Michigan CPA, Engineering and Architecture Firm Insurance: Where Professional Liability Actually Fails

Run a CPA, engineering or architecture firm in Michigan? Have us review your E&O program →

Michigan professional services firm insurance gets bought on one number — the per-claim limit — and that is the number least likely to determine whether you survive a claim. On most professional liability policies your defense lawyer is paid out of that limit, not in addition to it. Your coverage depends on a retroactive date that a carrier change can silently reset. And Michigan's statutes give CPA firms a genuine liability shield and design firms a shorter limitations period than most of them realize. If you run an accounting, engineering or architecture firm in Michigan, these are the things worth an hour before your next renewal.

Your general liability was never built to cover advice

Start here because it is the foundation, and the usual shorthand for it is wrong in a way that matters.

The commonly repeated claim is that the standard general liability form excludes professional services. In its unendorsed state, it does not contain a blanket professional services exclusion. The real reason your general liability does nothing for a professional claim is structural: Coverage A responds only to bodily injury or property damage caused by an occurrence, and Coverage B only to personal and advertising injury. A design error that forces a redesign, a missed election that triggers a tax penalty, a structural calculation that adds six figures to a project — those are pure economic loss. They never meet the trigger, whether or not any exclusion is attached.

On top of that, carriers do attach exclusions to remove any argument: CG 21 16, Exclusion — Designated Professional Services, with your services scheduled on it, and for design firms CG 22 43, Exclusion — Engineers, Architects Or Surveyors Professional Liability. Belt and suspenders.

Where this gets litigated is the edges. Exclusions are construed strictly against the insurer under Michigan law, and some courts have found failure-to-warn or failure-to-supervise allegations to fall outside a professional services exclusion — though courts split on that, and many hold such allegations are within the rendering of professional services. Either way, the trigger problem does not go away. The honest version: your general liability covers the slip-and-fall in your lobby and the property damage your field crew causes. It does not cover your judgment.

Defense inside the limit: the number nobody quotes you

This is the single most consequential structural feature of professional liability, and it is the default. On most E&O, D&O and cyber policies, claim expenses erode the limit of liability. Your limit is not a settlement fund with a defense budget beside it. It is one pot, and the lawyers are drawing from it first.

Run the arithmetic on a $1,000,000 per-claim limit:

• $300,000 in defense costs through discovery and experts leaves $700,000 to settle or satisfy a judgment.
• Exhaust the limit defending a claim and two things happen at once: the insurer's duty to defend ends, and you fund the rest of the defense, any appeal, and any second claim reported in the same policy year out of the firm's own money — because claim expenses erode the aggregate too.

Options exist to change this, and their existence as priced options is the clearest proof of what the default is. In the architect and engineer market and among specialty CPA carriers you can find a fully separate claim-expense limit, or a capped first-dollar claim-expense sublimit that pays defense until it is exhausted and then reverts to eroding the policy limit. Those are two different products with very different outcomes. Availability, structure and cost vary by carrier, state and filing, so the useful move is to have your broker quote the option alongside the base program rather than assume a rule of thumb. On a mid-sized firm's program this is frequently the highest-return dollar in the entire policy, and most firms have never been shown it.

Claims-made: three mechanics that decide whether you are covered at all

Professional liability is written on a claims-made basis, which means the trigger is when the claim is made, not when you did the work. Three details control the outcome.

The retroactive date. This is the earliest date of professional services the policy will respond to. Work performed before it is not covered no matter when the claim arrives. For a firm with fifteen years of work product, the retro date is the most valuable line on the declarations page.

"Claims-made and reported" is not the same as claims-made. A pure claims-made policy requires only that the claim be made against you during the policy period. A claims-made-and-reported policy requires that it be both made and reported to the insurer during the policy period. The practical failure is obvious once you see it: a demand letter that arrives the third week of December, sits in a partner's inbox through the holidays, and gets reported in January can be an uninsured claim on a claims-made-and-reported form. Some forms add a short post-expiration grace window for reporting. Find out whether yours does, and how long it is.

A lapse resets everything. If coverage lapses, the retroactive date on your next policy will in practice almost always become the date you bought it — erasing prior acts for every year before. The same thing happens quietly on a carrier change when nobody insists the new policy carry forward the original retro date. Prior acts can sometimes be bought back with a warranty statement and a gap letter, but it is a negotiation, not a right. And note that a purchased extended reporting period or tail — which runs one to three years or longer, and is a different instrument from a short grace window — only extends the window to report a claim. It does not move the retroactive date, so it never restores the years a lapse cut off.

Michigan's limitations picture for design firms is not what it was in 2011

MCL 600.5839 is the statute every Michigan architect and engineer has heard of. Its layers:

• Six years after the time of occupancy of the completed improvement, its use, or its acceptance — for state-licensed architects and professional engineers furnishing design or supervision of construction, and for contractors making the improvement. It also reaches actions for contribution or indemnity arising out of such an injury, which is how a contractor's claim finds a design firm.
• Gross negligence: one year after the defect is discovered or should have been discovered, with an outer limit of ten years after occupancy, use or acceptance.
• Surveyors: six years after the survey or report is recorded or delivered. The "recorded or" was added by 2011 PA 162; before that it ran only from delivery.
• The statute has covered the licensee's corporation, partnership or other business entity since 1985, not just the individual.

The case most often quoted here needs a date and a boundary. In Miller-Davis Co. v. Ahrens Construction, Inc., 489 Mich 355 (2011), the Michigan Supreme Court held MCL 600.5839(1) reaches only tort claims for injury to property or bodily injury — so a breach-of-contract claim against a contractor runs six years from the breach rather than from occupancy. Ahrens was a contractor, and that is where the holding lives.

For design professionals, the Legislature responded. 2011 PA 162 added MCL 600.5805(13), which provides that an action against a state-licensed architect, professional engineer or licensed professional surveyor arising from professional services rendered is an action charging malpractice, subject to the two-year period in MCL 600.5805(8) — and MCL 600.5805(14) makes those periods subject to the applicable repose in MCL 600.5839. It applies to causes of action accruing on or after January 1, 2012. So for a Michigan design firm, this is not a framing choice a plaintiff gets to make by pleading in contract. Accrual runs from when the professional discontinues serving the plaintiff (MCL 600.5838(1)), with a six-month-from-discovery extension (MCL 600.5838(2)).

The practical conclusion for how you buy insurance still holds, and for better reasons than the old contract argument: your real tail is longer than six years. The gross-negligence branch reaches ten years, the discovery extension moves the start, accrual can run from your last service rather than from project completion, and contribution and indemnity claims arrive late by nature. Do not let a carrier change, a merger, or a retirement buy-out reset a retroactive date that needs to reach back a decade.

CPA firms: Michigan gives you a shield, if you papered it in time

Michigan is one of the better states in the country to be a certified public accountant defending a third-party claim, because of MCL 600.2962. (The statute's operative noun throughout is "a certified public accountant"; Michigan practice generally treats it as protecting the firm, but it contains no entity definition, so do not assume entity-level application is settled.) Under that statute, in a public accounting engagement, a CPA is liable only for:

• Negligence, where the claimant is the CPA's client. Privity.
• Fraud or intentional misrepresentation, which is not subject to the privity limit.
• Negligence toward a non-client, only if all of the following happened: the CPA was informed in writing, directly by the client, before commencement of the engagement, that a primary intent of the client was for the services to benefit or influence that person; and the CPA separately identified in writing, directly to the client, also before commencement of the engagement, each person, generic group or class description intended to rely — a list that must include everyone the client named. Liability then runs only to those specifically identified in writing.

The timing is the whole thing, and it is the detail most summaries get wrong. The statute says "before commencement of the engagement" twice, not "at engagement." Papering it when the letter is signed, or after fieldwork begins, is exactly the failure mode the statute forecloses. Which means your engagement letter process is a risk control document, and the firm that treats it as boilerplate gives away a statutory defense.

Michigan hands you three more defenses in MCL 600.2962(2), which most firms have never heard of. A CPA is not liable for civil damages to a non-client who sues as assignee of the client's claim; to a claimant whose standing came from a voluntary surrender of assets or acquisition of the claim by foreclosure or surrender under a security agreement; or to a third party relying on a writing under the third path above that the client never signed. That last one is the natural companion to the engagement-letter discipline: get the signature.

Two limits on the comfort. Fraud and intentional misrepresentation are not subject to the privity limits and can generally be pleaded by a non-client — which is precisely why plaintiffs' lawyers plead them. And the statute limits liability, not defense cost. You still litigate the question of which bucket the claim falls into, and on a defense-inside-the-limit policy you litigate it with your own coverage.

On licensure, Michigan requires a firm license to establish or maintain an office, with at least a simple majority of equity and voting rights held directly or beneficially by licensed CPAs in good standing (MCL 339.728). It requires peer review for firms performing audits, reviews, or compilations that are relied on by third parties, with proof of a review obtained within the three years immediately preceding the application, and notice to the department within 30 days of a failing rating or a second consecutive pass-with-deficiencies rating (MCL 339.729). It does not require professional liability insurance. Your clients and your bank do that.

Design firms: the contract clause your E&O will not follow you into

Michigan requires that not less than two-thirds of the principals of a firm practicing architecture, professional engineering or professional surveying be licensees, that a nonlicensed principal and that principal's firm obtain department approval, and that the firm employ a person in responsible charge at each Michigan place of business for the services offered there, except a field office that provides only a review of construction (MCL 339.2010). No E&O mandate appears anywhere in Article 20 of the Occupational Code. Again: the requirement comes from MDOT, from public owners, from institutional clients and from lenders, by contract.

Which brings up Michigan's anti-indemnity statute, MCL 691.991, and this is where most summaries get it backwards:

• Subsection (1) is narrower than it looks. In a contract relating to the design, construction, alteration, repair or maintenance of a building, structure, appurtenance, appliance, highway, road, bridge, water line, sewer line or other infrastructure, a provision indemnifying another party against liability for damages arising out of bodily injury to persons or damage to property caused by that party's sole negligence is void as against public policy. Note both limits: sole negligence only, and bodily injury and property damage only. It says nothing about indemnity for the economic loss that most design claims actually involve.
• Intermediate-form indemnity survives in private contracts. A clause requiring you to indemnify an owner for claims involving the owner's partial negligence is generally still enforceable.
• Subsection (2) — the good one — applies only to public entities. Added by 2012 PA 468, effective March 1, 2013, it bars a public entity from requiring a Michigan-licensed architect, professional engineer, landscape architect or professional surveyor, or a contractor, to defend the public entity or any other party from claims, or to assume liability or indemnify the public entity or any other party beyond that party's degree of fault and that of its subconsultants or subcontractors. The "or any other party" half is the practically important one: it kills flow-down defense obligations to other project participants, not just to the owner. Two catches — an out-of-state-licensed firm does not get the protection, and "public entity," which covers the state, public bodies, cities, villages, townships, counties, school districts, authorities and community and junior colleges, excludes Michigan's constitutionally autonomous universities.

So a private developer, a hospital system, or one of Michigan's autonomous universities can still put a broad duty to defend in front of you. And your professional liability policy will generally not follow you into it. E&O indemnifies you for damages you are legally liable to pay because of negligence, established after the fact, and it carries a contractual liability exclusion limiting coverage to liability that would exist absent the contract. A duty to defend obligates you to fund someone else's defense on allegation alone, before any finding of negligence and often in claims where you turn out not to be negligent at all. That obligation exists only because of the contract, which is what the exclusion removes. Read your own form and ask whether a contractual defense-cost endorsement is available — a material share of the architect and engineer market now writes one.

The standard contract fixes are negotiable and worth negotiating: convert a "duty" to defend into a "right" to defend, cap the obligation at a percentage of fee or at amounts actually covered by your policy, and limit indemnity to losses "to the extent caused by" your negligent acts, errors or omissions. And note the nuance running the other way: some courts have declined to let carriers use the contractual liability exclusion where a breach-of-contract claim genuinely sounds in negligence. Results turn on the form and the jurisdiction.

Cyber: if you prepare returns, you are already required to have a written plan

For CPA firms this is the most concrete, most verifiable, and most commonly ignored obligation on the list. The authority chain runs from the Gramm-Leach-Bliley Act to the FTC Safeguards Rule, 16 CFR Part 314, and the FTC expressly uses tax preparation services as an example of a covered non-banking financial institution.

• A written program is mandatory. 16 CFR 314.3(a) requires the information security program to be "written in one or more readily accessible parts." The IRS says the same thing in Publication 4557 and provides a template in Publication 5708, and reiterated it in news release IR-2025-79 on July 29, 2025: tax pros must have a written information security plan.
• The FTC must be notified within 30 days. Under 16 CFR 314.4(j), effective May 13, 2024, a notification event involving the information of at least 500 consumers requires notice to the FTC as soon as possible and no later than 30 days after discovery, on the FTC's electronic form.
• Michigan's own statute runs in parallel. MCL 445.72 requires notice to affected Michigan residents "without unreasonable delay" — unless the firm determines, exercising ordinary prudence, that the breach is not likely to cause substantial loss or injury or result in identity theft with respect to a Michigan resident. It carries an encryption safe harbor, requires notice to nationwide consumer reporting agencies when notifying more than 1,000 Michigan residents, requires no state regulator notice, and provides a civil fine of up to $250 per knowing failure to notify, capped at $750,000 per breach.

Put those together and a single ransomware event at a forty-person Michigan firm produces two notice obligations running on different clocks — client notice under Michigan law, subject to its risk-of-harm determination, and FTC notice within 30 days once 500 consumers are involved — plus a compliance exposure, because the FTC's next question is whether the firm had the written plan it was already required to maintain. Credit bureau notice comes in on top if the event reaches more than 1,000 Michigan residents. None of that is covered by general liability, and E&O is a poor fit for it. It is a cyber liability exposure with a regulatory component, and the underwriting question you will be asked is whether the plan exists.

Workers' comp: your classification depends on who leaves the office

Michigan is an independent bureau state. Classifications come from the Compensation Advisory Organization of Michigan (CAOM), and for professional firms three codes do almost all the work:

• 8810 — Clerical Office Employees, including technical drafting employees. The manual's conditions are strict: employees engaged exclusively in bookkeeping, record keeping, correspondence, computer composition, technical drafting or other office work, in areas physically separated from other operations by floors or floor-to-ceiling walls. Critically, 8810 is not available for dividing a single employee's payroll with another classification except in three narrow instances, and employees exposed to otherwise classified operations are assigned under the interchange-of-labor rule.
• 8601 — Architect or Engineer, Consulting; Surveyor. Covers consulting operations including client consultations, research, and site inspections, across mechanical, civil, electrical, chemical, mining metallurgical, marine, industrial and environmental disciplines. It does not apply when engaged in actual construction. And it expressly does not apply to personnel whose duties are confined to the office — those are 8810.
• 8803 — Accountant, Auditor, Factory Cost or Office Systematizer, Traveling. Applies to personnel who go to the client's location to perform accounting or auditing work. Staff with office duties only are 8810.

Read the interaction and you have the most common premium error in these accounts, in both directions. Because 8810 cannot be divided for one employee and the interchange-of-labor rule governs employees exposed to other operations, an engineer who does site visits or a senior who spends busy season at client offices does not belong in the clerical code — and a firm whose entire staff has been loaded into 8601 or 8803 when most of them never leave the building is overpaying. As always, CAOM's published definitions govern the residual market, a voluntary market carrier may apply its own, and the definitions manual carries a January 2016 update — so verify rather than assume. See our explainer on Michigan workers' comp class codes.

Employment practices: every Michigan firm is covered, from the first hire

Michigan's Elliott-Larsen Civil Rights Act defines an employer as a person with one or more employees. Title VII requires fifteen and the federal age discrimination act requires twenty. An employee can sue directly in circuit court without filing with the Michigan Department of Civil Rights first, the limitations period is three years rather than a 180- or 300-day charge window, and there is no statutory damages cap where Title VII caps combined compensatory and punitive damages from $50,000 to $300,000 by employer size. Michigan does not recognize punitive damages in the federal sense, but no statutory ceiling applies to a compensatory award.

ELCRA's employment protected classes include height, weight and marital status, which have no federal employment analogue, and 2023 PA 6 added sexual orientation and gender identity or expression. (Familial status is an ELCRA protected class in housing, not in employment.) For a partnership-track firm with performance reviews, compensation tiers and promotion decisions, this is a live frequency exposure, and it is what employment practices liability insurance is for.

Frequently Asked Questions

Are defense costs included in my professional liability limit?

On most professional liability policies, yes — defense inside the limit is the standard arrangement, meaning claim expenses erode the money available to settle or pay a judgment. On a $1 million limit, $300,000 of legal fees leaves $700,000, and exhausting the limit on defense ends the insurer's duty to defend. Options exist in both the architect and engineer market and among specialty CPA carriers, either a fully separate claim-expense limit or a capped first-dollar claim-expense sublimit, but availability and cost vary by carrier and state. Check your declarations page for how claim expenses apply, and ask what the option costs.

Does Michigan require CPA firms, engineers or architects to carry E&O insurance?

No. Michigan requires a CPA firm license with majority CPA ownership and peer review for firms performing audits, reviews, or compilations relied on by third parties, and it requires design firms to have at least two-thirds licensed principals plus a person in responsible charge at each Michigan office. Neither regime mandates professional liability insurance. In practice the requirement comes from client contracts, public owner procurement including MDOT, and lender or bonding requirements.

How long is a Michigan architect or engineer exposed to a claim?

Longer than the headline six years. MCL 600.5839 provides a six-year repose period from occupancy, use or acceptance, with a one-year-from-discovery period capped at ten years for gross negligence, and it also reaches contribution and indemnity claims. Since 2011 PA 162, MCL 600.5805(13) treats any action against a licensed architect, professional engineer or professional surveyor arising from professional services as malpractice with a two-year period, accruing when the professional discontinues serving the client, with a six-month discovery extension, all subject to the repose. Practically, plan your retroactive date around a decade rather than six years.

Can a bank or investor sue my CPA firm for negligence if they were not my client?

Generally no, under MCL 600.2962, unless the engagement was set up for it. Negligence liability to a non-client requires that the client informed you in writing, directly, before the engagement commenced, that a primary intent was to benefit or influence that person, and that you separately identified in writing to the client, also before commencement, each person, group or class intended to rely — with liability limited to those specifically identified. The statute also bars claims by a non-client suing as assignee of the client's claim, by a claimant who acquired the claim by foreclosure or surrender under a security agreement, or by a third party relying on a writing the client never signed. Claims alleging fraud or intentional misrepresentation are not subject to the privity limit, which is why plaintiffs plead them.

Do I really need a written information security plan for my tax practice?

Yes. The FTC Safeguards Rule at 16 CFR 314.3(a) requires the information security program to be written, the FTC treats tax preparation services as a covered financial institution, and the IRS has repeatedly confirmed the requirement, providing a template in Publication 5708. Since May 13, 2024, a breach involving at least 500 consumers also requires notice to the FTC within 30 days under 16 CFR 314.4(j). Underwriters ask whether the plan exists, and its absence is both a compliance problem and a coverage conversation.

The bottom line

Professional liability programs fail in places a premium comparison cannot show you: a limit that pays the lawyers first, a retroactive date that a carrier change quietly moved forward, a reporting condition that turns a December demand letter into an uninsured claim, a duty-to-defend clause your policy will not follow you into, and an engagement letter signed a week too late to claim a statutory defense Michigan handed you for free.

We work best with established Michigan firms — principals on the license, a book of recurring clients, real payroll, and a few years of claim history to look at. If that is you, send us your current professional liability declarations page and policy form, your engagement letter or owner-contract template, and your last three years of loss runs. We will tell you what your retro date is actually worth and where your limit is going before anyone talks about price. As an independent agency representing more than twenty commercial carriers, we can place a firm with a professional-lines market instead of a generalist. Call (248) 693-6455 or request a commercial review.