When the customer refuses a limitation of liability: what it costs to be wrong
A customer's refusal to cap liability does not remove the limits that sit outside the contract. Certain duties survive any negotiated ceiling, and a supplier who treats the clause as the only backstop is wrong about where the risk actually sits. The cost of being wrong here is not abstract: it is uncapped exposure on ordinary breach, a weaker renegotiation position later, and cover that does not match what was actually signed.
What stays mandatory regardless of the cap
Three layers of EU law do not bend to a commercial negotiation, and a supplier drafting around a customer's refusal should know which one applies to the deal in front of them.
| Layer | What survives a negotiated cap | Status |
|---|---|---|
| Directive 2009/24/EC | Rights of the lawful acquirer to observe, study and correct the software cannot be contracted away by a cap on damages | in force since 2009 |
| Directive (EU) 2022/2555 (NIS2) | Risk-management and incident-notification duties attach to the entity in scope, not to the contract's liability clause | in force since 18 October 2024 |
| Regulation (EU) 2024/1689 (AI Act) | Conformity obligations on providers and deployers of high-risk systems sit above any negotiated cap | applies from 2 August 2026 (state as at 4 March 2025) |
None of these three acts sets the size of a commercial cap. Each of them sets a floor that a cap cannot go under, whatever the customer signed.
What actually changes when the customer refuses
A refused cap shifts the ordinary-breach exposure back onto the supplier's own balance sheet. It does not change the mandatory floor described above, and it does not remove the need for carve-outs that both sides can live with. What usually moves next is the insurance conversation, the indemnity wording, and the fee-multiple used as an informal ceiling in place of a fixed figure.
If the deployment includes a high-risk AI system, refusing the cap does not touch the AI Act obligations that already sit with the provider. If the software licence includes error-correction rights under Directive 2009/24/EC, those rights travel with the customer whatever the cap says. Treating the clause as the only line of defence is the error that costs the most.
What to do, in order
- Have the commercial lead pause the draft and route the clause to outside counsel before the next version goes out.
- Ask counsel to confirm whether the deal touches a high-risk AI system, a NIS2-scoped entity, or software governed by Directive 2009/24/EC, and to note which floor already applies.
- Offer a mutual cap tied to fees paid over a fixed period, rather than a supplier-only ceiling the customer has no reason to accept.
- Keep a short, named list of carve-outs — data breach, IP infringement, wilful misconduct — and leave the general cap intact everywhere else.
- Have the risk or insurance officer check the policy limits against the exposure the new draft creates, before anyone signs.
- Run the subprocessor chain through the same cap using the register: Subprocessors, including local delivery partners and its limits.
Who decides, and on what
Inside the negotiation, the decision sits with whoever holds signing authority under internal delegation, not with the person drafting the clause. That person decides on the redline itself, the insurance confirmation, and counsel's note on the mandatory floor.
If the dispute reaches a court or an arbitral tribunal, the decision turns on the executed contract text, the correspondence around the redline, and any notice given under it. Nothing else carries weight at that stage.
Two forks worth checking before you sign
If the licence is delivered through a token rather than a conventional grant, the cap discussion changes shape entirely: A licence terminates but the token remains tokenised rights sets out what happens when the underlying right ends but the token does not follow it.
If the deployment is still moving from a pilot into live use, the cap negotiated for the pilot rarely survives production scale unchanged: When a proof of concept becomes production explained covers what shifts when that line is crossed.
What this page does not decide
This page does not set the figure for your cap, and it does not replace a read of the specific draft in front of you. Two adjacent checks are usually needed before the cap conversation can close safely.
If the counterparty on the other side of the negotiation has recently changed its name or structure, confirm who you are actually contracting with: Counterparty report when the counterparty changes name in detail.
If a signed version of the clause is going to be relied on later in a dispute, verify it before that moment arrives, not during it: Document report before relying on it in a dispute.
Verified
Checked as at 4 March 2025 against: EUR-Lex, Directive 2009/24/EC of the European Parliament and of the Council of 23 April 2009 on the legal protection of computer programs (codified version); European Commission Digital Strategy, Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2); EUR-Lex, Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act).
FAQ
What is the first step when the customer refuses a limitation of liability?
Pause the draft and route it to counsel before sending the next version. The first useful move is checking whether a mandatory floor already applies, not offering a lower cap.
Which deadline is already running?
Any notice period written into the previous draft keeps running whatever the negotiation status. Separately, statutory reporting duties under cybersecurity law attach to the entity, not to the state of the contract, and do not pause for a redline in progress.
Who decides, and on what evidence?
Commercially, the person holding signing authority decides, on counsel's note and the insurance confirmation. If it reaches a tribunal, the decision turns on the signed text, the correspondence around it, and the notices actually given.