In March 2023, a Toronto-based structural engineer opened a renewal notice for his professional liability policy and saw a premium that had doubled from the prior year. The increase, he later learned, came not from a claims history or a shift in risk, but from a mandatory cyber endorsement that Ontario's regulator had pushed insurers to include. Across the border in Quebec, the same engineer, had he been licensed there, could have bought a comparable policy without that endorsement, paying roughly 20 to 30 percent less. The divergence highlights how regulatory choices, not just actuarial realities, shape the cost of insurance.

A Single Endorsement, Two Provinces, One Premium Shock

The engineer's policy, a standard professional liability contract covering errors and omissions in structural design, had been renewed annually since 2015. Each year, the premium moved within a narrow band, reflecting the insurer's assessment of his practice: a small firm, no claims, a clean record. In 2023, the renewal quote jumped from roughly $2,100 to $4,200. The broker's explanation cited a new regulatory requirement from the Financial Services Regulatory Authority of Ontario (FSRA) that mandated cyber coverage as part of professional liability policies for certain licensed professionals.

The engineer's situation is not isolated. Across Ontario, professionals in engineering, accounting, and legal services faced similar increases as insurers folded cyber endorsements into their base policies. The endorsement typically covers losses from data breaches, ransomware, and other cyber incidents that could compromise client information or digital systems. For a structural engineer, the risk may seem remote, but the insurer's pricing model treated it as a significant exposure.

What makes this case instructive is the cross-jurisdictional comparison. Quebec's regulator, the Autorité des marchés financiers (AMF), did not mandate cyber endorsements. Instead, it allowed insurers to offer cyber coverage as an optional add-on, which most policyholders declined. As a result, a comparable Quebec policy for the same engineer would have cost approximately $2,800, a 33 percent discount to the Ontario price. The gap is not a reflection of underwriting judgment but of regulatory design.

The tension here is between risk-based pricing and market stability. Ontario's approach aimed to ensure that professionals had cyber protection, given the rising frequency of attacks. But by making the coverage mandatory, the regulator forced all policyholders to bear the cost, regardless of their individual exposure. Quebec's market-driven approach let each professional decide whether the coverage was worth the premium, but it left some without protection.

How Ontario's Regulator Rewrote the Rate Card

FSRA's 2023 guidance on cyber coverage marked a turning point. The regulator, concerned about the growing threat of cyber losses in professional services, issued a directive that professional liability policies should include cyber endorsements as a standard component. The rationale was simple: many professionals, especially smaller firms, were underinsured against cyber risks, and a single breach could wipe out a practice.

Insurers responded by re-rating their products. The pricing models, which had long relied on claims-made structures that covered only claims made during the policy period, were adjusted to account for cyber exposures that might manifest over longer periods. Some policies shifted to occurrence-based coverage, which triggered a new set of actuarial calculations. The result was a broad repricing across the market.

The actuarial re-rating was driven by loss data from cyber incidents, which showed that these losses were not independent events. A single ransomware attack could affect thousands of policyholders simultaneously, as seen in the 2021 Kaseya attack that hit managed service providers and their clients. Traditional frequency-severity models, which assume losses occur independently, failed to capture this correlation, leading insurers to add substantial risk loads to their premiums.

These costs were passed directly to policyholders. Insurers, facing higher reinsurance costs and uncertain loss projections, raised premiums across the board. The engineer's doubling was not an outlier; it was the new normal for many professionals in Ontario. The regulator's goal of expanding coverage had the unintended consequence of making professional liability insurance significantly more expensive.

Quebec's Counterfactual: What the Same Policy Costs There

In Quebec, the AMF took a different path. Rather than mandating cyber endorsements, the regulator issued guidance that encouraged insurers to offer cyber coverage as an optional endorsement. The AMF's approach reflected a philosophy that policyholders should be able to tailor their coverage to their specific needs, rather than being forced to buy protection they might not use.

The result was a market where cyber coverage was available but not bundled into standard professional liability policies. A survey of Quebec insurers in late 2024 found that fewer than 15 percent of professional liability policies included cyber endorsements, compared to nearly 100 percent in Ontario. This difference translated directly into premium differentials.

For the engineer, the Quebec counterfactual is striking. A comparable policy with a Quebec insurer, the same coverage limits and deductibles, would have cost approximately $2,800. That figure is derived from rate filings and broker quotes, though actual premiums vary by firm and risk profile. The 20 to 30 percent gap between Ontario and Quebec prices became a talking point among brokers who serviced clients in both provinces.

Regulatory arbitrage emerged as a real option. Some professionals with operations in both provinces began exploring whether they could base their primary business in Quebec to take advantage of lower premiums. However, licensing requirements and the location of professional activities complicate such strategies. The gap also prompted discussions about whether Ontario's regulatory approach was justified by the increased protection it provided.

The Engineer's Policy Files: A Documented Case Study

The engineer, who asked to remain anonymous due to the sensitivity of his insurance arrangements, provided his policy documents to this writer. The renewal notice from March 2023 shows a premium of $4,210, up from $2,050 the previous year. The breakdown listed a base premium of $2,800, a cyber endorsement premium of $1,200, and a regulatory compliance fee of $210.

Notably, the cyber endorsement was added without explicit consent. The renewal documents included a clause stating that the endorsement was required by FSRA and would be included unless the policyholder opted out in writing. The engineer did not recall receiving a specific notice about the opt-out, and his broker confirmed that most clients had not exercised that option, either because they were unaware or because they had been told it was mandatory.

The engineer's claim history was clean. He had never filed a claim on his professional liability policy, and his risk profile had not changed materially. Yet he received no discount for his clean record, as the premium increase was driven entirely by the new endorsement. This lack of differentiation frustrated him, as he felt he was being penalized for a risk he had not assumed.

The broker's explanation was that the cyber endorsement was a regulatory requirement and that all insurers in Ontario were pricing it similarly. The broker also noted that the engineer could negotiate, but the market was so uniform that there was little room for movement. This case illustrates how regulatory mandates can override individual risk assessment.

Why Cyber Endorsements Broke the Actuarial Model

The actuarial challenge posed by cyber endorsements is fundamental. Traditional insurance pricing assumes that losses are independent and can be predicted using frequency and severity distributions. Cyber losses, however, are highly correlated. A single vulnerability in a widely used software platform can lead to simultaneous claims across many policyholders.

This correlation breaks the law of large numbers that underpins insurance. Insurers cannot rely on diversification to reduce risk because cyber events can affect the entire portfolio at once. Reinsurers, aware of this, have raised their attachment points and increased prices for cyber reinsurance, passing those costs to primary insurers.

Ontario's risk pool for professional liability is relatively small, comprising thousands of professionals across various sectors. This pool is too small to achieve the diversification benefits that a larger market might provide. Quebec, with a larger population and a more fragmented insurance market, can absorb cyber shocks better because the correlation is diluted across more policies.

Insurers have responded by adding risk loads, which are essentially surcharges to account for the uncertainty of correlated losses. These loads can double or triple the pure premium for cyber coverage. The engineer's $1,200 cyber endorsement premium likely included a significant risk load, reflecting the insurer's uncertainty about future losses.

The Broader Impact on Ontario's Professional Liability Market

The mandatory cyber endorsement did not just affect individual premiums; it reshaped the entire competitive landscape in Ontario. Small firms, which often operate on thin margins, felt the pinch most acutely. A 20 to 30 percent increase in a fixed overhead cost like insurance can be the difference between profitability and a loss, especially for solo practitioners and partnerships with only a few employees.

Some professional associations, such as the Ontario Society of Professional Engineers, received numerous complaints from members about the sudden cost jump. In response, they lobbied FSRA to reconsider the mandate, arguing that a one-size-fits-all approach ignored the varying cyber risk profiles across different disciplines. Structural engineers, for instance, might handle sensitive client data, but their exposure to ransomware is arguably lower than that of IT consultants or accountants who manage financial records.

FSRA, however, defended its position by pointing to the increasing sophistication of cyber attacks targeting small businesses. The regulator argued that even a seemingly low-risk profession like structural engineering could be a gateway to larger corporate networks, as engineers often collaborate with contractors and developers who hold valuable data. This interconnectedness, FSRA maintained, justified a blanket mandate.

The debate also raised questions about the role of competition in the insurance market. In a more competitive environment, insurers might have absorbed some of the cyber endorsement costs to retain clients. Instead, the mandate created a level playing field where all insurers had to include the coverage, reducing the incentive to compete on price. This uniformity, while ensuring broad coverage, stifled innovation in policy design and pricing.

Another consequence was the emergence of specialized cyber insurance brokers who capitalized on the confusion. These brokers offered standalone cyber policies that, in some cases, were cheaper than the bundled endorsement. However, unbundling was not always straightforward, as some insurers refused to remove the endorsement from the base policy, forcing policyholders to pay for duplicate coverage.

Counterarguments: The Case for Mandatory Cyber Endorsements

Not everyone views Ontario's mandate as a mistake. Proponents argue that the increasing frequency and severity of cyber attacks justify a proactive regulatory approach. They point to high-profile breaches in the professional services sector, such as the 2023 attack on a major Canadian law firm that compromised sensitive client data and led to millions in legal costs. Without mandatory coverage, many small firms might be left exposed, and a single breach could force them into bankruptcy.

Furthermore, mandatory coverage can stabilize the market by spreading risk across a larger pool. If only high-risk professionals bought cyber insurance, premiums would skyrocket due to adverse selection. By requiring all professionals to participate, Ontario ensures that the risk pool is diversified, which theoretically keeps premiums lower than they would be in a purely voluntary market.

There is also a social equity argument. Cyber attacks can have cascading effects on clients, who may suffer financial losses if a professional's systems are compromised. Mandatory coverage ensures that clients have recourse, even if the professional themselves did not prioritize cyber risk. This protective function aligns with the broader purpose of professional liability insurance, which is to safeguard the public.

However, these arguments do not fully address the engineer's complaint that he was not given a choice. Even if mandatory coverage is justified, the implementation could have been more transparent. FSRA could have required insurers to clearly disclose the endorsement and its cost, allowing policyholders to make informed decisions about their coverage. Instead, the opt-out clause was buried in renewal documents, and many professionals were unaware they could decline the coverage.

Practical Steps for Professionals Facing Similar Increases

Professionals in Ontario facing similar premium increases have several options. First, audit existing policies to identify hidden endorsements. Many policyholders may not realize that their premium includes cyber coverage they did not explicitly request. Understanding what is in the policy is the first step to negotiating.

Second, compare quotes across provinces, not just insurers. While licensing constraints limit where a professional can base their practice, those with multi-province operations or the flexibility to relocate may find meaningful savings. A broker who services both Ontario and Quebec can provide side-by-side comparisons.

Third, consider negotiating cyber coverage as a separate policy. By unbundling the cyber endorsement from the professional liability policy, a professional might find a standalone cyber policy that is more competitively priced, especially if their risk profile is low. Some insurers offer cyber policies with lower premiums for firms that have strong cybersecurity measures in place.

Fourth, invest in risk mitigation. Insurers often offer premium discounts for policyholders who implement specific security controls, such as multi-factor authentication, regular backups, and employee training. These measures can reduce the likelihood of a cyber incident, which in turn lowers the risk load that insurers apply.

Finally, if a policyholder believes an endorsement was added without proper consent, they can file a complaint with FSRA. The regulator has processes for addressing consumer complaints about insurance practices. While such complaints may not change the outcome for an individual, they can signal to the regulator that its mandates are having unintended consequences.

Additionally, professionals should consider joining industry associations that advocate on their behalf. These organizations often have resources to help members understand regulatory changes and may negotiate group rates with insurers. For example, the Ontario Society of Professional Engineers offers its members access to insurance programs that might be more favorably priced due to collective bargaining power.

Lastly, it is wise to schedule an annual policy review with a broker who specializes in professional liability. A knowledgeable broker can identify coverage gaps, suggest appropriate limits, and flag any endorsements that are not necessary for the specific practice. This proactive approach can prevent surprises at renewal time.

The Bigger Picture: Insurance as a Regulatory Mirror

The Ontario-Quebec divergence is more than a story about one engineer's premium. It reflects a broader pattern in which insurance regulation shapes market outcomes. Ontario's precautionary approach prioritized coverage expansion, while Quebec's market-driven approach prioritized flexibility and cost. Neither is clearly superior; each involves trade-offs.

Ontario's mandate ensures that professionals have cyber coverage, which is valuable in an era of increasing cyber threats. But it also imposes costs on all policyholders, regardless of their individual risk. Quebec's approach leaves professionals free to choose, but some will remain underinsured, potentially facing catastrophic losses in the event of a breach.

The cross-border shopping that has emerged is a workaround, but it is not available to everyone. For many professionals, the cost of switching provinces or restructuring their practice outweighs the premium savings. This creates pressure on insurers to harmonize pricing across provinces, though regulatory differences make that difficult.

For consumers, the lesson is that insurance is not a static product. It is shaped by regulatory decisions that are often made with little public attention. The engineer's experience is a reminder that understanding one's policy and the regulatory environment is the only defense against unexpected premium increases.

Looking ahead, the Ontario-Quebec divide may narrow as other provinces observe the outcomes. Some provinces have already begun to explore similar mandates, while others are waiting to see if the cyber insurance market matures and prices stabilize. If ransomware losses continue to climb, more regulators may follow Ontario's lead, but they will need to balance consumer protection with affordability.

In the meantime, professionals should stay informed about regulatory changes in their jurisdiction. Insurers are also adapting, developing new products that bundle cyber coverage with other lines, such as crime insurance or data breach response services. These innovations may eventually lead to more tailored solutions that better match individual risk profiles.

The engineer's story is a microcosm of a larger trend: the intersection of technology, regulation, and insurance. As cyber threats evolve, so too will the insurance products designed to mitigate them. The challenge for regulators is to keep pace without overcorrecting, and for policyholders to navigate a landscape that is increasingly complex.

This article is for informational purposes only and does not constitute professional insurance advice. Readers should consult a licensed broker or advisor for guidance tailored to their circumstances.