,000 aggregate from a commercial carrier as a condition of licensure.

Everywhere else, the mechanism is disclosure rather than mandate. At least 27 states have adopted some form of insurance disclosure requirement, either on annual bar registration statements or directly to clients, according to ABA Standing Committee on Client Protection data. Going without coverage is legal in most jurisdictions, but it is visible.

The compliance question undersells the exposure. Plaintiff personal injury work has consistently ranked among the most frequently claimed practice areas in the ABA's quadrennial Profile of Legal Malpractice Claims, and defense costs accrue even when the underlying claim fails. Priced against those odds, malpractice insurance for lawyers functions less like an option and more like a cost of licensure. The claims-made structure adds a discipline requirement: keep coverage continuous, because a lapse can erase protection for every prior year of work, and buy tail coverage, an extended reporting endorsement, when the firm dissolves or an attorney departs.

How Much Does Law Firm Insurance Cost?

A typical attorney pays $2,500 to $3,500 per year for lawyers professional liability coverage at commonly accepted limits. Beyond malpractice, published carrier data puts average law firm costs near $350 per year for general liability, roughly $620 for workers' compensation, and about $2,100 for cyber liability.

The malpractice line has the widest spread. ALPS puts the per-attorney range at $500 for a new attorney with no prior acts up to $6,500 for higher-risk practice areas with years of retroactive coverage, with $2,500 to $3,500 as the typical band. First-year pricing runs low by design: carriers use step rating, which raises the premium each year for roughly the first five to seven years as prior-acts exposure accumulates, so budget to the mature rate rather than the introductory one.

At the firm level, malpractice coverage for a firm of two to ten attorneys generally runs $5,000 to $20,000 per year, and firms above ten attorneys commonly pay $20,000 to $100,000 or more depending on practice mix, limits, and claims history. Practice area is the single biggest variable, followed by location, deductible, and revenue.

The rest of the stack costs less but adds up. Insureon's published figures for lawyers average $29 per month for general liability, $57 per month for a BOP, $52 per month for workers' compensation, and $175 per month for cyber coverage. Add every line together at renewal and evaluate the total cost of risk against revenue, the same way you would evaluate any other operating category.

Cyber Insurance for Law Firms: The LPL Rider Is Not Enough

Law firms concentrate exactly what attackers want: client identities, financial records, deal information, and standing instructions to move money. In the ABA's 2023 Legal Technology Survey, 29% of responding attorneys reported that their firm had experienced a security breach at some point, and another 19% could not say whether it had. IBM's Cost of a Data Breach Report puts the average cost of a US breach at $10.22 million, a figure that includes detection, notification, lost business, and regulatory response.

Many firms believe they already have cyber coverage because their LPL policy includes an endorsement. That endorsement is usually capped at $25,000 to $50,000, which does not cover forensic investigation, client notification, credit monitoring, business interruption, and ransom response at real-world scale. A standalone policy with both first-party coverage for your own losses and third-party coverage for claims from affected clients is the working standard.

Buy it before the incident, and expect the application to function as a security audit. Carriers now condition pricing and renewal on multi-factor authentication, endpoint detection and response, a documented incident response plan, and security awareness training. Firms missing those controls face higher premiums or a declined renewal.

One gap deserves specific attention from any firm managing client trust accounts: fraudulent wire instructions. Losses from social engineering often fall under the crime policy rather than the cyber policy, and sublimits vary widely, so confirm in writing which policy responds to an email-initiated fraudulent transfer and at what limit. Accurate IOLTA trust accounting and dual controls on disbursements reduce the odds you ever test that coverage, and they protect the firm's standing with clients and the bar.

Which Practice Areas Need Higher Law Firm Insurance Limits?

Personal injury, mass tort, real estate, securities, IP, and trusts and estates work carry the highest malpractice exposure, so law firm insurance limits should scale up when those matters make up most of the caseload. Criminal defense, immigration, and family law generally support minimum-tier limits at equivalent headcount.

Contingency practices concentrate risk in ways hourly firms do not. Case values are large, missed deadlines are unforgiving, and the firm's own balance sheet carries advanced client costs that grow with the docket. When contingency injury or mass tort work leads the caseload, we recommend pushing LPL to $5 million or more and raising crime and social engineering limits to $1 million or more, because the same account that pays case expenses is a target for fraudulent disbursement requests.

Trusts and estates carries a different problem: time. Claims often surface years after the work, sometimes after the responsible attorney has retired, which makes continuous coverage and extended reporting periods more important than raw limits. Real estate, securities, and IP practices have historically paid the highest LPL premiums, and carriers price that history into every renewal.

Lower-risk practice areas earn real savings. Criminal defense, immigration, and family law firms can typically defend minimum-tier limits, and redirecting part of the premium difference toward standalone cyber coverage is often the better risk trade at those firms' data volumes.

The Insurance Mistakes We See on Law Firm Financials

The most expensive mistake is a lapse on a claims-made policy. Because the policy in force when a claim is reported is the one that responds, a gap in coverage can eliminate protection for prior years of work, and retroactive coverage to repair the gap is costly when it is available at all. Continuous coverage is the discipline that matters more than any individual limit.

Three more patterns repeat across the firms we review. Owners assume the umbrella policy extends malpractice limits when it does not. Firms rely on the small cyber endorsement inside the LPL policy well past the point their data volume justifies a standalone policy. And firms dissolve, merge, or lose a senior attorney without buying tail coverage, which leaves the departing work uninsured the day the policy ends.

The last pattern is a reporting problem rather than a coverage problem. Premiums scatter across the financial statements, some in occupancy, some in payroll costs, some in general overhead, so nobody sees the total cost of risk in one place. Controller-level bookkeeping consolidates those lines, which turns renewal season into a single decision: this is what the firm pays to transfer risk, and this is what that number should buy. Reviewed annually next to the Critical Four, the insurance stack stops being a pile of invoices and becomes a managed line.

Where This Fits in Your Financial Plan

Three takeaways. Insurance for law firms is a stack sized to headcount and practice mix, not a single malpractice policy. Limits should scale with the risk actually on the books, especially for contingency and trust-heavy practices. And the claims-made structure rewards continuity, so treat renewal as a planning event, not an invoice.

We currently support more than 120 law firms, and our fractional CFO teams put the total cost of risk on the planning calendar next to revenue, margin, and cash. If you want a second set of eyes on your coverage stack before your next renewal, schedule a consultation with Law Firm Velocity.

Frequently Asked Questions

Do lawyers need malpractice insurance if their state does not require it?

As a practical matter, yes. Only Oregon and Idaho mandate coverage, but at least 27 states require attorneys to disclose their coverage status to the bar or to clients, so going without is visible to the people deciding whether to hire you. Claim frequency data from the ABA's Profile of Legal Malpractice Claims shows exposure across every practice area, and defense costs accrue even when claims fail.

What does a business owner's policy (BOP) cover for a law firm?

A BOP bundles general liability, commercial property, and usually business income coverage into one policy. For law firms, Insureon reports an average BOP cost of $57 per month at $1 million per occurrence and $2 million aggregate limits. It does not include malpractice, cyber, workers' compensation, or employment practices coverage, which are purchased separately.

Does an umbrella policy cover legal malpractice claims?

No. A commercial umbrella sits over general liability, commercial auto, and employer's liability, and it does not extend lawyers professional liability limits. Firms that need more malpractice capacity buy a separate excess LPL layer above the primary policy.

What is tail coverage and when does a law firm need it?

Tail coverage, formally an extended reporting period or ERP, lets a firm report claims after a claims-made policy ends for work performed while the policy was in force. The ABA Standing Committee on Lawyers' Professional Liability recommends it when a firm closes, merges, or changes carriers, and when an attorney retires or departs. Without it, prior work goes unprotected the day the policy expires.

How much cyber insurance does a law firm need?

Solo and micro firms should carry $500,000 to $1 million in standalone cyber limits, small firms $1 million to $3 million, and mid-size firms $3 million to $5 million or more. The driver is the volume of client personal information and funds movement the firm handles. With the average US breach costing $10.22 million per IBM's Cost of a Data Breach Report, the small endorsement inside a malpractice policy is not a substitute.