FRANCE Trends and Developments Contributed by: Emmanuèle Lutfalla and Louis Fer, Signature Litigation AARPI
must be allocated between covered directors, corpo- rate entities and uninsured conduct. Cyber-Risk: From Technical Incident to Systemic Threat The French regulatory framework Article L. 12-10-1 of the Insurance Code, introduced by Law No 2023-22 of 24 January 2023 on the Orien- tation and Programming of the Ministry of the Interior (the “LOPMI Law”), makes the payment of an insur- ance indemnity for certain cyber-attacks conditional on the reimbursement of ransomware payments on the filing of a criminal complaint by the insured within 72 hours of becoming aware of the attack. The provi- sion was intended to improve the reporting of cyber- crime and to give law enforcement earlier visibility into active incidents. In practice, it added a new proce- dural layer to coverage analysis: an insured who fails to file in time may be unable to obtain payment under the relevant insurance contract, even if the policy oth- erwise provides cover. The provision has generated debate among practitioners, particularly regarding its interaction with policies that cover business interrup- tion losses flowing from the same attack but do not specifically reimburse the ransom. At the European level, the Digital Operational Resil- ience Act, applicable to financial entities includ- ing insurers since January 2025, imposes prescrip- tive requirements on ICT risk management, incident reporting, operational resilience testing and third-par- ty risk oversight. The French Prudential Supervision and Resolution Authority has made cyber-resilience a supervisory priority, reflecting the recognition that insurers are themselves potential targets as much as they are providers of cyber cover. The French Insurance Federation’s 2025 risk map ranked cyber-risk as the French insurance indus- try’s leading risk, reflecting attacks that increasingly cross traditional lines of business. The insurer’s role is changing most visibly in the conditional nature of cover: policies increasingly require policyholders to maintain specified cybersecurity standards. Coverage may therefore depend not only on the occurrence of an attack but also on compliance with contractual security obligations. The policy is no longer simply a
promise to indemnify loss after the event, it can shape risk management before the loss occurs. Cyber-insurance is consequently becoming a fertile source of coverage litigation. The 72-hour complaint condition may produce split outcomes: an insured that reports a ransomware attack late may be unable to obtain payment under the relevant insurance con- tract, while arguing that business interruption losses flowing from the same attack remain covered under the policy. Insurers may invoke war exclusions for state-sponsored attacks, but attribution is uncertain and proving that a cyber-operation legally qualifies as an act of war is difficult. Similar disputes arise over silent cyber losses under traditional property or liabil- ity policies. Finally, refusing a legitimate claim under a contested sanctions limitation clause or debatable war exclusion may amount to abusive resistance to payment, exposing the insurer to damages beyond the policy indemnity. Data Protection Sanctions and the Insurability Debate Recent enforcement actions by the French Data Pro- tection Authority have kept data protection firmly on the insurance agenda. In December 2024, the author- ity imposed a fine of EUR2.3 million on Free and Free Mobile for data protection failures, a decision that also triggered a class action claim. Earlier that year, a breach at the national employment agency exposed the personal data of 43 million individuals, an incident whose scale underscored the systemic nature of data risk in public infrastructure. The insurability of administrative fines remains a con- tested question in French law. The French Prudential Supervision and Resolution Authority has indicated that insuring fines imposed by public authorities is contrary to public policy, on the basis that allowing indemnification would deprive the sanction of its deterrent effect. The market has adopted a pragmatic position: fines themselves are generally not covered, but the defence costs incurred in challenging or miti- gating a regulatory sanction are insurable under cyber or D&O policies. The distinction is significant in prac- tice, because legal and advisory fees in complex data protection proceedings can be substantial.
121 I NSURANCE L I T IGATI O N 2026
CHAMBERS.COM
Powered by FlippingBook