Why these 2025 updates matter for Canadian risk teams

Last updated: November 2025

Summit Commercial Solutions regularly publishes short, citable updates to help risk managers act on regulatory and wording changes that affect coverage certainty and operational compliance. This post contains two quick-reference 2025 guides: (1) preparing for jurisdictional Equipment Breakdown (EB) inspections in Ontario and British Columbia; and (2) the most common OT/ICS cyber policy wording pitfalls seen in manufacturing programs this year. Where relevant, we point to deeper Summit resources, including Cyber Insurance and Manufacturing Insurance.

2025 guide: EB inspections in Ontario and British Columbia—what to prepare before the engineer arrives

EB (boiler & machinery) losses are low-frequency, high-severity. Jurisdictional inspections are mandated and linked to Certificates of Inspection/Operation. In Ontario, the Technical Standards and Safety Act and O. Reg. 220/01 require a current Certificate of Inspection (COI) for each boiler/pressure vessel (BPV) and empower inspectors to dictate preparation steps for proper inspection and safety. In British Columbia, the Safety Standards Act and the Power Engineers, Boiler, Pressure Vessel and Refrigeration Safety Regulation require inspection/permit compliance and prescribe specific owner preparations (e.g., opening, cleaning, isolations, and confined space procedures) before internal examination.

Scope and authorities in 2025

• Ontario (ON): Technical Standards and Safety Authority (TSSA) administers BPV under O. Reg. 220/01. COIs are issued following a first inspection and must be renewed via periodic inspections; intervals vary by device class. Inspections may be conducted by the insurer’s authorized inspector or by TSSA.

• British Columbia (BC): Technical Safety BC administers inspections under the Safety Standards Act and PE/BPVR Regulation. A certificate of inspection/permit is required before use and remains subject to re‑inspection; owners must prepare equipment as specified by a safety officer.

Note: EB coverage is often written as an endorsement to commercial property insurance in Canada. Coordinate inspection requirements with your Commercial Property Insurance schedule and any Business Interruption indemnity periods that depend on jurisdictional compliance.

Two weeks out: documentation to assemble

• Asset roster and nameplates for all in-scope BPV/refrigeration equipment; confirm Canadian Registration Numbers (CRNs) and provincial IDs.

• Prior inspection reports, recommendations, and evidence of completed corrective actions.

• Relief-valve documentation: set pressures, service dates, test certificates; proof valves are set at/under MAWP and are code-compliant.

• Water treatment and chemistry logs (e.g., conductivity, pH, sulfite) and blowdown records for boilers.

• Maintenance and NDT records (e.g., thickness readings, UT/MT/RT where applicable).

• Operating logbooks (pressures, temperatures, alarms, trips) and operator certifications, where required.

• Safe work procedures for isolation/LOTO, confined space, gas-free certificates (as applicable), and hot work.

24–48 hours before: plant preparation

• Shut down, depressurize, drain, cool, and isolate as directed by the inspector/safety officer or code adoption documents.

• Remove manhole/handhole covers; open, clean, and ventilate internal spaces; clean flues and furnaces slated for inspection.

• Verify LOTO and install blinds/blanks where needed to prevent ingress of steam, gas, or liquids during internal access.

• Stage safe access (lighting, scaffolding, fall protection) and ensure relief devices and gage connections are accessible.

• Confirm testing resources (hydrostatic/operational tests, water supply, air) are available if requested.

Day-of checklist (owner responsibilities)

• Escort inspector; provide site safety orientation and hazard communication.

• Produce all requested documentation; ensure competent personnel are on hand to operate and test equipment on command.

• Expect operational checks of safety devices (e.g., low-water cutoffs, flame safeguards, relief lift tests where appropriate).

• Be prepared for additional requests (e.g., drilling/cutting for thickness measurement) per inspector direction.

Frequent findings that delay a COI/permit

• Overdue or unverified safety-relief maintenance or set pressures above MAWP.

• Incomplete internal cleaning/ventilation that prevents safe entry.

• Missing or nonfunctional low-water cutoff, flame safeguard interlocks, or alarm/trip tests.

• Inadequate LOTO or isolation plans; absence of confined space documentation where required.

• Unresolved recommendations from the prior inspection.

Insurance implications and how Summit helps

• EB forms typically require jurisdictional compliance and functioning safety devices. Noncompliance can jeopardize coverage for resulting loss.

• Align EB inspection intervals with your Business Interruption indemnity period. If a late COI delays restart after a breakdown, your time‑element recovery could be impacted.

• We can coordinate your inspection cadence, relief-valve service vendors, and documentation standards with your EB carrier to minimize deferrals. Start with a quick call or use Contact Us to align scope before your next visit.

Quick owner-prep reference

2025 OT/ICS cyber wording pitfalls for manufacturers

Manufacturers increasingly rely on PLCs, DCS, HMIs, and connected robotics. Many cyber policies were drafted for data‑centric IT scenarios; unless amended, they can leave OT‑driven loss scenarios underinsured. Use this checklist during renewals—especially when coordinating with Manufacturing Insurance and Cyber Insurance.

The pitfalls we see most often in 2025

1) Computer system definition excludes OT/ICS

• Problem: “Computer system” sometimes references only IT assets owned/operated by the insured, omitting PLCs/SCADA, safety instrumented systems, robotics controllers, or cloud‑hosted OT. Vendor‑managed OT and IIoT sensors can also fall outside the definition.

• Fix: Expand definitions to include insured‑owned, leased, or controlled OT/ICS and “dependent computer systems,” expressly naming PLCs, RTUs, HMIs, data historians, and safety controllers. Confirm inclusion of vendor‑hosted OT platforms and telemetry.

2) Bodily injury (BI) and property damage (PD) exclusions with narrow carve‑backs

• Problem: Standard cyber policies commonly exclude BI/PD; some offer “contingent BI/PD” extensions with narrow triggers and low sublimits. Meanwhile, GL/property forms increasingly add affirmative cyber exclusions, shrinking “silent cyber” pathways.

• Fix: Seek explicit cyber grants for OT‑triggered physical damage and third‑party injury, or negotiate BI/PD carve‑backs that apply when a cyber event causes process upset, fire, explosion, pollution, or product damage. Align retentions and limits across property, GL, and cyber to avoid gaps.

3) State‑backed cyber operations and war exclusions

• Problem: Updated model clauses distinguish state‑backed cyber operations from traditional war and can exclude “significant impairment” events even outside declared war. Your coverage can vary materially depending on the clause type selected by carriers.

• Fix: Understand the specific war/cyber operation clause used on your cyber policy and property treaty; confirm how attribution works, what events trigger exclusion, and whether any carve‑backs exist. Avoid misalignment across policies.

4) Voluntary shutdown and “system failure” triggers

• Problem: Many policies require “total interruption” and exclude precautionary shutdowns (e.g., safety trips, controlled shutdowns to prevent damage). OT incidents often manifest as degraded states before a full outage.

• Fix: Add coverage for partial/intermittent outages and precautionary shutdowns commanded by safety systems. Clarify “system failure” to include loss of view/control in OT, not just application‑level IT failures.

5) Dependent business interruption (DBI) and utilities/infrastructure exclusions

• Problem: Manufacturers depend on upstream/downstream OT‑enabled partners and critical utilities. DBI often covers only named IT service providers, not OT vendors or utilities. Some policies exclude grid, telecom, or cloud failures entirely.

• Fix: Broaden “dependent system” and “outsourced provider” definitions to capture OT vendors, managed service providers, robotics integrators, cloud historians, and key utilities. Where utilities are excluded, negotiate a limited buy‑back.

6) Data restoration vs. configuration/firmware re‑commissioning

• Problem: Policies may cover data re‑creation but not the time and cost to re‑flash firmware, re‑validate safety logic, recalibrate sensors, and re‑commission lines—major cost drivers in OT incidents.

• Fix: Add wording covering re‑commissioning and validation steps, OEM engineering support, and acceptance testing for affected lines/cells.

7) “Bricking” coverage gaps for hardware

• Problem: Some policies exclude replacement of corrupted controllers or HMIs if no physical damage is proven.

• Fix: Seek explicit hardware replacement (“bricking”) grants for irrecoverable OT devices and specify valuation methods for legacy or end‑of‑life controllers.

8) Regulatory, pollution, and product exposures from cyber events

• Problem: Pollution and product liability may be excluded or sublimited under cyber, while GL and environmental forms increasingly exclude cyber triggers.

• Fix: Negotiate cyber pollution carve‑backs triggered by cyber events and align with environmental impairments coverage. Clarify product recall/withdrawal treatment when cyber manipulation affects product safety.

Placement checklist for manufacturers

• Map OT assets in scope; list PLC families, SIS, historians, and vendor‑hosted OT. Attach as a schedule to the policy.

• Align property cyber exclusions with cyber policy grants; run scenario tests (e.g., ransomware‑driven safety trip, corrupted logic causing scrap and fire) and confirm which policy responds, in what order.

• Confirm panel requirements for IR/forensics allow OT specialists and OEMs; pre‑approve vendors to avoid response delays.

• Validate DBI provider lists include OT vendors and key utilities; set practical waiting periods for manufacturing (consider inspection/validation time).

• Review war/state‑backed cyber clauses; document board understanding and residual risk.

Where to go next

• Compare your current cyber schedule to the pitfalls above with a Summit broker. We routinely align cyber, property, GL, and EB placements for manufacturers so a single OT incident doesn’t fall between policies. Explore Cyber Insurance and Manufacturing Insurance, or reach us via Contact Us. If you experience a loss, our Claim Services team will coordinate fast response.

References (for verification)

• Ontario: Technical Standards and Safety Act; O. Reg. 220/01: Boilers and Pressure Vessels; TSSA guidance on Certificates of Inspection and periodic inspections.

• British Columbia: Safety Standards Act; Power Engineers, Boiler, Pressure Vessel and Refrigeration Safety Regulation; Technical Safety BC owner preparation requirements for internal inspections (opening, cleaning, isolation, confined space compliance).

• OT/ICS security: NIST SP 800‑82 Rev. 3 (Guide to Operational Technology Security, 2023); ISA/IEC 62443 series (notably ANSI/ISA‑62443‑2‑1‑2024 update).

• Canadian threat context: Canadian Centre for Cyber Security advisories and “Primary Mitigations to Reduce Cyber Threats to OT.”

• Cyber policy war/state‑backed clauses: Lloyd’s Market Association model clauses (LMA5564A/B et seq.; 2023 updates) and related market bulletins.