What changed in cyber insurance requirements for 2026?

Less on the application than you might expect, and more around it. We can only compare forms that are public, and the Canadian form we track carries no date, so a year-on-year comparison is mostly not possible from the outside. That form still asks the incident response question in two parts. What we could verify in 2026 sits around the form: a Canadian insurer adding first-party cyber cover with a fraud limit set by controls, a carrier’s claims data showing payment fraud as most of its incidents, and a federal cyber law that passed but is not yet in force.

What did carriers add?

Nothing we could verify on an application form. That says more about what is public than about what moved. Beazley’s Canadian application, the one we follow most closely, carries no date anywhere in it (Beazley Cyber Application, Canada, 2026).

The clearest documented change came from a Canadian insurer on 1 October. LAWPRO, which insures Ontario lawyers in private practice, announced that its 2027 program adds first-party cyber coverage and moves all of its cyber cover into one endorsement. First-party and third-party cyber claims will share a sublimit of up to $250,000. The social engineering limit can rise from $250,000 to $1,000,000 where specified risk controls set out within Endorsement 14 are met (LAWPRO, Your 2027 program, New cyber enhancements, 2026).

The control-based limit is not new. LAWPRO’s limit for social engineering fraud has depended on steps written into a firm’s retainers since 2024 (LAWPRO, practicePRO Social Engineering Toolkit, 2026). What is new is that it now sits inside a cyber endorsement with first-party cover beside it. That is the pattern worth noticing: a control that decides how much cover you have, not just whether you have any.

What stayed the same?

Area	Status in 2026	What we read
A written incident response plan	Still asked	Beazley’s Canadian form, tick box: Have a plan
A plan tested in the last year	Still asked, as its own box	The same question, second box: Tested in last year
Who ran the test	Still not asked	The form asks Internal, Third Party or None only about compliance audits
Payment verification controls	Sets the fraud limit for Ontario lawyers, carried into 2027	LAWPRO’s social engineering limit has turned on retainer steps since 2024, and on Endorsement 14 controls from 2027
Payment fraud in claims	Most of one carrier’s incidents	58 percent of the incidents in Coalition’s 2026 report were email compromise or funds transfer fraud
Federal cyber law	Passed, not in force	Bill C-8 received Royal Assent on 15 June 2026. Part 2 waits on an order

Sources for the table: Beazley’s two questions (Beazley Cyber Application, Canada, 2026), Coalition’s report (Coalition, 2026 Cyber Claims Report, 2026), and the Act’s own coming-into-force clause (Justice Laws Canada, An Act respecting cyber security, S.C. 2026, c. 9, section 16, 2026).

The incident response question is the line we watch most closely. On the form we can read, it still separates having a plan from testing it, and nothing in it asks who ran the test.

What should you prepare?

The same evidence as last year, plus one record that used to be easy to skip.

Pull the written plan and check its date. Find the record of the last test. If there is none, decide now whether one happens before renewal, because the second box is still there.

Then go to finance, not IT, and get the written payment verification procedure: the callback rule, the threshold above which it applies, and something that shows it is followed. It is the row LAWPRO ties its fraud limit to, and the one an IT-led review is most likely to miss.

If you supply a bank, a telecom company or a utility, watch for the Bill C-8 order as well. When it comes, the questions will reach you through your customers’ contracts.