A business owners policy Arizona small businesses rely on bundles three coverages into one package, but as of 2025, most standard BOPs still exclude cyber, professional liability, and workers comp entirely. Most AZ business owners find this out after a pipe bursts, a customer slips, or a data breach notice lands on their desk.
Key Takeaways:
- A BOP bundles general liability, commercial property, and business interruption into one policy, but the standard package caps BI at 12 months and excludes professional liability, cyber, and workers comp entirely.
- Arizona businesses with revenues under approximately $5 million and fewer than 100 employees qualify for BOP pricing in most standard markets, above those thresholds, carriers push you to a commercial package policy instead.
- ARS 18-552 requires Arizona businesses to notify affected individuals within 45 days of a data breach and caps civil liability at $500,000, a standard BOP has no cyber coverage to pay that exposure, which is why a standalone cyber endorsement or policy is not optional for any AZ business handling personal data.
What a Business Owner’s Policy Actually Is, and What the Three-Part Bundle Does
A business owner’s policy is a pre-packaged insurance product that combines general liability, commercial property, and business interruption coverage into a single policy form for qualifying small businesses. This means a small-business owner gets three distinct coverage layers under one renewal date, one premium, and one carrier, instead of managing three separate policies.
Here is how each layer works in plain terms.
General liability covers third-party claims: a customer who slips on your floor, a product that causes property damage, a personal injury claim from an advertisement. It pays your legal defense and any damages up to the policy limits. Commercial property covers the building you own or the contents inside it, equipment, inventory, fixtures, when a covered peril causes direct physical loss. Business interruption (BI) coverage pays the net income your business loses and the ongoing expenses it still owes when a covered property loss forces you to suspend operations.
To make this concrete: picture a Chandler HVAC contractor whose shop floods after a supply line fails. The commercial property layer pays to repair the building and replace damaged equipment. The BI layer pays the revenue the contractor loses while the shop is closed, plus the rent that still comes due. If a customer who was on-site during the flood later files a bodily injury claim, the GL layer responds.
All three layers fire from a single event. That is the practical value of the BOP structure.
One detail worth knowing: the BOP is a packaging decision, not a coverage category. The same three coverages exist as standalone policies, GL, commercial property, business interruption each sell separately. The BOP packages them because carriers found that small businesses with straightforward risk profiles could be priced as a bundle without individual underwriting on each piece. BI coverage carries a 72-hour waiting period before it triggers, three full days of closed operations before a dollar pays out.
For anyone working through the broader arizona insurance guide for small businesses, the BOP is usually the starting point, not the finish line.
GL, Property, and Business Interruption: What Each Layer Actually Pays
Each BOP layer covers a distinct loss trigger with its own limit, sublimit, and exclusion set. A claim that exhausts your GL limit does not borrow from your BI limit. Each bucket is separate, and knowing which bucket a loss falls into determines whether you collect.
| Coverage Layer | What Triggers It | What It Pays | Common Limit Range | Key Exclusion |
|---|---|---|---|---|
| General Liability (GL) | Third-party bodily injury, property damage, personal injury, or advertising injury caused by your business | Legal defense costs and damages up to the policy limit | $1M per occurrence / $2M aggregate (standard starting point for Mesa contractor profiles in admitted markets; $500K available for lower-risk retail classes) | Professional acts, intentional harm, employee injuries |
| Commercial Property | Direct physical loss to your owned building or business contents from a covered peril | Repair or replacement cost (RCV) or depreciated value (ACV) depending on form | Varies by building value and contents schedule | Flood, earthquake, normal wear and tear, mechanical breakdown |
| Business Interruption (BI) | Physical loss that forces a full or partial suspension of operations | Net income loss plus continuing expenses (rent, payroll, loan payments) during restoration | 12-month period of restoration is the standard cap | 72-hour waiting period; no coverage if loss doesn’t stem from a covered property peril |
The occurrence vs. aggregate distinction matters under the GL layer. The occurrence limit is the most the policy pays for a single claim. The aggregate limit is the most it pays for all claims combined in a policy year. A $1M/$2M GL structure means one bad slip-and-fall can consume $1M, and a second claim in the same year still has $1M available, but a third claim in the same year would have nothing left if the first two each hit the per-occurrence ceiling.
This is the liability limits structure Arizona carriers use across admitted BOP products. The numbers are not negotiable on a standard BOP form; if you need higher limits, you are looking at endorsements or a commercial package policy.
Which Arizona Businesses Qualify for a BOP, and Which Get Pushed to a Package Policy
BOP eligibility depends on revenue size, occupancy class, and loss history, not on what the business owner prefers. Carriers pre-price the BOP bundle on the assumption that the risk is straightforward. When it isn’t, they manually underwrite instead.
Businesses that typically qualify for a BOP in Arizona:
- Small retail operations, a Scottsdale boutique, a Mesa gift shop, a Chandler specialty food store, where foot traffic is moderate and inventory values are predictable.
- Office-based professional services with low physical risk, such as a Mesa CPA firm, a Tempe marketing agency, or a Gilbert bookkeeper. Note: professional liability for the actual professional acts is still excluded from the BOP.
- Small restaurants and cafes under carrier-specific revenue thresholds, generally in the range of $1M to $3M in annual food-and-beverage revenue depending on the carrier.
- Light-service contractors who work on-site but don’t haul hazardous materials and don’t carry a large subcontractor workforce.
- Small apartment buildings under a unit count ceiling (typically 6 to 12 units depending on the carrier’s appetite).
Businesses carriers push to a commercial package policy (CPP):
- General contractors who regularly hire subcontractors, where the right-to-control question under ARS 23-907 creates workers comp exposure that a BOP cannot address.
- Manufacturers, auto-related businesses (repair shops, dealers), and any class with significant equipment or product liability complexity.
- Businesses with revenues above approximately $5 million or more than 100 employees, most admitted carriers set the BOP ceiling there.
- Habitational properties above a unit threshold, or any property with mixed-use commercial and residential tenants.
- Any business class where professional liability is a primary exposure, medical practices, law firms, engineering firms.
A CPP uses the same ISO building blocks as a BOP but is manually underwritten with individually negotiated limits. More flexibility, more cost, more paperwork. The BOP is the pre-packaged, lower-complexity version. When your risk profile grows past the pre-packaged model, the CPP is the next step.
What Does a BOP Not Cover? The Six Exclusions That Catch AZ Business Owners Off Guard
A standard BOP excludes professional liability, cyber, workers comp, commercial auto, flood, and employment practices liability, leaving six exposure gaps that require separate policies. Each gap has a specific AZ context that makes it more than a theoretical risk.
Professional liability. A Gilbert IT consultant writes code that fails and causes a client’s customer database to corrupt. The BOP GL covers bodily injury and property damage from third parties, it does not cover economic losses caused by a professional’s work product or advice. A professional liability (errors and omissions) policy is separate.
Cyber liability. Arizona Revised Statutes 18-552 requires businesses to notify affected individuals within 45 days of a confirmed data breach, with civil liability capped at $500,000 per event. A standard BOP pays none of those costs, not the forensic investigation, not the notification mailings, not the regulatory defense. The cyber liability stack has two sides: first-party coverage pays your own response costs, and third-party coverage responds to customer claims. Neither side lives inside a BOP.
Workers compensation. ARS 23-907 creates civil penalty exposure up to $10,000 for repeat workers comp coverage lapses. More to the point, if your 1099 contractors pass the ARS 23-907 right-to-control test, Arizona treats them as employees, and a BOP does not cover employee injury claims regardless of classification. Workers comp is its own policy, always separate. Anyone working through the 1099 workers comp arizona question needs to resolve the classification question before assuming the BOP handles it.
Commercial auto. Personal auto policies stop covering a vehicle the moment it is used for business delivery, client transport, or job-site travel. A BOP does not fill that gap. A commercial auto policy or hired/non-owned auto endorsement is required.
Flood. The BOP property layer excludes flood by the same logic as a homeowners policy. NFIP coverage or private flood insurance is a separate purchase, and in the Phoenix metro, where monsoon water enters buildings through doors and windows rather than rising groundwater, the distinction between flood and weather-related water damage matters for claims.
Employment practices liability (EPLI). Wrongful termination, harassment, and discrimination claims against an employer are outside the BOP’s GL scope entirely. EPLI is a standalone policy or endorsement.
ARS 18-552 caps civil liability at $500,000 per breach event and requires notification within 45 days. A standard BOP will not pay a dollar of that.
BOP vs. Commercial General Liability: What’s the Actual Difference?
A standalone commercial general liability policy covers only third-party liability, while a BOP adds property and business interruption to the same package at a lower combined price. The GL layer inside a BOP is structurally identical to a standalone CGL, same occurrence/aggregate structure, same coverage triggers, same exclusions.
| Feature | Standalone CGL | Business Owner’s Policy (BOP) |
|---|---|---|
| Third-party liability coverage | Yes, bodily injury, property damage, personal/advertising injury | Yes, same GL coverage included |
| Commercial property coverage | No | Yes, building and contents at replacement cost |
| Business interruption coverage | No | Yes, 12-month period of restoration, 72-hour waiting period |
| Pricing structure | Individually underwritten | Packaged; typically 15-25% less than buying three coverages separately |
| Best fit | Home-based business with no owned location; tenant whose landlord carries property; business with property covered elsewhere | Any AZ small business with a physical location, owned contents, and revenue at risk during a closure |
| Eligibility ceiling | No specific revenue cap | Approximately $5M revenue / 100 employees in most admitted markets |
When a standalone CGL makes more sense: a home-based Mesa bookkeeper who has no commercial property to insure, a Scottsdale photographer who rents studios and owns no fixed location, or a contractor whose tools are leased and whose property exposure sits elsewhere. In those cases, paying for the property and BI layers inside a BOP adds cost without adding coverage.
For any AZ business with physical assets and revenue that would stop during a closure, a Chandler restaurant, a Queen Creek veterinary clinic, a Gilbert retail shop, a BOP costs less per coverage dollar than buying GL, property, and BI separately. Bundling property and BI with GL in a BOP typically saves 15 to 25 percent versus buying the three coverages as standalone policies. The exact figure varies by carrier and class, but the pattern holds across admitted markets.
Note for clients considering options across different parts of the state: if you are working with an insurance agency scottsdale az or elsewhere in the metro, the BOP vs. CGL question comes down to one thing, do you have property to protect and revenue that stops if you close?
When a BOP Isn’t Enough: How to Scale Up to a Commercial Package Policy
A business outgrowing BOP eligibility adds endorsements first, then moves to a CPP, to match coverage to actual exposure without paying for layers it doesn’t need. Here is the path.
Audit what the BOP currently covers against today’s operations. If you have added employees, vehicles, a second location, or professional services since the policy was written, the BOP may already be misfiling your risk. A policy written for a two-person office does not automatically adjust when you hire a crew.
Layer endorsements onto the BOP before assuming you need a full CPP. A cyber endorsement addresses the ARS 18-552 breach notification exposure without moving the entire account. A professional liability rider, where available for your class, handles the E&O gap. Hired/non-owned auto covers vehicles your business uses but doesn’t own.
Identify the specific trigger that forces a CPP. Revenue crossing $5 million, adding a contractor workforce where ARS 23-907 creates workers comp exposure, acquiring owned vehicles that require commercial auto, or opening a second location with its own property value, any of these signals a move.
Move to a CPP with individually underwritten limits for property, GL, and BI. A CPP gives you the flexibility to set each limit based on actual exposure rather than accepting the BOP’s pre-packaged ceilings.
Add workers comp as a completely separate policy. Workers comp cannot be packaged inside a BOP or a CPP in Arizona, regardless of carrier. It is always its own policy, and the ARS 23-907 classification analysis has to happen before you write it, the 1099 workers comp arizona question feeds directly into the WC premium calculation.
The transition from BOP to CPP almost always means a higher premium. It also means the coverage matches the business that exists today, not the one that existed when you first bought a policy. For AZ business owners wanting to see what coverage options look like across the state, the arizona insurance agency locations page covers the metro areas where The Gebhard Agency works.
For context: business insurance sits alongside auto and motorcycle insurance arizona as part of the broader coverage picture for AZ business owners who use personal or commercial vehicles for work, and the commercial auto gap in a BOP is one of the most common reasons a business ends up underinsured after a vehicle accident.
Frequently Asked Questions
What’s the difference between a BOP and a commercial general liability policy?
A commercial general liability policy covers only third-party bodily injury, property damage, and personal injury claims against your business. A BOP wraps that same GL coverage together with commercial property and business interruption in a single packaged policy. For most Arizona small businesses with a physical location, a BOP costs less than buying those three coverages separately.
Does a business owner’s policy cover cyber attacks or data breaches?
No. A standard BOP does not include cyber liability coverage. Arizona Revised Statutes 18-552 requires businesses to notify affected individuals within 45 days of a data breach, with civil liability exposure capped at $500,000, costs a BOP will not pay. A separate cyber endorsement or standalone cyber liability insurance arizona policy is required to cover breach response, notification costs, and third-party claims.
Is a BOP right for my Arizona small business?
A BOP works well for Arizona businesses with annual revenues under approximately $5 million, fewer than 100 employees, and a physical location to insure. If your business has significant professional liability exposure, owns commercial vehicles, employs workers who might qualify as employees under ARS 23-907’s right-to-control test, or handles customer data, you will need additional policies beyond the BOP to cover those gaps.