Service Robot Insurance: The Evidence Pack Behind the Certificate
At a glance: The certificate of insurance is one page and it is the last thing anyone looks at, until a claim arrives. What actually decides whether a robot claim is paid is the evidence pack behind that certificate: the right named insureds, a public liability limit that matches the venue contract, the telemetry retention that lets you reconstruct the event, and the subrogation position that decides who recovers from whom. This guide is the operations side of robot insurance, written for the facility or fleet manager who has to produce the file.
What an Underwriter Is Actually Pricing
A robot is not a strange risk to an underwriter. It is a mobile machine that occupies a public space, and the pricing logic is the same one used for escalators, automatic doors and floor-cleaning equipment. What changes with an autonomous fleet is the volume of small incidents and the quality of the data around them. An underwriter quoting a 20-robot fleet is pricing four things: the frequency of low-severity contact events, the tail risk of a single serious injury, the property damage risk to the building and its contents, and the reliability of the insured's own evidence when a claim is disputed.
The fourth item is the one operators underestimate. A carrier that expects a claim to be arguable will load the premium and will ask for a higher self-insured retention. A carrier that believes the operator can produce a timestamped, sensor-backed account of every event prices the risk as a known quantity. The difference between those two quotes on a mid-size fleet is routinely 20 to 40 percent, and it comes from documentation, not from the robot.
That is why the evidence pack is worth building before the first quote rather than after the first claim. It is also why the incident register has to be honest: an operator with a documented near-miss record and a closed corrective action is a better risk than one with a clean sheet and no record at all, and the escalation design that produces that record is set out in the incident response and escalation guide. The rest of this guide is what goes in the pack.
The Certificate of Insurance and What Must Be on It
A certificate of insurance (COI) is an evidence document, not a policy, and it is what a venue, a landlord or a client's procurement team will ask for. Most disputes about robot insurance are not disputes about cover; they are certificates that name the wrong entity, carry the wrong limit, or omit the endorsement the contract required. The fields below are the ones to check on every certificate, every renewal.
| Field | What to check | Common failure |
|---|---|---|
| Named insured | The legal entity that signed the robot contract, exactly as written | Trading name, group parent, or a subsidiary that does not hold the contract |
| Additional insured | Client, landlord or venue named as additional insured where the contract demands it | Blanket additional-insured wording rejected by the client's legal team |
| Policy period | Covers the full service term, not just the installation month | Certificate expires mid-contract and nobody notices |
| General liability limit | Per-occurrence and aggregate both meet the contract minimum | Aggregate adequate, per-occurrence too low for the venue type |
| Products and completed operations | Included, since a robot is a product in operation | Excluded, leaving a gap for defects in the robot itself |
| Care, custody and control | Cover for property in the robot's possession, if it carries goods | Delivery robots moving client inventory with no cover for it |
| Primary and non-contributory | Stated where the client requires it | Missing, so the client's own policy shares the loss |
| Waiver of subrogation | In favour of the client or landlord where required | Requested in the contract but never endorsed |
Two practical rules follow. Always obtain the certificate from the broker rather than from a template, because the endorsements are what matter and a template cannot show them. And file the certificate with the contract that demanded it, so the renewal review can check the certificate against the clause rather than against memory.
Public Liability Limits by Venue Type
Public liability limits are set by the venue, not by the robot. A supermarket, an airport and an apartment lobby impose very different requirements, and a fleet that moves between sites has to carry the highest limit it will be asked for or negotiate each site separately. The ranges below reflect what commercial venue contracts commonly require in 2026; they are contract requirements, not actuarial advice, and the site contract always governs.
| Venue type | Typical required limit | Why the number sits there |
|---|---|---|
| Office lobby, corporate campus | 1 to 2 million per occurrence | Low public footfall, staff-dominated exposure |
| Retail store, supermarket | 2 to 5 million per occurrence | Public footfall, slip and trip history, higher claim frequency |
| Hotel, restaurant, hospitality | 5 million per occurrence | Guest injury exposure plus food and beverage service risk |
| Airport, rail station, transit hub | 5 to 10 million per occurrence | Concession contracts, high throughput, strict authority requirements |
| Hospital, clinic, care facility | 5 to 10 million per occurrence | Vulnerable persons, clinical environment, reputational tail |
| Warehouse, industrial site | 2 to 5 million per occurrence | Lower public exposure, higher property and equipment value |
The number that most often catches operators is the transit and healthcare band, because the fleet was priced against a retail contract and then won a hospital or airport site. A limit increase mid-term is possible but is treated as a new risk, so the cheaper path is to carry the top limit the target market requires from the start and price it into the contract.
Naming the Right Insured Parties
Robot deployments have more interested parties than a normal equipment sale. The operator of the fleet, the owner of the site, the client whose contract the robot performs under, and sometimes the landlord who owns the building all have an insurable interest in the same event. Getting the named and additional insureds right is not paperwork; it decides who responds to a claim and who is left arguing.
The pattern that works is straightforward. The fleet operator is the named insured on the liability policy. The client whose premises the robot works in is an additional insured, because the client's own policy would otherwise respond first and the client will insist on it. The landlord is an additional insured only where the lease requires it, which is common in shopping centres and airports. The robot manufacturer is not an additional insured but must provide its own product liability certificate, because a defect claim runs against the manufacturer, not the operator.
Where the deployment is RaaS rather than a purchase, the split changes: the RaaS provider usually owns the liability policy and the client is an additional insured, and the contract should say explicitly which party responds to a third-party claim and which party's insurer leads. Two operators on one site with two separate policies and no lead designation is the configuration that produces the slowest claims.
Telemetry Retention Versus the Claims Timeline
A robot incident is reconstructed from data, and the data expires faster than the claim does. A slip-and-fall claim may be notified six months after the event and litigated two years later. Most fleet platforms default to 30, 90 or 180 days of detailed logs, which means the operator is producing a narrative from memory by the time anyone asks. The retention requirement has to be derived from the claim timeline, not from the platform default.
| Evidence | Typical claim need | Minimum retention to specify |
|---|---|---|
| Task and route log | Where the robot was, and when | 3 years |
| Event and alarm log (contacts, e-stops, faults) | Whether an incident was detected and how it was escalated | 3 years |
| Sensor summary and video where fitted | What the robot saw in the seconds before an event | 90 days hot, 12 months archived is a workable split |
| Battery and charging state | Whether a low-power or charging fault contributed | 2 years |
| Firmware and configuration version | Whether the behaviour at the time matches current release | Life of the asset plus 3 years |
| Maintenance and inspection records | Whether the asset was maintained to the required standard | Life of the asset plus 3 years |
The firmware row is the one that surprises operators. If the robot's behaviour changed between releases, the claim turns on which version was running, and the platform's current version tells you nothing about a version that was replaced 18 months ago. Keep a version history against deployment dates, and keep the release notes. The firmware and OTA lifecycle guide covers how to record that history without extra tooling.
Retention also has a privacy boundary. Video and audio that identify individuals are personal data in most jurisdictions, and retaining them beyond the operational need creates its own exposure. The workable approach is to retain the structured logs in full and to retain identifiable media on a short hot window with a documented legal-hold procedure that extends retention only when a claim is notified. The privacy side of that is set out in the fleet cybersecurity and data privacy guide.
Subrogation: Who Recovers What From Whom
Subrogation is the mechanism by which an insurer that has paid a claim steps into the insured's shoes to recover from whoever actually caused the loss. On a robot deployment it matters because there are usually three candidate causes and they point at three different parties: a robot defect points at the manufacturer, an operator error points at the fleet operator, and a site hazard points at the client or landlord.
Two clauses shape the outcome. A waiver of subrogation in favour of the client means the operator's insurer cannot recover from the client after paying, which is usually what the client wants and what the operator should price for. A cross-liability clause means the policy responds to a claim by one insured against another, which matters when the operator and the client are both insured under the same policy and a dispute between them arises.
The practical consequence is that the contract should say who carries the risk of each failure class before the policy is bound, not after. A contract that is silent on defect-versus-operation sends both parties to their insurers, and the insurers send both parties to their lawyers. The insurance and liability guide covers the coverage lines themselves and how a purchase, lease and RaaS structure allocate them.
The Annual Renewal File
Insurance renews annually and the robot fleet usually changes more than annually, so the renewal submission should be assembled from the same evidence pack rather than rebuilt each year. Twelve items cover a mid-size fleet and each one has an owner.
- Updated asset schedule: every robot, serial number, site, commissioning date and current status.
- Incident register for the year, including near misses and no-injury contacts, with the escalation outcome for each.
- Claim history with reserves and closures, including claims closed at nil.
- Current certificate of insurance and the endorsements in force.
- Contract register showing which site contracts demand which limits and which additional insureds.
- Maintenance compliance record against the vendor's schedule, with any missed intervals explained.
- Firmware version map and the release history for the year.
- Training records for the operators, including the induction and any refresher.
- Safety inspection results and any corrective actions closed.
- Telemetry retention confirmation, with a sample export proving the retention window actually works.
- Any change in duty cycle, site type or operating hours that alters the risk profile.
- Subcontractor or agency arrangements, since a third-party operator changes the liability picture.
The test of the file is simple: hand it to a broker who has never seen the fleet and see whether they can quote without asking a question. If they can, the pack is complete, and the renewal conversation moves from explaining the risk to pricing it.
Two of those twelve items are worth building first because they take longest to create. The incident register accumulates from the day the fleet goes live, and the maintenance compliance record depends on the schedule actually being followed, so both should start at commissioning rather than at renewal. The safety standards and compliance guide covers the standards the maintenance record is measured against, and the preventive maintenance schedule guide covers the intervals themselves.
Frequently Asked Questions
Does a service robot need its own insurance policy?
No separate policy class exists for robots in most markets. The robot fleet is usually scheduled under the operator's general liability and property policies, with the asset added to the schedule. What does need separate attention is product liability, which sits with the manufacturer, and cyber cover, which is increasingly required where the fleet holds client data.
Who is liable if a robot injures a customer?
Liability follows the cause. A defect points at the manufacturer, a failure to maintain or supervise points at the operator, and a site hazard the client created points at the client. The contract and the insurance structure should allocate each of those before an incident, because the outcome is decided by the evidence and the clauses, not by the fact that a robot was involved.
How long should robot incident video be kept?
Long enough to cover the notification tail of a claim, which in commercial premises is commonly six to twelve months. Ninety days hot plus twelve months archived covers most notifications; anything longer should be held under a documented legal hold on a specific incident rather than by retaining everything indefinitely.
Does RaaS change who insures the fleet?
Yes. Under RaaS the provider typically owns the liability policy and the client is named as an additional insured, and the contract must state which party leads a third-party claim. Under a purchase the operator insures and the client is usually an additional insured on the operator's policy.
Get a Quote
Tell us about your space and workload, we reply within 24 hours.