Intentional and fraudulent misconduct (French insurance law)
Insured misconduct that the insurer does not cover by operation of law: intentional misconduct, aimed at the damage itself, and fraudulent misconduct, a deliberate act that removes the contingency by making the damage inevitable.
Article L. 113-1 of the French Insurance Code provides that the insurer is not liable for losses and damage resulting from the insured's intentional or fraudulent misconduct. This statutory exclusion, a matter of public policy, does not depend on policy wording: it follows from the very nature of insurance, which covers a contingency and not the insured's will. Case law long conflated the two notions, then distinguished them from 2020. Intentional misconduct requires that the insured wanted the damage as it occurred, not merely the act that caused it, which makes it rare and hard to prove. Fraudulent misconduct, a separate notion, is a deliberate act by the insured committed with awareness that it would necessarily cause the damage, even without seeking it, thereby removing the contingency. The burden of proof lies on the insurer. The distinction matters in cyber and directors' liability: can an insured that deliberately leaves a system without known protection face a finding of fraudulent misconduct? Courts accept it where the inevitability of the damage was conscious, and reject it for mere negligence, even gross.
Textbook case: an executive, warned three times by his provider that an exposed server had an actively exploited flaw, refuses the update so as not to interrupt production; ransomware enters through that server two weeks later. The insurer invokes fraudulent misconduct, and must show the executive was aware the attack was inevitable, not merely that it was a risk.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.