The update depends on two States

Erratum of 6 October 2026. Section 3 reads LMA 5565 to 5567 as worded on 25 November 2021. In January 2023 the Lloyd's Market Association replaced them with A and B versions, which drop the exclusion of retaliatory cyber operations between seven named states and add cyber operations carried out in the immediate preparation for a war (note no. 4, which appears on 19 October 2026; date corrected on 9 October 2026). For a policy written today, the third reading in section 3 therefore no longer holds as written: outside any war or its preparation, the hijacked update is excluded under these clauses only if it impairs the functioning of a state, its essential services or its security. The body and the decision stay as they were decided: a decided note is reviewed, not rewritten.

This note became a decision on 29 September 2026. It works up a file, sets out what a rating grid would have returned, and proposed three complete decisions. Option A, recommended by the drafter, was adopted: it appears in section 6 with its reason, and the other two stay on the record.

Proposed review date: 4 April 2027. On that date the note will be read again against what actually happened, and the review will be published at the top, whether it proves the chosen decision right or wrong.

Reviewed on 1 October 2026, before publication, at the level of a senior underwriter. Four additions, no word of substance removed: the exposure bounded on stated assumptions (section 1), the text of the war and cyber operation clauses and what it does to the file's two scenarios (section 3), the accumulation and the scenario that would hurt a portfolio (section 3), and the dated thresholds that would change the decision before inception (section 6). The decision is unchanged: the analysis does not lead to a decline, it bounds what option A is buying. The added facts are checked in section 9.

The case is public; the insured is fabricated. The acts of States, the court decisions and the vendor's statements cited here are real and dated. The company seeking cover does not exist: it combines common market configurations. The note says what an underwriter would decide. It tells nobody what to buy or where, and it contains no recommendation of cover, limit, deductible or premium.

0. Why this case

Note no. 1 sat on the cyber side: a collateral damage scenario, and a war exclusion that only decides after the event. This one is the junction that the site's charter names as its central argument: an act of State that, without any attack having taken place, takes away the security control on which an insured's cyber cover rests.

Of the candidate cases, it is the best documented on both sides. There is a primary legal instrument published in the US official journal, two German court decisions on an administrative warning, a European Parliament resolution, the Commission's reply saying it holds no evidence, and the vendor's own statements contesting all of it. An underwriter rarely gets a political file this well sourced, and almost never gets both versions.

1. The risk

The public facts

On 20 June 2024, the US Department of Commerce's Bureau of Industry and Security issued a final determination (case ICTS-2021-002, published in the Federal Register on 24 June 2024, 89 FR 52434) prohibiting Kaspersky Lab, Inc., its affiliates, subsidiaries and parent companies from providing anti-virus software and cybersecurity products or services in the United States or to US persons. The prohibition bites in two stages: no new agreements from 20 July 2024, and no signature or codebase updates, and no operation of the Kaspersky Security Network, from 29 September 2024. Users face no penalty for carrying on with the product; they simply stop being protected by it. Threat intelligence, training, and purely informational advisory products are carved out.

The rationale fits in one sentence of the text: the vendor, being subject to Russian jurisdiction, must comply with Russian government requests for assistance or information, and its software, which runs at kernel level, gives broad access to the systems it protects. The next day, 21 June 2024, OFAC designated twelve of the company's executives under Executive Order 14024. Three group entities were added to the Entity List the same month.

The vendor disputes this. It wrote that the decision rested on "the present geopolitical climate and theoretical concerns" rather than on an assessment of its products' integrity, and it had proposed in January 2024 a verification framework run by a trusted third party, which the administration found insufficient. It wound down its US operations from 20 July 2024. On 19 September 2024, an update automatically replaced its software with a third-party product on US consumer machines; some of those users said they had not been warned, while the vendor says it informed them from 5 September.

In Europe the position is different, and less settled. On 15 March 2022 the German Federal Office for Information Security (BSI) issued a warning under section 7 of the BSI Act, recommending that these products be replaced. The vendor challenged it; the Cologne Administrative Court refused interim relief on 1 April 2022 (1 L 466/22), and the Higher Administrative Court in Münster upheld that on 28 April 2022 (4 B 473/22). The European Parliament had already called, in its resolution of 13 June 2018 on cyber defence, for programmes "confirmed as malicious, such as Kaspersky Lab" to be excluded from the institutions; the Commission replied in 2019 that it held no evidence to that effect. To my knowledge, as of this note, no binding EU-wide prohibition applies to private companies: the product is still sold and updated in Europe.

The insured, fabricated

A manufacturer of hydraulic components for agricultural and construction machinery, headquartered in France. EUR 410 million turnover, 2,600 employees, six plants: three in France, one in Germany, one in Poland, and a US subsidiary that assembles and distributes in the Midwest.

The group rolled out this vendor's endpoint and server protection across its whole estate in 2016. In September 2024 the US subsidiary, a US person within the meaning of the determination, had to migrate its roughly 400 endpoints to another product. The European estate, some 3,100 endpoints and 240 servers, including the supervisory systems of the production lines, stayed on the original product. The group therefore runs two management consoles, from two vendors, governed by two different legal orders. An outsourced security operations centre monitors both.

The request is the renewal of a standalone cyber policy on 1 January 2027. The proposal form reads well: multi-factor authentication on remote access and email, endpoint and server protection on 100% of the estate, offline backups tested in March 2026, no claims in five years.

The exposure, bounded

The figures below are stated assumptions, not data from the insured, which does not exist. They show the order of magnitude at stake, and where it sits.

The act of State itself costs the policy nothing. A forced withdrawal is not an intrusion, a security failure or an extortion: the migration, the new licences and the IT team's hours stay with the insured. No ordinary cyber insuring clause is triggered on the day a vendor stops shipping updates. The whole exposure lies in what happens during the window, and it takes two forms.

First scenario, the likely one: ordinary ransomware during the window. Assumptions: the European estate carries about 85% of revenue, EUR 350 million, a little under a million a day; the attack halts 60% of output at the five European plants for twenty-one days; the contribution margin is 40%. Business interruption then comes to about EUR 4.8 million, and recovering 3,100 endpoints and 240 servers (forensics, rebuild, surge staff) adds two to three. Roughly EUR 7 to 8 million: the severity of an ordinary ransomware loss for a manufacturer of this size, which the act of State barely moves. What it moves is the probability over ninety days. Assume a base annual frequency of 3% for the segment, doubling during the window: annual probability rises by about three quarters of a point, an added expected loss of around EUR 55,000. That is small: on this scenario, option B would pay dearly for a narrow gap.

Second scenario, the severe one: the update channel is compromised. An update turns the kernel-level product against the whole European estate at once, supervisory controllers included. Assumptions: forty-five days at 80% outage across the five plants, same margin, full rebuild. The loss then comes to about EUR 18 to 20 million, two and a half times the first. No public record documents this scenario, and the note does not treat it as likely; it bounds it, because this is the one the war and cyber operation clauses decide, and they decide it in opposite ways depending on the variant (section 3).

2. What is missing

Where the European console runs, and how it receives updates. On-premises or hosted by the vendor, pulling directly from the vendor's servers or through an internal relay, and under which accounts. This is the channel through which a kernel-level product receives its instructions: I need to know who controls it.

Whether the vendor's reputation network is switched on. It is the service the US determination names expressly, because it sends data from endpoints back to the vendor. On or off, and with what data.

The lessons of the US migration. How long it took, how many endpoints went unprotected and for how many days, what broke. This is the most valuable document in the file, because it measures the insured's ability to do, under compulsion from a State, what Europe might one day require of it.

The production systems. Protection on production lines is not swapped like protection on an office laptop: some control-system manufacturers only qualify a short list of security products. I do not know whether a replacement is possible without stopping a line.

The exact wording of the questions put to the insured. Under French law, an insurer can only rely on a misrepresentation made in answer to a question it actually asked (Cour de cassation, mixed chamber, 7 February 2014, no. 12-85.107). If the question is "endpoint protection deployed: yes or no", the answer stays true on the day the vendor stops updating. If it is "deployed and up to date", the end of updates is a new circumstance the insured must declare within fifteen days (article L. 113-2, 3° of the French Insurance Code). The legal effect of the act of State on the contract turns on one sentence of the proposal form, and I do not have it.

3. The signals

Taken into account

The control can disappear mid-term, through an act that neither insured nor insurer controls. This is the heart of the note. A proposal form captures controls on the day cover is bound; it says nothing about whether they survive twelve months. Here survival depends on two States: on one side the EU or a member State, which could require removal as the United States did; on the other the State the vendor answers to, which could restrict its companies' activity abroad or lean on them. The US precedent showed the exact shape of the risk: a date, three months' notice, then an estate that stops being protected, without a single line of malicious code.

The insured has already lived through the event, on part of its estate. That cuts both ways. It proves the group can migrate under compulsion; it also proves the group chose, in 2024, not to migrate Europe. That choice is not a fault. It says the group preferred to wait for the political risk to crystallise rather than deal with it, and that is information about how it takes decisions.

Two consoles, two legal orders. A split estate doubles the administrative surface, and a monitoring centre reading two tools sees less well than one reading a single tool. The signal is technical, but its cause is political: the line between the two consoles follows exactly the jurisdictional line of the US determination.

The update channel is a trusted channel. That is the NotPetya path, already covered in note no. 1. I do not take up here the hypothesis of a malicious update, which no public document supports; I take up the fact that on the day this channel were implicated, the question of attribution to a State would arise at once, and with it the market's state-backed attack exclusions. The insured would then lose through the very control the proposal form rewarded.

Set aside

The vendor's nationality, on its own. A vendor is not a risk because it is Russian, Chinese or American. It becomes one when a State has acted, or has said it will. Here a State has acted, through a published and reasoned text. I keep the act and set aside the passport.

The technical quality of the product. It is not in issue in the determination, which turns on jurisdiction and not on detection, and I have no reason to doubt it. An excellent control that can be switched off by decree is not a weak control; it is a control of uncertain duration, which is a different category.

The German warning as evidence. It is a recommendation, not a ban, and the courts upheld it on the basis of a plausible danger, not a demonstrated defect. It tells me about the likelihood of a European act, not about how dangerous the product is.

The forced replacement of 19 September 2024. It is striking, and it only concerned US consumers. It shows that a vendor forced to leave can act on endpoints through its update channel; I keep it in mind, and keep it out of the file of a European industrial group.

The wording that matters: the war and cyber operation clauses

In late 2021 the Lloyd's Market Association published four model clauses, LMA 5564 to 5567, which form a ladder. LMA 5564 excludes any cyber operation, defined as the use of a computer system by, at the direction of, or under the control of a state to disrupt, deny, degrade, manipulate or destroy information in a computer system of or in another state. LMA 5565 and 5566 exclude only war, retaliatory cyber operations between China, France, Germany, Japan, Russia, the UK and the USA, and those with a "major detrimental impact" on the functioning of a state, its essential services or its security; 5565 with limits, 5566 without. LMA 5567 adds back so-called bystanding systems, located outside the impacted state (note no. 4). Attribution turns first on what the government of the state where the affected system is physically located says; pending that, the insurer may rely on an inference that is "objectively reasonable"; if that government stays silent for an unreasonable time, the burden of proving attribution stays with the insurer.

Applied to this file, the wording yields three readings a committee needs in front of it:

1. The forced withdrawal is not a cyber operation. A regulatory act uses no computer system; none of the four clauses reaches it, and none needs to, since the act triggers no cover (above, the exposure).
2. The ransomware in the window is criminal and stateless. None of the four clauses applies. The likely scenario sits wholly with the policy, whichever variant the market uses.
3. The hijacked update is where everything gets litigated. Under 5564 it is excluded once attributed to a state. Under 5565 to 5567, an attack on a single manufacturer, outside any war, is excluded only if it is retaliation between two of the seven named states, Russia and France among them, or if it reaches the functioning of a state. The same EUR 18 to 20 million event is therefore worth nothing or everything depending on the variant and on what the French government says, or does not say, attribution falling to it because the systems sit in France, Germany and Poland. That is why note no. 1 already held that relying on the exclusion is a legal bet.

Contract law does the rest. Under French law, an aggravation of the risk during the policy period lets the insurer cancel or propose a new premium (article L. 113-4 of the Insurance Code), but it can no longer rely on the aggravation once, having been informed, it has shown consent to keep the cover in force, notably by continuing to collect premium. Option A therefore has a legal price the note must state: by requiring the inventory, the post-migration review and the exit plan, the insurer knows, and on the day a European act lands it can no longer plead that it was unaware of the dependency. It buys the information at the price of the argument. That is the right trade, because without a precise question on the proposal form the argument was worth nothing (section 2).

The accumulation, and the scenario that would hurt

This file's accumulation is measured neither by sector nor by country, but by vendor: how many insureds in the European book protect their endpoints with this product, and how many take their updates through the same chain. The two scenarios then cut in opposite directions:

1. If a European act lands, all of those insureds migrate in the same three-month window. The accumulation is one of frequency: each sees its probability of an ordinary loss rise for a quarter, with no catastrophe. It reads in loss ratio points, and option A reduces it, since its conditions measure the length of the window.
2. If the channel is compromised, all of those insureds are hit on the same day. The accumulation is one of severity, NotPetya-style, and it is then decided by the clauses: if the exclusion holds, the book inherits a series of disputes over attribution; if it fails, the book pays all of them at once. This is the scenario that would hurt, and the only condition of option A that touches it is the fourth: admin accounts and backups that do not depend on the compromised console reduce each loss, not their number.

What a portfolio must therefore track, and this file alone does not show: a count of its insureds by endpoint protection vendor. One insured's file is decided on option A; how many similar files there are is decided at portfolio level, and that is the grain of truth in option C.

4. What an engine would have decided

The grid

An ordinary appetite grid for this segment, of the kind that feeds automated quoting platforms, would have read this:

sector               industrial manufacturing     medium hazard
size                 EUR 410m                     within band
authentication       MFA remote and email         compliant
endpoint protection  100% of estate               compliant
backups              offline, tested 03/2026      compliant
monitoring           outsourced SOC               compliant
loss history         nil over five years          favourable
------------------------------------------------------------
result               preferred tier, bound within delegated
                     authority, no referral to an underwriter

sector

industrial manufacturing

medium hazard

size

EUR 410m

within band

authentication

MFA remote and email

compliant

endpoint protection

100% of estate

compliant

backups

offline, tested 03/2026

compliant

monitoring

outsourced SOC

compliant

loss history

nil over five years

favourable

result

preferred tier, bound within delegated authority, no referral to an underwriter

Some grids ask for the vendor's name. None whose logic I know scores it on a jurisdiction criterion; and if one did, it would find it compliant, since no prohibition applies in Europe. An external attack surface score would say nothing either: the product cannot be seen from outside.

The engine binds, and it has good reasons to. On the data it reads, this file is better than the segment average.

Where judgement departs, and why

At one place only, and it is precise: the line "endpoint protection: 100% of estate". The engine reads it as a state of affairs. I read it as a twelve-month promise whose keeping depends on a political act, and the probability of that act is not zero, since the same act has already been taken by another State, against the same vendor, on part of the same estate.

Three reasons make this departure more than a scruple:

1. The engine does not know the contract's timeline. It scores a control that is present; it does not know that a control can have an end date set by a third party. A European act modelled on the US text would leave about three months between announcement and the end of updates: a quarter of the policy period.
2. The engine does not know the contract's law. Depending on the wording of the proposal form, the end of updates is either an aggravation the insured must declare, or a contractual non-event. In the first case, a failure to declare becomes, on the day of a claim, a dispute over a proportional reduction of the indemnity (L. 113-9); in the second, the insurer carries an aggravated risk without knowing it. Travelers v. International Control Services (US District Court for the Central District of Illinois, filed July 2022, policy rescinded by consent judgment on 26 August 2022, over multi-factor authentication declared and absent) shows what a declared control becomes when it is missing on the day of the loss: a question about the validity of the contract, and no longer about underwriting.
3. The engine does not see the junction. It files the vendor under a technical heading. The fact that decides is political, and it has been public since 20 June 2024.

What the review will settle. On 4 April 2027 we will know whether a European or national act has been taken, and whether the "100% of estate" line held. If nothing happened, the grid was right over the period, and judgement will have to say whether its departure was justified caution or a wasted cost. That answer will be written, whatever it is.

5. The three possible decisions

Each is complete and defensible. None concerns the terms of the contract: they say whether to accept, and on what information.

Option AYes, subject to information and reversibility conditions

Accept, and turn the political uncertainty into a measured capability. Before inception, the insured provides:

1. an inventory of the European estate by country and by console, with the console's location, the update path, and the status of the vendor's reputation network;
2. a dated account of the 2024 US migration: duration, number of endpoints and days without protection, incidents;
3. a written exit plan for the European estate, executable in under ninety days, with a replacement product already qualified on a sample of endpoints and on at least one production line;
4. console administrator accounts separate from directory administrator accounts, and backups that do not depend on that console.

If any is missing, the decision becomes no. These are not recommendations to the insured; they are the facts without which I do not know for how long its main control could vanish.

Option BNo, until the European estate has migrated

Decline the renewal on this basis, and say why: the file's central control has a lifespan set by States, the insured has known it since 2024 because it went through it in the United States, and it chose not to deal with it in Europe. The file is reopened as soon as the migration is done. It is the easiest decision to defend before a committee, and the most expensive one commercially.

Option CYes, on the engine's terms

Accept as the grid does. The vendor is lawful in Europe, the product is not in issue, the German warning is a recommendation the Commission did not back with evidence, and penalising a supplier on political grounds that no European legislator has adopted is a bias, not prudence. The risk of simultaneous withdrawal is real, but it belongs at portfolio level, by measuring how many insureds depend on the same vendor, not file by file.

6. What would prove each option wrong

A would be wrong if a European or national act required removal before the exit plan had been tested, and the real migration took more than twice the stated time, or stopped a production line. The conditions would then have measured an intention, not a capability. It would also be wrong in the other direction if the insured could not produce the US migration account within thirty days: that would mean the 2024 migration was not managed, and the "yes" would have been announced too soon.

B would be wrong if, by 4 April 2027, no binding act has been taken in Europe, the product has kept receiving updates, and no public incident has implicated its update channel. We would have declined a better-than-average file on a risk that did not materialise, and the refusal would have measured a headline rather than a probability.

C would be wrong if, during the period, an EU member State or the Union itself adopted a measure requiring removal or an end to updates for private companies; or if the State the vendor answers to restricted its activity outside Russia to the point of interrupting updates; or if a government publicly attributed an incident to that update channel. In each case, the control the grid rewarded would have ceased to exist mid-term, and the question of cover would have arisen on a declaration that had become untrue.

What would change my mind before inception

The decision stays A. Four facts, each verifiable before 1 January 2027, would tip it:

1. A binding act of the Union, or of France, Germany or Poland, requiring withdrawal or an end to updates at private companies, published before inception while the exit plan is not under way: B, because the window would open before the capability had been measured.
2. A US post-migration review showing more than thirty days without protection on more than a tenth of the 400 endpoints: B, because the quantity A is buying, the length of the window, would be measured and bad.
3. A European console hosted by the vendor, not by the insured, with no separable admin accounts: B, because the fourth condition, the only one touching the severe scenario, could not be met.
4. The other way, a European migration completed before inception: the file becomes ordinary, and the gap with the grid disappears. That is the outcome option C expected without asking for it.

The drafter's recommendation

Option A. Reason: it is the only one that addresses what the underwriter actually needs to know, how long the insured stays unprotected if a State decides, and that is a quantity the insured can prove, since it has already lived through it in the United States. B overpays for a jurisdictional risk that has produced no documented incident; C ignores that a control can be switched off by an act neither insured nor insurer controls, when that precedent is documented, dated and recent.

What the recommendation is not: a decision. If the decision chooses B or C, it prevails, and the published note will carry both, disagreement included.

Decision: Option A, yes subject to information and reversibility conditions, following the writer's recommendation.

Reason, in one sentence: It bears on the one quantity that decides this file, how long the insured stays unprotected if a State decides, and the insured can prove it, having already lived through it in the United States in 2024.

Date of decision: 29 September 2026

Review date: 4 April 2027 (proposed, and open to change)

7. The review

On 4 April 2027, or on the date that has been set. We will look for five verifiable facts, in this order:

1. A binding European or national act targeting this vendor's products in private companies, adopted between 4 October 2026 and the review date. Yes or no, with its reference.
2. The status of the BSI warning: maintained, withdrawn, or turned into an obligation.
3. An interruption of updates in Europe, whatever the cause, lasting more than seven days.
4. A public attribution, by a government, of an incident delivered through the update channel of any security vendor.
5. A published court decision or award in which the enforced end of a security control was relied on against a cyber insured.

The review will say which occurred, what it does to the option chosen, and who was right, the grid or the judgement. If none of the five occurred, it will say so too, and option C will be credited with the win.

8. Objections

Adversarial review, played by a political risk reviewer in the posture of a senior London market political risk underwriter. The three hardest objections, and the replies.

Objection 1 · "This is not political risk."

"My book covers confiscation, expropriation, nationalisation, deprivation, inconvertibility, political violence and contract frustration by a State. None of those triggers reaches an insured whose software supplier loses its licence in a third country. You are calling supply chain risk political risk, and that is exactly the confusion that lets a generalist pass for a specialist."

Reply. The objection is right about the product, and the note does not claim a political risk policy would respond. It claims something else: that the fact which decides the cyber contract is an act of State, and that it is analysed with political risk tools, not cyber ones. The trigger has an identified author, a date, a published legal basis, and remedies exhausted or not; that is exactly the framework for qualifying a licence cancellation under a political risk policy, applied to a contract that is not one. The junction is not a confusion of products; it is the observation that the cyber underwriter without that framework does not see the fact, and section 4 shows where it goes blind.

Objection 2 · "You are pricing a headline."

"Nothing in your file shows damage caused by this product. The US text talks about capability, not incidents; the Commission said it holds no evidence; the Münster court found a plausible danger. You are making a European insured pay for an American decision taken for foreign policy reasons. A good underwriter separates political noise from insurable risk."

Reply. This is the most serious objection, which is why option A bets neither on malice nor on the product. It bets on continuity, which is a measurable fact: a State has already switched this control off, on an announced date, on part of this very estate. What is being priced is not the hypothesis of a booby-trapped update, which the note expressly sets aside for want of evidence; it is how long the insured would go unprotected if the act were repeated. And option C, which is the objection's own position, is written out in full and remains available: if it is chosen, the review will say whether the noise was noise.

Objection 3 · "Your loss scenario does not exist."

"Follow the money. A European act comes down; the insured has three months; it migrates, as it did in the United States. Where is the loss? And if the vendor were ever forced to act against its customers, the state-backed operations exclusion would do its job. You are describing an inconvenience, not a claim."

Reply. The loss is not in the act; it is in what happens during the window: an industrial estate partly mid-migration, production lines whose control systems only support a short list of products, two consoles for weeks, and an ordinary ransomware attack, criminal and stateless, landing at that moment. That loss is untouched by any exclusion, and it is what condition 3 measures. As for the exclusion, note no. 1 already said what to make of it: relying on it is a legal bet, not underwriting, and on the day an update channel were implicated, attribution would come late and the burden of proof would stay with the insurer. The objection does render one precise service: it forces the note to state that if the insured proves a fast and clean US migration, the gap between A and C becomes small, which is why condition 2 is the first document to read.

9. Facts added on 1 October 2026

Checked by exact search: the official pages remain blocked from the review machine, and each fact below is confirmed by two concurring sources, or removed.

1. 89 FR 52434: final determination ICTS-2021-002 is published in the Federal Register of Monday 24 June 2024 (vol. 89, no. 121), page 52434. Kept. Sources: govinfo.gov (FR-2024-06-24, 2024-13532); federalregister.gov.
2. 29 September 2024 as the date updates and resale stop. Kept. Sources: federalregister.gov; Holland & Knight, June 2024.
3. The vendor's statement ("the current geopolitical climate and theoretical concerns"), 20 June 2024. Kept. Sources: The Hacker News, June 2024; Help Net Security, 21 June 2024.
4. OVG Münster, 28 April 2022, 4 B 473/22, upholding VG Köln of 1 April 2022, 1 L 466/22, under section 7 BSIG; not open to further appeal. Kept. Sources: Legal Tribune Online; beck-aktuell, 29 April 2022.
5. Cour de cassation, mixed chamber, 7 February 2014, no. 12-85.107: the insurer may rely on non-disclosure or misrepresentation only where it stems from answers to its own questions. Kept. Sources: Légifrance summary (JURITEXT000028574768); L'Argus de l'assurance.
6. *Travelers v. International Control Services*: complaint filed 6 July 2022, agreed judgment of 26 August 2022 declaring the policy void from inception. Kept, filing date specified. Sources: Insurance Journal, 30 August 2022; Lockton.
7. LMA 5564 to 5567: the ladder of four clauses, the list of seven states, the "major detrimental impact" test, published in late 2021. Kept. Sources: Latham & Watkins, War Exclusion Developments in Cyber Insurance Policies; DAC Beachcroft, War exclusions in cyber policies: an overview.
8. Attribution by the government of the state where the system is physically located, the reasonable inference, the burden on the insurer absent attribution. Kept. Sources: LMA 5567A text published by the LMA (lmalloyds.com); IBA, The LMA Cyber War Exclusions, 18 April 2023.
9. Article L. 113-4 of the French Insurance Code: cancellation or new premium on aggravation, and loss of that right after consenting to keep the cover, notably by collecting premium. Kept. Sources: Doctrine (LEGIARTI000006792029); L'Argus de l'assurance.

Rechecked on 1 October 2026: no binding Union act targets private companies using the product; the BSI warning remains a recommendation. The statement in section 1 therefore stands, and will be checked again at the review (section 7, fact 1). Set aside: a list of member states restricting the product in public procurement only, found in a single popular source, for want of a second.

The exposure figures (section 1) are not facts: they are assumptions, stated as such, about a fabricated insured.

Public sources cited. U.S. Department of Commerce, Bureau of Industry and Security, Final Determination: Case No. ICTS-2021-002, Kaspersky Lab, Inc., 20 June 2024, published in the Federal Register on 24 June 2024, 89 FR 52434. U.S. Department of the Treasury, OFAC, designation of twelve AO Kaspersky Lab executives under E.O. 14024, 21 June 2024. Kaspersky, Statement on the U.S. Commerce Department Determination, June 2024, and statement on compliance, July 2024. Automatic replacement on US consumer machines on 19 September 2024, reported among others by TechCrunch on 23 September 2024 and The Register on 24 September 2024. Bundesamt für Sicherheit in der Informationstechnik, warning under section 7 BSIG, 15 March 2022. Verwaltungsgericht Köln, 1 April 2022, 1 L 466/22; Oberverwaltungsgericht Nordrhein-Westfalen, 28 April 2022, 4 B 473/22. European Parliament, resolution of 13 June 2018 on cyber defence; Commission answer to question P-001206/2019. Travelers Property Casualty Co. of America v. International Control Services, Inc., U.S. District Court, Central District of Illinois, 2022, judgment of 26 August 2022. Cour de cassation, mixed chamber, 7 February 2014, no. 12-85.107. French Insurance Code, articles L. 113-2 and L. 113-9.

Verification. Sources were cross-checked on 26 September 2026 by search, the official sites (Federal Register, BIS, OVG NRW) being unreachable from the drafting machine. The three primary references, 89 FR 52434, 4 B 473/22 and 12-85.107, were identified on 1 October 2026 by their summary and two concurring sources (section 9), without reading the full text.