How Limitation of Liability and Indemnity Clauses Work

A limitation of liability clause is usually three sentences long and decides more money than the pricing schedule. One sentence caps each party’s total exposure. One excludes indirect and consequential damages. One lists the exceptions. The indemnification clause next to it then shifts the cost of certain third-party claims from one party to the other, and the relationship between the two clauses decides whether the indemnity is worth anything at all. We negotiate these terms in nearly every agreement that passes through our contract drafting and negotiation practice, and this post explains the mechanics so you can read them yourself.

What a limitation of liability clause actually caps

The cap sets the maximum a party can be ordered to pay for claims arising out of the contract, regardless of how large the actual loss is. The most common structures are a cap equal to the fees paid or payable in the twelve months before the claim, a fixed dollar figure, or a multiple of annual fees. Vendors prefer the fee-based cap because it scales with the deal. Customers prefer a fixed amount or a multiple, because a cheap software tool that holds customer data makes a fee-based cap meaningless.

“Arising out of or relating to this Agreement” captures contract, tort, and statutory claims alike. A cap that is “aggregate” applies across all claims for the life of the contract; a cap that is “per claim” resets each time.

The consequential damages waiver

The second sentence usually excludes “indirect, incidental, special, consequential, or punitive damages, including lost profits.” Direct damages are the costs that flow immediately from the breach, such as the cost to re-procure the service or fix the defective deliverable. Consequential damages are the downstream losses: the revenue the customer lost because the system was down, the penalties it paid its own customers, the cost of the data it could not recover.

First, lost profits are not always consequential; in some situations a court will treat them as direct damages, and the clause should say explicitly whether lost profits are excluded in all cases. Second, a waiver of consequential damages combined with a low cap can leave a customer with almost no remedy for the harm it actually fears. If the thing you are worried about is downtime or data loss, the waiver has to be negotiated alongside the cap, not accepted as boilerplate. Our overview of which clauses every business contract needs places these terms in the context of the rest of the agreement.

Carve-outs: what should sit outside the cap

The third sentence lists the obligations the cap and the waiver do not apply to. The typical candidates:

• Each party’s indemnification obligations, so the indemnity is not capped at twelve months of fees
• Breach of confidentiality or data protection obligations
• Gross negligence, willful misconduct, and fraud
• Infringement of the other party’s intellectual property
• The customer’s obligation to pay fees, which should never be capped

Vendors resist unlimited carve-outs and often propose a “super cap” instead: a higher ceiling, such as three times annual fees, for data breach and indemnity claims, with the standard cap for everything else. That compromise is often where technology negotiations settle. The carve-out list is where the real trading happens, as our post on how to negotiate a business contract describes.

How indemnification shifts third-party claims

Indemnification is a promise to cover the other party’s losses from a defined category of claims, usually claims brought by someone outside the contract. A software vendor indemnifies its customer against claims that the software infringes a third party’s patent or copyright. A customer indemnifies the vendor against claims arising from the customer’s data or its misuse of the service.

The clause usually contains three verbs: indemnify, defend, and hold harmless. “Defend” is the operational one. It obligates the indemnifying party to take over the defense of the claim, hire counsel, and pay as the case proceeds, rather than reimbursing the other party afterward. The procedure that follows matters as much as the promise: the indemnified party must give prompt notice, the indemnifying party gets control of the defense, settlements that admit fault or impose obligations on the indemnified party require its consent, and both sides must cooperate.

Watch for indemnities that extend to first-party claims, meaning claims between the contracting parties themselves. An indemnity for “any breach of this Agreement” that is carved out of the cap effectively removes the cap for every breach, which is rarely what the party agreeing to it intended.

Negotiating the package

The cap, the waiver, the carve-outs, and the indemnity have to be read together, because each one changes the value of the others. An uncapped IP indemnity is strong protection for a customer. An IP indemnity subject to a twelve-month fee cap is close to decorative. A consequential damages waiver with no carve-out for confidentiality means a data leak that costs the customer its clients may be worth nothing in damages.

A party should not accept exposure it cannot insure, and its insurer’s limits are an objective reason to hold a position. Mutuality is another. A clause that caps the vendor’s liability but not the customer’s is common in vendor paper and routinely negotiated to mutual. CLP’s risk management and legal compliance team aligns these contractual positions with a client’s actual insurance program.

Where enforceability ends

Courts generally enforce limitation of liability clauses between sophisticated commercial parties. The limits are set by public policy and vary by state. Many states, including New York, will not enforce a clause that shields a party from the consequences of its own gross negligence, willful misconduct, or fraud, regardless of the contract’s wording. Clauses imposed on a party with no ability to negotiate face unconscionability challenges. And a cap that leaves a party with no meaningful remedy at all can be attacked on the ground that the contract’s exclusive remedy has failed of its essential purpose.

In practice, a clearly drafted cap with reasonable carve-outs holds up. When a breach does happen, the first thing counsel reads is this clause, which is why our post on what to do when the other party breaches a contract begins there, and why our contract review and executive counsel team flags it on every review.

If a counterparty’s liability and indemnity terms do not match the risk you are actually taking on, Capitol Law Partners can restructure them so the cap, the carve-outs, and the indemnity protect you together. Schedule a consultation.

This article is for informational purposes only and does not constitute legal advice. No attorney-client relationship is formed by this communication.

Attorney Cagatay Ersoy. Practical strategy for founders, investors, and growing companies.

Need help with this topic? See our liability and indemnity clause drafting page or schedule a consultation.