Leaving Boilerplate Behind

Wander deep into the pages of a commercial contract, and, amidst many provisions, you will encounter one of the most significant of them all: Limitation of Liability…and almost every limitation of liability clause looks roughly the same at first glance.

You will typically see a waiver  of consequential damages, a cap on direct damages that is tied to the fees being paid under the agreement, and perhaps carveouts for death, bodily injury, or liabilities that cannot, by law, be limited.  Then comes the familiar negotiation. One party pushes for uncapped liability. The other insists on a lower cap. The parties exchange multipliers of annual fees as though they are negotiating the purchase price of a car. But limitation of liability clauses are not just about numbers.

If you're unable to convince the other party to accept the uncapped liability you're seeking, or even the neat multiplier that would make your risk allocation feel more predictable, take a step back from the boilerplate language we've all seen hundreds of times and ask a different question: What specific risks are we actually trying to address?

Once the conversation shifts from the size of the cap to the nature of the risk, it often becomes much easier to find common ground and craft a liability structure that better reflects the realities of the deal.

So, what happens when the discussion over the liability cap reaches an impasse? That is when it may be time to leave boilerplate behind and think more creatively about risk allocation.

• Consider separate liability buckets for different risks rather than focusing solely on the general liability cap or a single super cap intended to cover every carved-out claim. I have had success negotiating separate caps for specific categories of liability, allowing the parties to tailor risk allocation to the nature of the exposure rather than applying a one-size-fits-all approach. For example, a customer and a software provider agreed to retain a general cap while establishing a separate cap for documented data-breach response costs, giving the customer meaningful protection for its most likely exposure without requiring the provider to accept uncapped liability.
• Exclude specific categories of damages from the liability cap. For example, instead of seeking uncapped liability for a data breach, carve out particular breach-response costs such as notification expenses, credit monitoring, forensic investigation costs, or regulatory assessments. This approach directly addresses the risks most likely to arise while avoiding a broader fight over unlimited liability.
• Require insurance coverage that aligns with the risks being assumed. A party may be unwilling to increase its liability cap but may be comfortable maintaining cyber, professional liability, or other insurance coverage that can serve as a practical source of recovery.
• Negotiate operational remedies, not just monetary ones. Incident response support, transition assistance, regulatory cooperation, remediation obligations, or dedicated resources during a disruption may ultimately be more valuable than an increased damages cap.

The most effective limitation of liability negotiations I've led were not focused on whether the cap should be 1x, 5x, or 10x the annual fees. Instead, they focused on the practical aspects of identifying the losses most likely to occur and ensuring those specific risks were addressed appropriately.

Sometimes the best solution is not a bigger cap. It is a more thoughtful allocation of risk.

What creative approaches have you seen used to address a tight liability cap?