Civil Law and UAE Cyber Liability Insurance Coverage Disputes

1. Introduction

Cyber liability insurance coverage disputes arise when an insured business suffers a cyber incident and the insurer disputes whether the resulting loss falls within the insurance policy.

Typical disputes concern:

ransomware;

hacking;

phishing;

business-email compromise;

theft of cryptocurrency;

data breaches;

privacy claims;

regulatory investigations;

cyber extortion;

network interruption;

restoration of computer systems;

third-party liability;

notification and incident-response costs;

fraudulent employee or third-party transfers.

The legal question is usually not simply “Was there a cyberattack?” The court must determine:

What risk was insured, what loss occurred, what policy conditions and exclusions apply, whether the insured complied with its obligations, and whether the claimed loss was caused by an insured event?

The UAE position must now be considered against the Federal Decree-Law No. 6 of 2025 regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business, which entered into force on 16 September 2025 and repealed Federal Decree-Law No. 48 of 2023. Existing regulations, standards and circulars remain effective under the transition provisions until replaced. (Central Bank Rulebook)

Because reported UAE cases specifically involving modern cyber-insurance wording remain limited, the most useful UAE authorities are insurance-coverage, fraud, exclusion, notification, jurisdiction and reinsurance decisions. Their principles can be applied to cyber policies, but they should not be presented as cases that themselves decided a cyber-ransomware coverage claim.

2. Legal Framework

A cyber-liability insurance dispute can involve several layers of UAE law.

Main sources

Federal Decree-Law No. 6 of 2025

regulates insurance business and CBUAE supervision;

provides the current federal regulatory framework;

preserves existing regulations during transition. (Central Bank Rulebook)

Current UAE Civil Transactions Law

governs general contractual obligations, interpretation, liability and compensation;

applies subject to specialised insurance legislation.

Commercial Transactions Law

may apply where the insured event arises from commercial activity.

Federal Decree-Law No. 46 of 2021

electronic transactions and trust services;

particularly relevant where the insurance dispute depends upon emails, electronic signatures, digital records or authentication.

UAE cybercrime and data-protection legislation

may become relevant to the underlying cyber incident.

Insurance policy itself

the policy wording remains central;

coverage, exclusions, conditions, deductibles, limits and notification requirements must be analysed.

DIFC/ADGM legislation

relevant where the insurance contract falls within those jurisdictions.

3. Current Regulatory Position

The current federal insurance framework is particularly important.

Federal Decree-Law No. 6 of 2025 places insurance within the consolidated CBUAE regulatory structure. It replaced the 2023 insurance legislation and provides transitional continuity for regulations, standards and circulars issued under the previous framework. (Central Bank Rulebook)

This matters for cyber insurance because insurers and insured businesses may still encounter policy and regulatory materials developed under the previous regime during the transition.

A court therefore has to distinguish:

the law applicable when the policy was issued;

the law applicable when the cyber incident occurred;

the law applicable when the claim was made;

the current regulatory framework.

4. What Is Cyber Liability Insurance?

Cyber liability insurance generally protects against specified losses arising from cyber-related risks.

Depending upon the policy, coverage may include:

First-party losses

data restoration;

system restoration;

business interruption;

cyber extortion;

forensic investigation;

crisis-management expenses;

notification costs;

reputational-response expenses.

Third-party liabilities

privacy claims;

confidentiality claims;

contractual claims;

regulatory-related liabilities where legally insurable;

claims arising from transmission of malware;

liability for security failures.

Additional cover

Some policies may contain:

social-engineering fraud cover;

funds-transfer fraud cover;

digital asset cover;

contingent business-interruption cover;

dependent-business interruption;

reputational harm cover.

Coverage depends entirely upon the policy wording.

5. The Central Coverage Question

The court generally has to move through several questions:

Question 1

Did an insured event occur?

Question 2

Does the claimed loss fall within an insuring clause?

Question 3

Does an exclusion remove the loss from coverage?

Question 4

Did the insured comply with policy conditions?

Question 5

Was notice given within the required period?

Question 6

Was there material misrepresentation or non-disclosure?

Question 7

Was the claimed amount caused by the insured event?

Question 8

Does the policy impose a deductible, sub-limit or aggregate limit?

Question 9

Is the claim fraudulent or exaggerated?

Question 10

Which court or arbitration tribunal has jurisdiction?

6. Cyber Event Versus Cyber Loss

A cyberattack does not automatically establish an insured loss.

For example:

A company is hacked.

That is an event.

But the company might claim:

AED 5 million ransom;

AED 2 million business interruption;

AED 500,000 forensic costs;

AED 1 million regulatory expenses;

AED 3 million customer claims.

The insurer may accept that the hacking occurred but dispute whether each category of loss is covered.

Therefore:

The existence of a cyber incident and the existence of insurance coverage are separate legal questions.

7. Policy Construction

Insurance coverage disputes usually begin with construction of the policy.

A court may examine:

policy schedule;

insuring clause;

definitions;

exclusions;

endorsements;

warranties;

conditions precedent;

notification provisions;

deductibles;

limits;

sub-limits;

governing-law clause;

jurisdiction clause.

A cyber policy should therefore be read as a whole contractual instrument, rather than looking at one isolated phrase.

8. Case Law 1 — Horizon Energy LLC v Al Buhaira National Insurance Company [2022] DIFC CA 015

This is an important UAE insurance authority concerning coverage disputes, avoidance and jurisdiction.

Al Buhaira sought declarations that insurance policies were avoided for alleged misrepresentation and, alternatively, that the underlying loss was not covered. (DIFC Courts)

The Court of Appeal considered the interaction between insurance legislation and the parties' contractual jurisdiction agreement.

It held that the statutory insurance dispute mechanism did not prevent an insurer from pursuing appropriate legal remedies concerning:

avoidance;

fraudulent claims;

premium recovery;

declaratory relief concerning coverage.

(DIFC Courts)

Cyber-insurance significance

A cyber insurer may similarly seek a declaration that:

the policy was avoided;

the cyber event falls outside coverage;

a particular exclusion applies;

the insured breached a material policy obligation.

The case also demonstrates that jurisdiction must be analysed separately from the substantive coverage question.

9. Case Law 2 — Al Buhaira National Insurance Company v Horizon Energy LLC [2022] DIFC CFI 098/2021

At first instance, Al Buhaira sought declarations that the policies were avoided because of alleged misrepresentations and alternatively that the claimed loss did not fall within the policy cover. (DIFC Courts)

The case therefore demonstrates a familiar insurance structure:

Avoidance → alternatively no coverage → alternatively other policy defences.

Cyber application

Suppose a company purchased cyber insurance after answering a proposal question concerning:

“Previous cybersecurity incidents.”

If the insured failed to disclose a major previous ransomware event, the insurer may argue that the non-disclosure affects the validity of the policy.

Whether that argument succeeds depends on the applicable law, policy wording and evidence concerning materiality and the insurer's underwriting position.

10. Case Law 3 — Orient Insurance PJSC v ABN Amro Bank NV & Others [2015] DIFC CFI 014

The case involved an insurance policy containing an express clause dealing with misrepresentation or fraudulent acts.

The policy stated that misrepresentation or fraudulent conduct relating to the policy or claim could render the policy void. (DIFC Courts)

Principle

Insurance policies may contain contractual mechanisms dealing specifically with:

misrepresentation;

fraud;

fraudulent claims;

assignment;

policy validity.

Cyber significance

This becomes important in:

exaggerated ransomware claims;

fabricated cyber losses;

false invoices;

manipulated forensic reports;

fraudulent proof of loss;

deliberately inflated business-interruption calculations.

A genuine cyberattack does not necessarily protect an insured from consequences of a fraudulent claim.

11. Case Law 4 — Union Insurance PJSC v International Precious Metals Refiners LLC [2022] DIFC CFI 064/2022

This case involved allegations of:

concealment;

misrepresentation;

fraudulent claim;

breach of good faith.

The insurer proposed underwriting expert evidence concerning whether alleged non-disclosure was material to the underwriting risk and whether alleged fraud was sufficiently material to affect the policy. (DIFC Courts)

Principle

Insurance disputes can require expert evidence concerning:

underwriting materiality;

risk assessment;

policy construction;

forensic accounting;

industry practice.

Cyber application

A cyber-insurance dispute may similarly require experts to determine:

whether cybersecurity controls were actually present;

whether a security questionnaire was accurate;

whether MFA was enabled;

whether backups existed;

whether a vulnerability was known;

whether the incident was caused by the alleged security failure;

how business-interruption loss was calculated.

12. Case Law 5 — AIG UK Ltd & Others v Qatar Insurance Co. [2024] DIFC CA 008

This case concerned a major insurance/reinsurance dispute arising from employee collusion and misappropriation of funds.

The underlying insured had obtained compensation for losses caused by employee misconduct, and the insurer then sought indemnification from reinsurers. The reinsurers relied on exclusions in the reinsurance contracts. (DIFC Courts)

Principle

Insurance and reinsurance disputes may turn on the precise wording of:

insuring clauses;

exclusions;

limitations;

reinsurance clauses;

allocation of losses.

Cyber application

A cyber incident may simultaneously involve:

insured → insurer → reinsurer

and coverage may differ at each contractual level.

For example:

A cyber insurer pays AED 20 million to an insured after ransomware.

The reinsurer might later dispute whether the payment falls within the reinsurance treaty.

Therefore:

Insurance coverage and reinsurance coverage are separate contractual questions.

13. Case Law 6 — Nessim v Nader [2024] DIFC CFI 013

This case involved a substantial marine-insurance dispute and arguments concerning:

non-disclosure;

avoidance;

notice;

policy exclusions;

limitation;

reinsurance;

contractual coverage.

The pleadings included arguments that the insurer or insured failed to give notice within the contractual period and that exclusions operated to remove certain losses from cover. (DIFC Courts)

Principle

Insurance coverage can depend on compliance with contractual:

notice periods;

claims procedures;

warranties;

exclusions;

conditions.

Cyber application

This is particularly important because cyber incidents require rapid notification.

A cyber policy may require immediate or prompt notification to:

insurer;

broker;

incident-response provider;

law-enforcement authority.

Delay can become a coverage issue depending upon the policy wording and applicable law.

14. Case Law 7 — Ahmed Mohamed Eid Al Yahad Al Zaabi v Al Buhaira National Insurance Company [2024] DIFC TCD 002

The policy in this case contained express conditions concerning:

compliance with policy terms;

truthfulness of proposal statements;

fraudulent claims;

forfeiture of claims.

It also contained specified insured perils and exclusions. (DIFC Courts)

Principle

Insurance policies can contain conditions precedent, warranties and exclusions that materially affect liability.

Cyber application

Cyber policies may similarly contain conditions concerning:

MFA;

encryption;

endpoint protection;

backups;

access controls;

incident notification;

vulnerability management.

The legal question is whether the relevant provision is:

a condition;

warranty;

exclusion;

representation;

covenant;

condition precedent.

That classification can materially affect the coverage dispute.

15. Case Law 8 — Okeke v Obike [2026] DIFC ARB 039/2025

This is a particularly recent insurance coverage authority.

The case arose from an insurance coverage arbitration. The arbitral tribunal dismissed the applicant's claims based on contractual defences including avoidance and related provisions. The applicant then sought to set aside the partial award. The DIFC Court dismissed the set-aside application. (DIFC Courts)

The underlying policy contained an arbitration agreement covering disputes arising out of or connected with the policy. (DIFC Courts)

Principle

Insurance coverage disputes can be:

contractually arbitrated;

decided through interpretation of policy defences;

subject to limited judicial review of the resulting award.

Cyber application

Cyber policies frequently contain arbitration clauses, particularly where:

the insurer is international;

the insured is a multinational;

reinsurance is involved;

London-market wording is used.

16. Case Law 9 — Al Buhaira National Insurance Company v Arab War Risks Insurance Syndicate [2026] DIFC CA 003

This is a particularly important recent insurance/reinsurance decision.

The Court of Appeal dealt with:

reinsurance wording;

follow-the-settlements provisions;

good faith;

fair presentation;

notification;

limitation.

The Court declared that the reinsurance contract contained a term requiring reinsurers to follow certain decisions and settlements between insurer and insured. It also held that the appellant had not breached its duty of good faith or fair presentation and that the claim was not barred by late notification/time-bar arguments. (DIFC Courts)

Cyber significance

This is highly relevant where cyber losses pass through several insurance layers.

For example:

Cyber incident

↓

Primary cyber insurer

↓

Reinsurer

↓

Retrocession

A coverage dispute may therefore concern whether the reinsurer must respect a settlement reached by the primary insurer.

17. Case Law 10 — Union Insurance PJSC v International Precious Metals Refiners LLC [2022] DIFC CFI 064

A further procedural aspect of the same litigation is significant.

The Court considered proposed expert evidence concerning:

underwriting;

materiality of alleged non-disclosure;

forensic accounting;

alleged fraudulent claim;

good faith.

(DIFC Courts)

This illustrates an important evidentiary point:

Insurance coverage disputes frequently require technical expert evidence rather than purely legal argument.

For cyber insurance, that can include:

cybersecurity experts;

digital forensic experts;

forensic accountants;

insurance-underwriting experts;

incident-response specialists.

18. What Does Cyber Insurance Normally Cover?

Coverage depends on policy wording, but the following categories are common.

19. Ransomware Coverage

Ransomware disputes may involve several separate questions.

Event

Was the network encrypted by ransomware?

Cause

Was the incident caused by:

phishing;

stolen credentials;

vulnerability exploitation;

insider activity?

Coverage

Does the policy cover:

ransom;

restoration;

downtime;

investigation?

Exclusion

Does an exclusion apply?

Compliance

Were policy security requirements satisfied?

Causation

Did the ransomware cause the claimed business interruption?

20. Cybersecurity Warranties

Modern policies may require the insured to maintain specified security controls.

Examples:

multi-factor authentication;

endpoint protection;

regular patching;

encrypted backups;

privileged-access controls;

segregation of systems;

employee training;

vulnerability scanning.

Suppose the policy states:

“The insured shall maintain MFA for all privileged accounts.”

A dispute arises because hackers entered through a privileged account without MFA.

The court may need to determine:

Was the requirement incorporated into the policy?

Was it a warranty?

Was it a condition precedent?

Was it an exclusion?

Did the breach cause the loss?

What remedy does applicable law attach to the breach?

21. Exclusions

Common cyber-related exclusions may include:

war;

terrorism;

infrastructure failure;

nuclear risks;

bodily injury;

property damage;

known circumstances;

intentional acts;

fraud;

contractual liability;

prior known incidents;

regulatory penalties.

The exact wording matters enormously.

22. Cyber War Exclusion

Cyber-war exclusions create difficult disputes.

Consider:

A ransomware attack is allegedly connected to a state-sponsored hacking group.

The insurer invokes a war exclusion.

The court may have to consider:

what “war” means;

whether cyber operations constitute warfare;

whether attribution is established;

whether the exclusion applies to the particular loss;

whether the wording extends to state-sponsored cyber activity.

This is likely to require technical and geopolitical evidence.

A mere assertion that hackers were state-linked would not automatically resolve the contractual question.

23. Fraudulent Claims

A cyber claim may involve legitimate and illegitimate components.

Example:

Actual loss:

AED 3 million.

Claim submitted:

AED 8 million.

The insurer may argue that the claim was fraudulent.

The Orient Insurance and Union Insurance authorities demonstrate why fraudulent-claim clauses and materiality can become central issues in insurance disputes. (DIFC Courts)

The court should distinguish:

innocent error;

negligence;

inaccurate accounting;

exaggerated claim;

deliberate fraud.

These may have different contractual consequences.

24. Business Interruption

Cyber business-interruption claims are often difficult because the insured must demonstrate:

Cyber event → interruption → financial loss

For example:

Cyberattack → website unavailable → customers unable to place orders → lost revenue.

The insured may need evidence concerning:

historical revenue;

expected revenue;

actual revenue;

downtime;

recovery period;

seasonal fluctuations;

alternative sales channels;

saved expenses.

Forensic accounting may therefore become essential.

25. Causation

Causation is particularly complicated in cyber claims.

Suppose:

hacker enters network;

system goes down;

company already had declining sales;

company claims AED 20 million lost profits.

The insurer may accept the cyberattack but dispute whether the full AED 20 million resulted from it.

The court therefore needs to separate:

cyber-caused loss

from

pre-existing commercial loss.

26. Digital Forensic Evidence

Cyber insurance disputes frequently depend on forensic evidence.

Important evidence may include:

firewall logs;

endpoint logs;

authentication records;

SIEM data;

server logs;

cloud logs;

email headers;

malware samples;

ransomware notes;

network traffic;

access logs;

blockchain records;

incident-response reports.

The preservation principles discussed in cyber-forensic litigation become directly relevant to the insurance dispute.

27. Cyber Insurance and Data Breach Liability

A data breach can produce two different categories of legal exposure.

First-party

The insured itself suffers:

investigation expenses;

restoration expenses;

business interruption.

Third-party

Customers or other persons claim:

privacy violations;

confidentiality breaches;

financial loss;

contractual damages.

The policy may cover one but not the other.

28. Regulatory Fines and Penalties

An insured may face a regulatory sanction after a cyber incident.

The question becomes:

Is the regulatory fine legally insurable and does the policy cover it?

This cannot be answered merely by asking whether the policy contains “regulatory cover.”

The court may have to consider:

mandatory UAE law;

public policy;

nature of the penalty;

purpose of the sanction;

policy wording.

29. Social Engineering and Business Email Compromise

This is an increasingly important coverage issue.

Example:

A CFO receives an apparently genuine email instructing a bank to transfer AED 4 million.

The email was actually sent by a hacker.

The insurer may argue:

“This is a voluntary transfer, not a cyberattack.”

The insured may argue:

“The transfer resulted directly from computer fraud.”

The answer depends upon the specific insuring clause.

Possible policy distinctions include:

computer fraud;

funds-transfer fraud;

social engineering;

fraudulent instruction;

phishing.

The court should therefore identify the precise insured peril instead of treating every digital fraud as automatically covered.

30. Cryptocurrency Cyber Losses

Crypto-related insurance disputes are particularly complicated.

Suppose a company loses:

100 BTC.

Questions include:

Was the wallet hacked?

Who controlled the private key?

Was the transfer authorised?

Was the exchange responsible?

Was the loss caused by employee negligence?

Does the policy cover digital assets?

Is cryptocurrency treated as property under the applicable law?

How is the loss valued?

What exchange rate applies?

The Gate Mena v Tabarak litigation demonstrates the complexity of proving control, custody and transfer of cryptocurrency within the DIFC legal system. (DIFC Courts)

31. Notification Requirements

Cyber policies commonly contain strict notification provisions.

A policy might require notification:

“as soon as reasonably practicable.”

Another might require:

“within 24/48/72 hours.”

A dispute can arise where the insured:

detects suspicious activity Monday;

confirms ransomware Wednesday;

notifies insurer Friday.

The insurer may argue late notification.

The court will need to examine:

exact wording;

when the insured knew;

what it reasonably understood;

when a claim arose;

whether delay caused prejudice;

applicable law.

The recent Al Buhaira v Arab War Risks Syndicate judgment demonstrates the significance of notification and time-bar provisions in insurance/reinsurance disputes. (DIFC Courts)

32. Good Faith and Fair Presentation

Insurance relationships involve significant information asymmetry.

The insurer needs information concerning:

cybersecurity controls;

previous incidents;

vulnerabilities;

claims history;

security architecture.

The insured may therefore face disputes concerning:

non-disclosure;

inaccurate proposal answers;

incomplete questionnaires;

misleading security certifications.

The Al Buhaira 2026 Court of Appeal decision is particularly relevant because it addressed alleged breach of good faith/fair presentation and rejected avoidance on the facts before it. (DIFC Courts)

33. Cyber Insurance and Reinsurance

A cyber insurer may itself have reinsurance.

The structure may be:

Cyber insured

↓

Primary insurer

↓

Reinsurer

↓

Retrocessionaire

A dispute at one level does not necessarily produce the same result at another.

The AIG v Qatar Insurance and Al Buhaira v Arab War Risks Syndicate authorities demonstrate how the wording of the reinsurance contract can become decisive. (DIFC Courts)

34. Jurisdiction

Jurisdiction is particularly important for international cyber insurance.

A policy might provide:

UAE law;

UAE courts;

or:

English law;

arbitration in London;

or:

DIFC law;

DIFC Courts.

The Horizon Energy litigation is important because the DIFC Court of Appeal held that an agreement referring disputes to the “Courts of the United Arab Emirates” could include the DIFC Courts where the contractual wording and circumstances supported that construction. (DIFC Courts)

35. Insurance Dispute Resolution Under the Current Framework

The regulatory dispute-resolution landscape has changed.

The 2025 Central Bank/insurance legislation introduced a consolidated customer-complaints and dispute framework under the CBUAE structure. The law also provides for specialised committees in specified financial disputes, with rules concerning enforceability and challenges depending on the value and nature of the dispute. (UAE Legislation)

This means that for a current onshore UAE insurance dispute, counsel must check:

the date of the policy;

date of the dispute;

applicable transitional provisions;

current CBUAE regulations;

complaint/committee requirements;

arbitration clause;

court jurisdiction.

The older Article 110 regime discussed in Horizon Energy should therefore not simply be treated as the current procedural regime for every 2026 dispute.

36. DIFC Versus Onshore UAE

This distinction is critical.

Onshore UAE

Primarily:

federal legislation;

CBUAE regulatory framework;

UAE Civil Transactions Law;

Civil Procedure Code;

Commercial Transactions Law.

DIFC

Potentially:

DIFC Insurance/financial-services legislation;

DIFC Courts;

DIFC procedural rules;

common-law contractual principles;

DIFC arbitration legislation.

Therefore:

A DIFC insurance judgment should not automatically be described as a binding precedent of the UAE Federal Courts.

The DIFC cases above are particularly useful for comparative reasoning and for disputes actually falling within DIFC jurisdiction.

37. Cyber Insurance Coverage Analysis Model

A useful litigation model is:

C-Y-B-E-R Coverage Test

C — Contract
What exactly does the policy insure?

Y — Your security obligations
What cybersecurity warranties and conditions apply?

B — Breach/event
What actually happened technically?

E — Exclusions
Does an exclusion apply?

R — Resulting loss
What financial loss was actually caused?

Then separately examine:

Notification + fraud + causation + evidence + jurisdiction.

38. Practical Example

Facts

A Dubai technology company buys cyber insurance.

The policy provides:

AED 20 million aggregate limit;

AED 1 million deductible;

ransomware coverage;

business-interruption cover;

forensic-investigation expenses.

The company experiences a ransomware attack.

Losses:

AED 4 million restoration;

AED 5 million business interruption;

AED 500,000 forensic expenses;

AED 2 million ransom;

AED 1 million customer claims.

The insurer accepts the ransomware event but disputes the claim.

Legal analysis

Issue 1 — Insuring clause

Does ransomware fall within the defined insured event?

Issue 2 — Security condition

Was MFA required?

Issue 3 — Causation

Did ransomware cause all claimed business interruption?

Issue 4 — Exclusion

Does any exclusion apply?

Issue 5 — Ransom

Is ransom payment covered?

Issue 6 — Third-party claims

Are customer claims covered?

Issue 7 — Deductible

How does the AED 1 million deductible apply?

Issue 8 — Limit

Does the aggregate limit cap all categories together?

Issue 9 — Notification

Was the insurer notified promptly?

Issue 10 — Evidence

Can the insured prove the attack and resulting losses?

39. Evidence Required by the Insured

A cyber-insurance claimant should generally preserve:

Technical evidence

forensic image;

firewall logs;

endpoint logs;

server logs;

authentication logs;

malware analysis;

ransomware note;

cloud logs.

Financial evidence

accounting records;

revenue history;

payroll;

invoices;

customer orders;

business-interruption calculations.

Legal evidence

policy;

endorsements;

proposal form;

security questionnaire;

broker correspondence;

renewal documents.

Incident evidence

incident-response report;

communications with insurer;

communications with forensic consultants;

ransom negotiations;

law-enforcement reports.

40. Evidence Required by the Insurer

The insurer may seek:

original policy documents;

proposal answers;

cybersecurity questionnaires;

penetration-test reports;

vulnerability reports;

security policies;

MFA configuration;

backup records;

incident logs;

forensic reports;

financial records;

previous incident information.

The Union Insurance case demonstrates how underwriting and forensic experts may become relevant to assessing materiality and fraudulent-claim allegations. (DIFC Courts)

41. Common Coverage Disputes

42. Important Distinction: Cyber Liability vs Cyber Crime

A cyber event may involve criminal conduct, but the insurance dispute is normally contractual.

For example:

Hacker steals AED 10 million.

There may simultaneously be:

criminal liability of hacker;

civil liability of negligent service provider;

contractual liability of bank;

insurance liability of cyber insurer.

These are separate legal relationships.

The insurance court does not necessarily have to determine the criminal liability of the hacker before deciding whether the policy covers the insured's loss.

43. Relationship with UAE Civil Liability

Where cyber negligence causes damage, the insured may face a civil claim.

For example:

A company fails to protect customer data, resulting in third-party losses.

The underlying claim may involve:

contractual liability;

harmful-act liability;

confidentiality;

data protection;

cybersecurity obligations.

The cyber insurer's liability is then a separate contractual question.

Thus:

Underlying liability ≠ insurance coverage.

44. Policy Exclusion Must Be Distinguished from Lack of Coverage

There is an important conceptual distinction.

Lack of coverage

The event never falls within the insuring clause.

Exclusion

The event falls within the broad coverage but a specific provision removes it.

Example:

“Cyberattack” is covered.

But:

“Loss arising from war is excluded.”

The court first identifies the scope of the insured risk and then determines whether an exclusion operates.

45. The Role of Experts

Cyber insurance litigation may require multiple experts.

Cybersecurity expert

Determines:

attack vector;

vulnerability;

security controls;

system compromise.

Digital forensic expert

Determines:

logs;

attribution;

system activity;

data integrity.

Forensic accountant

Determines:

business interruption;

lost profits;

restoration costs.

Insurance expert

May address:

underwriting practice;

policy construction;

market practice;

materiality.

The Union Insurance litigation illustrates the use contemplated for underwriting and forensic-accounting expertise in an insurance dispute. (DIFC Courts)

46. Six Core Lessons from UAE Case Law

The UAE insurance authorities establish several useful principles for cyber coverage disputes:

Policy wording is central.

Avoidance and coverage are distinct issues.

Fraudulent claims can have serious contractual consequences.

Notification provisions can be significant.

Expert evidence may be necessary to determine materiality and loss.

Jurisdiction must be separately established.

Insurance and reinsurance contracts must be analysed separately.

An arbitration clause may move the coverage dispute to arbitration.

DIFC insurance decisions are not automatically onshore UAE precedent.

For cyber claims, technical causation must be connected to contractual coverage.

47. Case-Law Summary

48. Conclusion

UAE cyber liability insurance coverage disputes are fundamentally contractual disputes informed by insurance regulation, civil liability, cybersecurity evidence and technical causation.

The central analytical sequence is:

Cyber event → insured risk → policy wording → conditions → exclusions → causation → quantified loss → notification → evidence → jurisdiction.

The current regulatory framework is especially important because Federal Decree-Law No. 6 of 2025 is now the principal federal framework governing insurance business and expressly repealed the 2023 Insurance Decree-Law, while preserving existing regulations and standards during transition. (Central Bank Rulebook)

The reported UAE case law presently provides substantially more authority on general insurance coverage, avoidance, fraud, exclusions, notification, reinsurance and jurisdiction than on ransomware-specific insurance. Consequently, those authorities should be applied by analogy to cyber-insurance disputes rather than inaccurately described as direct ransomware precedents.

For a cyber-insurance claimant, the strongest evidential structure is generally:

Policy + proposal form + security controls + forensic report + incident timeline + financial-loss evidence + notification records + expert evidence.

For an insurer, the corresponding analysis is:

Insuring clause + definitions + exclusions + security conditions + disclosure + notification + causation + fraud + limits + applicable dispute-resolution mechanism.