A limitation of liability clause is the single line item that decides how much a deal can cost you when it goes wrong. It does two things at once: it caps the total dollars one party can recover (usually at fees paid, or a multiple of them) and it excludes whole categories of damages (consequential, indirect, lost profits). For most B2B contracts, this clause moves more risk than the indemnity, the warranty, and the SLA combined.
TL;DR
- A limitation of liability clause caps total recoverable damages and excludes categories of damages (consequential, indirect, lost profits). The two halves are separate; negotiate them separately.
- The market-standard cap for SaaS and services is 12 months of fees paid (sometimes the greater of fees paid or a fixed floor). Data, IP infringement, and confidentiality breaches are commonly carved out to a higher cap or no cap.
- Caps almost never hold for fraud, gross negligence, willful misconduct, or death/bodily injury, and most states will not let you contract out of those. Put the carve-outs in writing anyway, because silence invites a fight.
- The most expensive review miss is a mutual consequential-damages waiver that swallows your own indemnity. If lost profits are waived "for any claim," your indemnification right can become worth very little.
- A short claims window buried in the survival clause can bar a valid claim before the cap ever matters. Read the cap, the carve-outs, the indemnity, and the time bar together.
What a limitation of liability clause actually does
The clause has two independent mechanics, and conflating them is the most common drafting error.
1. The damages exclusion (the "type" limit). This bars recovery of indirect, incidental, special, consequential, exemplary, and punitive damages, and usually lost profits and lost data, regardless of the theory (contract, tort, strict liability). It does not cap a number; it removes whole buckets of harm from the table.
2. The liability cap (the "amount" limit). This sets a dollar ceiling on everything that survives the exclusion, typically tied to fees paid in some look-back window. Direct damages up to the cap stay recoverable; everything above it does not.
A well-drafted clause also says what the cap does not apply to. Those exceptions, the carve-outs, are where the real negotiation happens, because a carve-out is the only way a counterparty gets meaningful recovery for the risks they actually care about.
Why it matters: the dollars at stake
Picture a $120,000-a-year SaaS contract. A misconfiguration on the vendor side exposes the customer's data, and the customer spends $900,000 on breach notification, credit monitoring, and a regulatory response.
- With a 12-month-fees cap and no data carve-out, the customer recovers at most $120,000 and eats $780,000.
- With a data-breach carve-out at a $2M super-cap, the customer recovers the full $900,000.
Same incident, same contract length, an $780,000 swing decided by one carve-out. That is why in-house counsel spend more time here than almost anywhere else in a commercial agreement.
How the cap is sized
The cap number is not always "12 months of fees." Which structure you get says a lot about who has leverage and how the deal is priced.
| Cap structure | Typical form | Where it shows up |
|---|---|---|
| Fees paid (look-back) | Fees paid in the trailing 12 months before the claim | Recurring SaaS and subscription services |
| Fixed dollar amount | A negotiated number (for example, $1M) | One-time engagements, or where fees are small relative to the risk |
| Multiple of fees | 2x or 3x fees paid | Mid-market compromise when the buyer refuses a bare 1x |
| Total contract value | All fees payable over the full term, including amounts not yet invoiced | Buyer push early in a term, when fees paid so far are tiny |
| Insurance-linked | The greater of a fee cap or the vendor's available insurance proceeds | Where the vendor carries cyber or E&O cover the buyer wants to reach |
The buyer's instinct is to move up this list; the vendor's is to stay at fees paid to date. The two most common buyer asks are switching from "fees paid" to "fees paid or payable" (so a claim early in year one is not capped at a few months of fees) and adding a fixed floor so a small or discounted deal still carries a meaningful number.
Who wants what
| Customer / buyer | Vendor / supplier | |
|---|---|---|
| Overall cap | Higher, or a multiple of fees | Lower, fees paid in trailing 12 months |
| Consequential damages | Carve out for breach of confidentiality and data | Mutual waiver, no exceptions |
| Data / security breach | Uncapped or high super-cap | Capped, ideally inside the general cap |
| IP infringement | Uncapped (it is the vendor's product) | Capped, or limited to the indemnity |
| Indemnification | Outside the cap | Inside the cap |
| Gross negligence / willful misconduct | Explicitly carved out | Silent (relies on the cap holding) |
| Time to bring a claim | Full statutory limitations period | Short contractual window (12 months) |
The pattern: the buyer wants the risks they cannot control (the vendor's security, the vendor's IP) sitting outside the cap, and the vendor wants everything inside a predictable, fee-linked number.
Market-standard language
A typical mutual clause for a SaaS or services agreement reads close to this:
LIMITATION OF LIABILITY.
(a) Exclusion of Damages. EXCEPT FOR THE EXCLUDED CLAIMS, NEITHER PARTY
WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR
PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, GOODWILL, OR DATA,
WHETHER IN CONTRACT, TORT, OR OTHERWISE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.
(b) Cap. EXCEPT FOR THE EXCLUDED CLAIMS, EACH PARTY'S TOTAL AGGREGATE
LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT WILL NOT EXCEED
THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER IN THE TWELVE (12) MONTHS
PRECEDING THE EVENT GIVING RISE TO THE CLAIM.
(c) Excluded Claims. The limitations in (a) and (b) do not apply to:
(i) a party's indemnification obligations; (ii) breach of confidentiality;
(iii) a party's gross negligence, willful misconduct, or fraud; or
(iv) amounts owed for the Services.
The all-caps styling is not decorative. Under the UCC and the law of many states, an exclusion of warranties or consequential damages must be conspicuous to be enforceable, and capitalization is the traditional way to clear that bar. Keep it.
The negotiation: standard, fallback, walk-away
Treat the cap and the carve-outs as two separate trades.
| Issue | Opening position | Fallback both sides accept | Walk-away |
|---|---|---|---|
| Cap size | 12 months fees | Greater of 12 months fees or a fixed floor (for example, $100K) | Uncapped general liability |
| Data breach | Uncapped or 3x-5x super-cap | Fixed super-cap (for example, $1M-$2M) | Data sitting inside the 12-month cap |
| IP infringement | Uncapped (vendor's product) | Tied to the IP indemnity, super-capped | No IP indemnity at all |
| Consequential waiver | Mutual, with confidentiality carve-out | Mutual, narrow carve-outs only | One-sided waiver favoring the vendor |
| Indemnity vs cap | Indemnity fully outside the cap | Indemnity outside the general cap but subject to a super-cap | Indemnity folded inside the 12-month cap |
| Insurance floor | Cap no lower than available insurance limits | Greater of the fee cap or insurance proceeds | Cap set below the vendor's coverage |
| Claims window | Full statutory limitations period | Contractual limit of 18-24 months | 12-month (or shorter) claims bar |
A "super-cap" is the workhorse compromise: instead of fighting uncapped-versus-capped, both sides agree the sensitive risks (data, IP) sit at a higher, separately negotiated number while everything else stays at fees paid.
Common carve-outs (and the language that creates them)
Carve-outs are the exceptions that pull a risk back out from under the cap or the exclusion. The high-frequency ones:
- Indemnification. Without this, an indemnity is capped at fees paid, which usually defeats the point of having one.
- Confidentiality and data. The buyer's top concern. Often given its own super-cap rather than going fully uncapped.
- Gross negligence, willful misconduct, fraud. Usually carved out because a court will likely strike the cap for these anyway. Writing it down avoids litigating enforceability.
- Death or bodily injury. Standard in any contract with a physical-world footprint; you generally cannot waive these.
- Amounts owed (fees). A vendor will not let a customer hide behind the cap to avoid paying for the service itself.
A narrow carve-out looks like this:
Notwithstanding the foregoing, the cap in Section (b) does not limit
liability for: (1) breach of Section [Confidentiality]; (2) a party's
indemnification obligations under Section [Indemnification]; or (3) a
party's fraud, gross negligence, or willful misconduct.
The claims window: liability's hidden time limit
A cap and an exclusion decide how much a claim is worth. A claims window decides whether you can bring it at all. Many agreements bury a contractual limitation period in the survival clause or the LoL section itself, requiring any claim to be filed within a fixed period after it arises (commonly 12 to 24 months), shorter than the statutory limitations period the law would otherwise give you.
No action arising out of or related to this Agreement may be brought by
either party more than twelve (12) months after the cause of action
accrued.
Under UCC section 2-725, parties to a sale of goods may shorten the limitations period to as little as one year but may not extend it. For services and other non-goods contracts, whether you can contractually shorten the statutory period varies by state, so confirm the governing law allows it before relying on the clause. Either way, a buyer should treat a short window as a real concession: a latent data or IP problem that surfaces in year three is worthless if the window closed in year one. Read this alongside the survival clause, which is where the window often actually lives.
Jurisdiction and enforceability notes
Limitation of liability clauses are generally enforced in commercial contracts between sophisticated parties, but the cap is not bulletproof:
- Gross negligence, willful misconduct, and fraud. Most US states will not enforce a cap that purports to limit liability for these. Some states (New York is the well-known example) refuse to enforce exculpatory clauses against gross negligence as a matter of public policy.
- Consequential damages must be conspicuous. Under UCC section 2-719, a limitation on consequential damages in a sale of goods is unenforceable if it is unconscionable, and limitation for personal injury in consumer goods is presumptively unconscionable.
- Failure of essential purpose. If the contract's exclusive remedy fails (for example, a "repair or replace" warranty that the vendor cannot actually deliver), a court may let the damages exclusion fall with it. Draft the cap and the exclusion as independent so one surviving does not depend on the other.
- Statutory liabilities. Many privacy, consumer-protection, and IP statutes carry damages or penalties you cannot contract away. A cap does not reach them.
This is general information, not legal advice for a specific deal. The enforceability of any cap turns on the governing law and the facts; confirm against the controlling state's law before you rely on it. For the related rule on penalty clauses, see our guide on liquidated damages.
Review checklist: red flags to catch
- The cap is tied to fees but the contract is usage-priced or front-loaded, so "12 months of fees" is a moving or tiny number.
- The consequential-damages waiver is mutual but you are the indemnified party, so the waiver erodes your own recovery.
- No carve-out for the vendor's indemnification, which caps the indemnity at fees paid.
- Data and IP sit inside the general cap with no super-cap.
- The cap is one-sided (limits only the vendor) when the deal is presented as mutual.
- A broad carve-out ("any breach") that quietly removes the cap.
- The exclusion is not conspicuous (lower-case, buried), creating an enforceability risk.
- A short claims window (12 months or less) sits in the survival clause and shortens the time to sue.
- The cap is pegged only to insurance proceeds, so a coverage denial leaves nothing to recover.
How it interacts with other clauses
The limitation of liability clause does not stand alone. Read it together with:
- Indemnification: the carve-out that puts the indemnity outside the cap is what gives it teeth.
- Liquidated damages: a separate, agreed sum for a specific breach that the general cap may or may not limit.
- Warranty disclaimer: both must be conspicuous, and a failed exclusive remedy can drag the cap down with it.
- Insurance: the coverage behind an insurance-linked cap, and the buyer's real source of recovery above the fee number.
- Survival: where the claims window and post-termination obligations usually live.
- Data protection: the breach exposure the buyer most wants carved out.
For the broader workflow, see the in-house contract review playbook and, for the SaaS-specific pass, how to review a SaaS agreement.
FAQ
What is a limitation of liability clause? It is a contract provision that limits how much one party can recover from the other. It works in two parts: an exclusion of certain damage types (consequential, indirect, lost profits) and a dollar cap on everything that remains, usually tied to fees paid.
What is a standard limitation of liability cap? For SaaS and services, the market standard is the total fees paid in the 12 months before the claim. Some contracts use a multiple of fees, or the greater of fees paid and a fixed floor. Sensitive risks like data breaches and IP infringement are often given a higher "super-cap."
How is a limitation of liability cap calculated? Most SaaS and services caps use the fees the customer paid in a look-back window, usually the 12 months before the claim. Other structures use a fixed dollar amount, a multiple of fees (2x to 3x), total contract value, or the greater of a fee figure and the vendor's available insurance proceeds.
Can you limit liability for gross negligence or fraud? Usually not. Most US states refuse to enforce a cap that limits liability for fraud, gross negligence, or willful misconduct as a matter of public policy. Because the cap likely fails for these anyway, it is standard to carve them out explicitly.
Is a limitation of liability clause enforceable? Generally yes, between sophisticated businesses, when the language is clear and conspicuous and the cap is not unconscionable. Courts refuse to enforce it for fraud, gross negligence, willful misconduct, and personal injury in consumer goods, and statutes can override it. Enforceability turns on the governing law and the facts of the deal.
What is the difference between the damages exclusion and the cap? The exclusion removes categories of damages (you cannot recover lost profits at all). The cap sets a maximum dollar amount on the damages that are still recoverable. They are separate limits and should be negotiated separately.
What is a super-cap? A super-cap is a higher, separate liability ceiling for specific high-risk obligations (commonly data breaches and IP infringement) while ordinary claims stay at the general fees-based cap. It is the standard compromise between "uncapped" and "capped at fees."
Should the indemnity be inside or outside the cap? The indemnified party wants it outside the cap, otherwise the indemnity is limited to fees paid and provides little protection. The standard compromise is to put indemnification outside the general cap but subject to a negotiated super-cap.
Should a limitation of liability clause be mutual? Usually yes. A mutual cap is easier to defend as reasonable and harder to attack as one-sided overreaching. Parties often make the general cap mutual while leaving certain carve-outs, such as a vendor's IP indemnity, running one direction only.
How long do you have to bring a claim under a limitation of liability clause? Many contracts add a survival or limitation-period clause requiring claims to be filed within 12 to 24 months after they arise, shorter than the statutory period. For sales of goods, UCC 2-725 lets the parties shorten it to as little as one year. Miss the window and the claim is barred no matter what the cap says.
Related clauses
Clauses that get negotiated alongside this one.
