Liability covers what you do. Not what you decide.
Ask a business owner whether they're covered if they get sued and almost all of them say yes. What they're actually covered for is someone falling in the lobby. A general liability policy responds to physical harm — it was never built to reach a former employee's discrimination claim, a decision made by an owner or director, or a data breach. Cincinnati writes the coverages that do.
The short answer
Cincinnati writes commercial property, general liability, commercial auto, workers' compensation, cyber, and management liability. The first four are the account most owners already recognize. The last two exist because general liability only reaches bodily injury and property damage — physical harm — and a great deal of what gets a business sued isn't physical at all. Two Arkansas numbers worth knowing: employment discrimination law reaches employers at nine, and a data breach affecting more than a thousand people requires notice to the Attorney General.
Two policies, and the space between them.
Most small business accounts hold general liability and workers' compensation, and owners reasonably assume that between them everything is handled. Here's what falls in the middle.
General liability responds to third-party bodily injury and property damage. A customer falls. A crew damages a client's floor. A sign comes loose. Physical harm to someone else or their things.
Workers' compensation responds to workplace injury — an employee hurt doing the job.
Now consider a former employee alleging they were let go unfairly. No bodily injury. No property damage. No workplace injury. Neither policy is built to respond — and the owner has two policies and a reasonable belief that being sued is covered.
The same logic reaches a claim over a management decision, and a data breach. Physical harm is one category of trouble. Decisions are another, and they need their own forms.
The employment threshold is lower than you think.
This is the number owners get wrong most often, because the one they've heard is the federal one.
Under the Arkansas Civil Rights Act, at Ark. Code Ann. § 16-123-102, an employer is a person employing nine or more employees in Arkansas in each of twenty or more calendar weeks in the current or preceding calendar year.
Federal Title VII applies at fifteen. So Arkansas reaches smaller employers than federal law does — the opposite of what most owners assume.
An owner who has heard "fifteen" and employs eleven people concludes they're outside it. On the Arkansas side, they aren't. That's a genuinely common misreading and it's worth five minutes of your attention if your headcount sits anywhere between the two figures.
Employment practices liability is the coverage built for claims of this kind — wrongful termination, discrimination, harassment, retaliation, and on many forms claims from applicants and former employees as well as current ones. Whether it belongs on your account depends on headcount, how you hire and manage, and what's available to you. This is general information, not legal advice — employment questions belong with your attorney.
A breach isn't only a technology problem. It's a notification obligation.
Under Arkansas's Personal Information Protection Act, at Ark. Code Ann. § 4-110-105, a business that owns or licenses computerized personal information must disclose a breach to affected Arkansas residents.
Where a breach affects more than one thousand individuals, the business must also disclose it to the Arkansas Attorney General — at the same time as the individual notice, or within forty-five days of determining a reasonable likelihood of harm, whichever comes first.
Which is why cyber coverage is less about computers than people assume. The technical problem may be resolved in a weekend. The obligation to identify who was affected, notify them properly, and in a larger event notify the Attorney General on a clock is where the cost and the exposure actually sit — and none of it is reached by a general liability policy.
There's an encryption safe harbor where the information was encrypted and the key wasn't also compromised. On the deadline for notifying individuals, published sources differ, so we're not printing a day count we haven't confirmed against the code itself. This is general information, not legal advice — confirm with your attorney and with the Attorney General's office.
Six lines, two of which nobody explains.
Short here on purpose — each links to the full coverage explainer.
Commercial property
Buildings, equipment, inventory, and business income when a loss stops you trading. Commercial property in detail.
General liability
Third-party bodily injury and property damage — and the certificate every contract asks for. How general liability works.
Commercial auto
Owned vehicles, and the ones you don't own but are still exposed to. The vehicles you don't own.
Workers' compensation
Medical costs and wage replacement for injured employees. Auditable — what that means at year end.
Management liability
Directors and officers, employment practices, and related exposures arising from decisions rather than from physical harm. Directors and officers · EPLI.
Cyber liability
Breach response, notification obligations, and the costs that follow — most of which are administrative rather than technical. Cyber liability.
Cincinnati reaches you only through an independent agency — there's no direct channel. Eligibility for any class of business is decided by the carrier on the facts of your operation rather than by a webpage, so the fastest route is a short conversation.
Cincinnati can hold the household too.
Unusually, this carrier writes personal lines, high-value Private Client, and life alongside the commercial book. For an owner whose household and business finances overlap — which describes most small operations — that means one relationship and one annual review across the whole picture, and it's how the gaps between personal and commercial get found rather than assumed.
The counterweight is concentration, and we set it out properly on the main Cincinnati page rather than skipping it. It's a judgment about your specific account, not a rule.
No range would mean anything.
Commercial premiums span too wide a range for a published figure to help. What drives yours: what the business does and how it's classified, payroll and headcount, the property you own or occupy, revenue, vehicles and driver records, claims history and experience rating, the limits and deductibles selected, whether management liability and cyber are included, and any limits your contracts require. This is a description of how the coverage is rated, not a quote and not a guarantee. Send a description of the operation and any current declarations pages and we'll build the real figure with you across our commercial markets.
Where the rest of this sits.
Cincinnati commercial insurance questions.
Doesn't my general liability policy cover me if I get sued?
Only for certain kinds of being sued. General liability responds to third-party bodily injury and property damage — physical harm to someone else or their things. A customer falls in your lobby, a crew damages a client's floor, a sign comes loose.
What it was never built to reach is a claim arising from a decision: a former employee alleging wrongful termination or discrimination, an owner or director being pursued over a management decision, or a data breach. Those are separate coverages with separate forms. It is the single most common gap between what a business owner believes a policy does and what it actually does.
When does Arkansas employment discrimination law apply to my business?
Sooner than most owners expect. Under the Arkansas Civil Rights Act at Ark. Code Ann. § 16-123-102, an employer is defined as a person employing nine or more employees in Arkansas in each of twenty or more calendar weeks in the current or preceding calendar year.
Federal Title VII applies at fifteen employees, so Arkansas reaches smaller employers than federal law does. Owners frequently assume they are below any threshold because they have heard the federal number. Whether and how any of this applies to your business depends on your specific circumstances, and this is general information rather than legal advice — employment questions belong with your attorney.
What is employment practices liability and do I need it?
It covers claims brought by employees and, on many forms, by applicants and former employees — allegations such as wrongful termination, discrimination, harassment, and retaliation. It matters because neither of the policies an owner already has will respond.
General liability covers bodily injury and property damage, not employment decisions. Workers compensation covers workplace injury, not the decision to end someone's employment. That leaves a real gap between two policies people assume have it covered. Whether it belongs on your account depends on headcount, how you hire and manage, and the coverage available to you, so it is a conversation rather than a checkbox.
What does Arkansas require if my business has a data breach?
Under the Personal Information Protection Act at Ark. Code Ann. § 4-110-105, a business that owns or licenses computerized personal information must disclose a breach of the security of the system to affected Arkansas residents.
Where a breach affects more than one thousand individuals, the business must also disclose it to the Arkansas Attorney General, either at the same time as the individual notice or within forty-five days of determining that there is a reasonable likelihood of harm, whichever occurs first. There is an encryption safe harbor where the information was encrypted and the key was not also compromised. This is general information, not legal advice; confirm the requirements with your attorney and with the Attorney General's office.
What does Cincinnati write on the commercial side?
Commercial property, general liability, commercial auto, workers compensation, cyber, and management liability. The last two are the reason this page exists, because they are the coverages that respond to decisions rather than to physical harm and very few business owners have been walked through them.
Cincinnati distributes only through independent agencies, so it reaches you through an agency rather than directly. Eligibility for any class of business is decided by the carrier on the facts of your operation rather than by a webpage.
Should my business insurance sit with the same carrier as my personal policies?
Cincinnati is unusual in being able to hold both, and for a business owner whose household and business finances overlap that has genuine advantages — one relationship, one annual review, and coverage that lines up at the seams instead of leaving gaps between policies.
The counterweight is concentration, because anything that changes a carrier's view of the account lands across all of it at once. We set that argument out in full on the main Cincinnati page. It is a judgment about your specific account rather than a rule, and it is one of the things an independent agency is actually for.
How do I get a Cincinnati commercial quote in Bentonville or Rogers?
Start a commercial quote online or call (479) 286-1066. Have ready a plain description of what the business does, payroll and headcount, the property you own or lease, a vehicle and driver list, and any current declarations pages.
Mention how many people you employ and whether you hold customer or employee data electronically, because those two answers decide whether the employment and cyber conversations apply to you. We quote Cincinnati against our other commercial markets before telling you where the account belongs.
If our coverage explainers are useful, mark Cribb Insurance as a preferred source so more Northwest Arkansas business owners can find our local, plain-English guides.
Two questions decide most of this.
How many people do you employ, and do you hold customer or employee data electronically? Those answers tell us whether the employment and cyber conversations apply to you — and both are exposures a general liability policy was never built to reach. Send a description of the operation and your declarations pages.
Cribb Insurance Group Inc. is an independent insurance agency licensed in Arkansas, Oklahoma, Missouri, and Texas. We are not Cincinnati Insurance, and this page is not endorsed, sponsored, reviewed, or approved by Cincinnati Insurance. "Cincinnati Insurance" and "Cincinnati Financial" are trademarks or service marks of Cincinnati Financial Corporation and its affiliates, used here nominatively to identify products we are appointed to place. Policies are issued by the individual Cincinnati underwriting companies.
This page describes commercial insurance in general, industry-standard terms for informational purposes only. It is not a policy, not an offer of insurance, and not a guarantee of coverage, availability, eligibility, or price. Commercial property, general liability, commercial auto, workers' compensation, cyber liability, management liability, employment practices liability, limits, deductibles, endorsements, and exclusions are set by the carrier, vary by state and by policy and over time, are subject to the carrier's underwriting approval and eligibility, and apply only as written in the policy actually issued. Whether any coverage described here is available to your business is determined by the carrier on the facts of your operation; this page makes no representation that any particular business qualifies or that any particular coverage can be obtained.
Descriptions of what general liability and workers' compensation do and do not respond to are general explanations of how these forms commonly operate. They are not a coverage determination. Whether any specific claim is covered depends on the terms of the policies actually issued and the facts of the claim.
Statements about Arkansas law — including the definition of "employer" under the Arkansas Civil Rights Act at Ark. Code Ann. § 16-123-102, the federal Title VII employee threshold, and the breach disclosure obligations of the Personal Information Protection Act at Ark. Code Ann. § 4-110-105 including the Attorney General notification threshold and timing — are general information, not legal advice, are simplified summaries rather than complete statements of the law, and are subject to change. Published sources differ on certain notification timing requirements and this page does not state a figure that has not been confirmed. Whether any of these laws apply to your business, and what they require of you, depends on your specific circumstances. Consult your attorney, and confirm breach obligations with the Office of the Arkansas Attorney General. Nothing on this page is employment, human resources, data security, or breach response advice.
Last reviewed August 2026.