Skip to content
←Back to glossaryInsurance

Subrogation

The mechanism by which the insurer, having indemnified its insured, steps into their shoes to recover the amount from the third party responsible for the damage.

Definition

Article L. 121-12 of the French Insurance Code, inherited from Article 36 of the law of July 13, 1930: the insurer that has paid the indemnity steps into the insured's rights against the party responsible, up to the amount paid. In practice, the insurer that has indemnified its insured takes over the rights the insured held against the third party responsible for the damage, and may go after that party to recoup all or part of the amount paid. The rule serves two ends of fairness. It prevents the insured from being indemnified twice, once by their insurer and once by the responsible party, which would breach the indemnity principle. It places the final cost of the loss on the party that caused it, rather than on the pool of insureds, so third parties keep a reason to be careful. The subrogated recovery is an important economic component of insurers' results, since amounts recovered reduce net claims cost. In cyber, subrogation matters more when a loss comes from a provider's failure: a negligent host, the vendor of vulnerable software, a compromised supplier. The insurer may go after it, but apportioning liability is hard in technical chains where fault is diffuse.

Its 10 cross-references, woven across the glossary's 18 categories
Subrogation: Insurance glossary illustration, AlgoPolis
Example

Textbook case: having indemnified an insured victim of a data leak caused by the negligence of its hosting provider, the insurer brings a subrogated recovery action against that provider to recoup the sums paid, which shifts the final cost onto the party truly responsible.

Read next
Put it to work
Related terms
On the Wire, where this term came up
Go further at the Academy
Stay informed

Follow the research

One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.

No spam, one-click unsubscribe, no data ever sold.