Limitation of liability is one of the most negotiated provisions in any commercial agreement, and it is frequently misunderstood by the business teams who have to live with it. Both sides get it wrong. Buyers fixate on the cap number without reading the consequential damages waiver that quietly eliminates most of their real exposure. Vendors agree to carve-outs they haven’t priced, creating risk their insurance won’t cover.
A liability cap sets the financial ceiling on what one party can recover from the other. But reading the cap number alone is like reading the deductible on an insurance policy without checking what’s covered. The cap, the carve-outs, and the consequential damages waiver work together as a single mechanism. Miss one and you’ve misread the clause.
This article breaks down how limitation of liability provisions actually function, where the real negotiation leverage sits, and what both buyers and vendors should protect. Whether you are the party buying services or the party delivering them, the analysis starts in the same place: understanding the three layers that make up every well-drafted liability framework.
The Three Layers
Layer one: the general cap. This is the aggregate limit for most claims under the agreement, usually pegged to fees paid in the prior 12 months, total fees over the contract term, or a fixed dollar figure. Each formula produces a different number. A 12-month lookback on a deal that started three months ago means the cap is three months of fees, not twelve. Vendors often prefer the 12-month lookback because it ties exposure to recent revenue. Buyers in large or long-term deals should push for a cap based on total contract value or a multiple of annual fees so the cap reflects the full scope of the commitment.
Layer two: carve-outs. Certain obligations sit above the general cap, either subject to a higher “super cap” or uncapped entirely. Confidentiality breaches involving personal data, IP infringement indemnities, and fraud are the usual candidates. Vendors have a legitimate interest in resisting open-ended carve-outs: a carve-out without its own defined limit creates unpredictable exposure that is difficult to price or insure. The better approach for both sides is a super cap (often two to three times the general cap) that gives the buyer meaningful recovery without exposing the vendor to unlimited liability for a single category of claims.
Layer three: the consequential damages waiver. This layer is often more important than the cap itself. Most commercial contracts include a mutual waiver of indirect, special, incidental, and consequential damages, including lost profits. That waiver can eliminate recovery for the categories of loss that matter most to a buyer. From the vendor’s perspective, the consequential damages waiver is the single most important protection in the agreement. Without it, a vendor selling a $50,000 annual subscription could face claims for millions in the customer’s lost revenue or downstream business losses that the vendor had no ability to predict or control.
Where the Negotiation Actually Happens
Cap structure matters more than the number. A $5 million cap sounds substantial until you realize it covers indemnification, confidentiality breaches, and every other obligation under the agreement. One significant claim exhausts it. A $1 million general cap with meaningful carve-outs for data obligations and IP claims can provide better practical protection. For vendors, a structured approach with a defined general cap and bounded super caps is preferable to a single high number, because it lets the vendor price risk by category and maintain insurance coverage that matches the contract.
Mutuality can be misleading. A mutual cap looks fair, but the risk profile between the parties is rarely symmetrical. The vendor controls the platform, handles the data, and delivers the services. The customer’s primary obligation is to pay and comply with usage terms. Vendors, though, have a reasonable argument that mutuality protects them from buyer-side risks: misuse triggering third-party claims, acceptable use violations, or wrongful termination resulting in lost revenue. The right answer is usually a mutual framework with category-specific adjustments rather than identical numbers on both sides.
Consequential damages carve-outs are the overlooked win. Negotiating an exception to the consequential damages waiver for data breach notification costs or regulatory fines can be more valuable than increasing the cap. The carve-out determines whether the loss is recoverable at all; the cap only limits how much. Vendors should approach these carve-outs carefully: a narrowly defined carve-out for statutory data breach notification costs is a manageable, insurable risk. A broad carve-out for “all damages arising from a data breach” is not, and vendors are right to push back on that language.
The Interaction with Indemnification
This is where contracts frequently create problems. If the agreement includes a broad indemnification obligation and a general liability cap but does not specify whether indemnification falls inside or outside the cap, you have built in a dispute. Resolve this during the negotiation, not after a claim arises.
The three options are straightforward:
- Indemnity inside the general cap: the indemnification obligation counts against the same aggregate limit as all other claims.
- Indemnity subject to a separate limit: the indemnification obligation has its own defined ceiling, independent of the general cap.
- Indemnity fully uncapped: no dollar limit applies to indemnification claims at all.
Vendors generally prefer the first option because it keeps total exposure predictable and bounded. Buyers generally want indemnification carved out, particularly for IP infringement and data breach claims where the buyer’s losses could easily exceed a modest general cap. Both positions are reasonable depending on the deal size, the nature of the services, and the specific risks the indemnity covers. The second option (a separate, defined limit) often represents the best compromise: it gives the buyer recovery headroom for high-severity claims while giving the vendor a ceiling it can price and insure against. Silence, however, is not an option.
A Note on Unlimited Liability
Pushing for uncapped liability sounds like maximum protection. In practice, it often backfires. A vendor facing unlimited exposure will price that risk into the deal, narrow its operational commitments, or simply walk away. The buyer ends up paying more for less, or losing a preferred vendor entirely.
From the vendor’s side, unlimited liability is not just a legal risk. It is a business risk that affects pricing, investment in the product, and willingness to serve certain customer segments. A vendor that accepts uncapped exposure on one deal may need to restrict service levels, limit data handling responsibilities, or add protective language elsewhere in the agreement that erodes the buyer’s position in ways less visible than the liability cap itself.
A well-structured cap with targeted carve-outs almost always produces a better result for both parties than an uncapped provision the vendor spent the rest of the agreement hedging against. The goal is not the highest possible number. The goal is a framework where the cap, the carve-outs, and the consequential damages waiver work together to allocate risk in proportion to the deal and the obligations each party actually controls.