Limitation of Liability Clause: Caps, Carve-Outs, and Fallbacks

A limitation of liability clause is the single line item that decides how much a deal can cost you when it goes wrong. It does two things at once: it caps the total dollars one party can recover (usually at fees paid, or a multiple of them) and it excludes whole categories of damages (consequential, indirect, lost profits). In many B2B contracts it decides how much of the risk the other terms (the indemnity, the warranty, the SLA) actually transfer.

Reviewed and corrected on 12 October 2026. This is general information, not legal advice; check the cited statute or opinion before relying on it. The caps, look-back periods and negotiating positions on this page are drafting practice, not legal rules, and we did not survey contracts to measure how common they are.

TL;DR

• A limitation of liability clause caps total recoverable damages and excludes categories of damages (consequential, indirect, lost profits). The two halves are separate; negotiate them separately.
• A common cap for SaaS and services is 12 months of fees paid (sometimes the greater of fees paid or a fixed floor). Data, IP infringement, and confidentiality breaches are often carved out to a higher cap or no cap.
• A cap can fail against fraud, willful misconduct and, in some states, gross negligence, and the UCC treats a limit on personal-injury damages for consumer goods as prima facie unconscionable. The rules differ by state. Put the carve-outs in writing anyway, because silence invites a fight.
• The most expensive review miss is a mutual consequential-damages waiver that swallows your own indemnity. If lost profits are waived "for any claim," your indemnification right can become worth very little.
• A short claims window buried in the survival clause can bar a valid claim before the cap ever matters. Read the cap, the carve-outs, the indemnity, and the time bar together.

What a limitation of liability clause actually does

The clause has two independent mechanics, and conflating them is the most common drafting error.

1. The damages exclusion (the "type" limit). This bars recovery of indirect, incidental, special, consequential, exemplary, and punitive damages, and usually lost profits and lost data, regardless of the theory (contract, tort, strict liability). It does not cap a number; it removes whole buckets of harm from the table.

2. The liability cap (the "amount" limit). This sets a dollar ceiling on everything that survives the exclusion, typically tied to fees paid in some look-back window. Direct damages up to the cap stay recoverable; everything above it does not.

A well-drafted clause also says what the cap does not apply to. Those exceptions, the carve-outs, are where the real negotiation happens, because a carve-out is the only way a counterparty gets meaningful recovery for the risks they actually care about.

Why it matters: the dollars at stake

Picture a $120,000-a-year SaaS contract. A misconfiguration on the vendor side exposes the customer's data, and the customer spends $900,000 on breach notification, credit monitoring, and a regulatory response.

• With a 12-month-fees cap and no data carve-out, the customer recovers at most $120,000 and eats $780,000.
• With a data-breach carve-out at a $2M super-cap, the customer recovers the full $900,000.

Same incident, same contract length, an $780,000 swing decided by one carve-out. That is why in-house counsel spend more time here than almost anywhere else in a commercial agreement.

How the cap is sized

The cap number is not always "12 months of fees." Which structure you get says a lot about who has leverage and how the deal is priced.

The buyer's instinct is to move up this list; the vendor's is to stay at fees paid to date. The two most common buyer asks are switching from "fees paid" to "fees paid or payable" (so a claim early in year one is not capped at a few months of fees) and adding a fixed floor so a small or discounted deal still carries a meaningful number.

Who wants what

The pattern: the buyer wants the risks they cannot control (the vendor's security, the vendor's IP) sitting outside the cap, and the vendor wants everything inside a predictable, fee-linked number.

Market-standard language

A typical mutual clause for a SaaS or services agreement reads close to this:

LIMITATION OF LIABILITY.

(a) Exclusion of Damages. EXCEPT FOR THE EXCLUDED CLAIMS, NEITHER PARTY
WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR
PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, GOODWILL, OR DATA,
WHETHER IN CONTRACT, TORT, OR OTHERWISE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.

(b) Cap. EXCEPT FOR THE EXCLUDED CLAIMS, EACH PARTY'S TOTAL AGGREGATE
LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT WILL NOT EXCEED
THE TOTAL FEES PAID OR PAYABLE BY CUSTOMER IN THE TWELVE (12) MONTHS
PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

(c) Excluded Claims. The limitations in (a) and (b) do not apply to:
(i) a party's indemnification obligations; (ii) breach of confidentiality;
(iii) a party's gross negligence, willful misconduct, or fraud; or
(iv) amounts owed for the Services.

The all-caps styling is a drafting habit, and it does legal work in some places. The UCC requires a warranty disclaimer in a sale of goods to be conspicuous (section 2-316(2)), and UCC 1-201(b)(10) defines "conspicuous" as "so written, displayed, or presented that a reasonable person against which it is to operate ought to have noticed it," listing a heading in capitals among the examples. Section 2-719, which governs limits on remedies and consequential damages, contains no conspicuousness requirement, but some state courts apply a fair-notice rule to clauses that shift a party's own negligence (Texas does for indemnities and releases: Dresser Industries, Inc. v. Page Petroleum, Inc., 853 S.W.2d 505 (Tex. 1993)). Capitalizing or bolding the clause is cheap insurance against that argument.

The negotiation: standard, fallback, walk-away

Treat the cap and the carve-outs as two separate trades.

A "super-cap" is the workhorse compromise: instead of fighting uncapped-versus-capped, both sides agree the sensitive risks (data, IP) sit at a higher, separately negotiated number while everything else stays at fees paid.

Common carve-outs (and the language that creates them)

Carve-outs are the exceptions that pull a risk back out from under the cap or the exclusion. The high-frequency ones:

• Indemnification. Without this, an indemnity is capped at fees paid, which usually defeats the point of having one.
• Confidentiality and data. The buyer's top concern. Often given its own super-cap rather than going fully uncapped.
• Gross negligence, willful misconduct, fraud. Often carved out because courts in some states will not enforce a limit against them (see the jurisdiction notes). Writing it down avoids litigating enforceability.
• Death or bodily injury. Commonly carved out in any contract with a physical-world footprint. Some law pushes the same way: UCC 2-719(3) makes a limit on consequential damages for injury to the person in the case of consumer goods "prima facie unconscionable," and Massachusetts makes language that excludes or modifies the implied warranties of merchantability and fitness, or the remedies for breaching them, unenforceable with respect to injury to the person, while leaving other law free to enforce an agreement between organizations that allocates that risk (Mass. Gen. Laws ch. 106, section 2-316A(4)).
• Amounts owed (fees). A vendor will not let a customer hide behind the cap to avoid paying for the service itself.

A narrow carve-out looks like this:

Notwithstanding the foregoing, the cap in Section (b) does not limit
liability for: (1) breach of Section [Confidentiality]; (2) a party's
indemnification obligations under Section [Indemnification]; or (3) a
party's fraud, gross negligence, or willful misconduct.

The claims window: liability's hidden time limit

A cap and an exclusion decide how much a claim is worth. A claims window decides whether you can bring it at all. Many agreements bury a contractual limitation period in the survival clause or the LoL section itself, requiring any claim to be filed within a fixed period after it arises (sometimes 12 to 24 months), shorter than the statutory limitations period the law would otherwise give you.

No action arising out of or related to this Agreement may be brought by
either party more than twelve (12) months after the cause of action
accrued.

Under UCC section 2-725, the uniform text says that "By the original agreement the parties may reduce the period of limitation to not less than one year but may not extend it." States vary from that default. Delaware lets an action on a written contract involving at least $100,000 be brought within the period the contract specifies, up to 20 years, "notwithstanding" UCC 2-725 (10 Del. C. 8106(c)). Texas voids a contractual period shorter than two years, with an exception for the sale or purchase of a business entity involving at least $500,000 (Tex. Civ. Prac. & Rem. Code 16.070). How section 16.070 interacts with UCC 2-725 for a sale of goods in Texas was not verified in our October 2026 review. For other contracts, check the governing state's rule on shortening the limitations period before relying on the clause. Either way, a buyer should treat a short window as a real concession: a latent data or IP problem that surfaces in year three is worthless if the window closed in year one. Read this alongside the survival clause, which is where the window often actually lives.

Jurisdiction and enforceability notes

Limitation of liability clauses are generally enforced in commercial contracts between sophisticated parties, but the cap is not bulletproof:

• Fraud, willful misconduct and gross negligence. The rules differ by state, and we read only a few. California's Civil Code section 1668 says contracts that "exempt any one from responsibility for his own fraud, or willful injury to the person or property of another, or violation of law, whether willful or negligent, are against the policy of the law." New York's Court of Appeals held in Sommer v. Federal Signal Corp., 79 N.Y.2d 540 (1992), that "a party may not insulate itself from damages caused by grossly negligent conduct," which "applies equally to contract clauses purporting to exonerate a party from liability and clauses limiting damages to a nominal sum." It added that gross negligence, when invoked to pierce a limitation of liability in a commercial contract, "must 'smack[ ] of intentional wrongdoing.'" California's Supreme Court held in City of Santa Barbara v. Superior Court, 41 Cal. 4th 747 (2007), that a release of liability for future gross negligence in a recreational program is unenforceable, and limited its ruling to that setting. Other states were not verified in our October 2026 review, so do not assume your state follows New York.
• Consequential damages and unconscionability. Under UCC section 2-719(3), "Consequential damages may be limited or excluded unless the limitation or exclusion is unconscionable. Limitation of consequential damages for injury to the person in the case of consumer goods is prima facie unconscionable but limitation of damages where the loss is commercial is not." Section 2-302 separately lets a court refuse to enforce a clause it finds unconscionable when the contract was made.
• Failure of essential purpose. Under UCC 2-719(2), "Where circumstances cause an exclusive or limited remedy to fail of its essential purpose, remedy may be had as provided in this Act." Courts disagree on whether a separate consequential-damages exclusion survives that failure. The Third Circuit, predicting New Jersey law, treated the exclusion as an independent provision, "valid unless unconscionable," and enforced it after the repair remedy failed (Chatlos Systems, Inc. v. National Cash Register Corp., 635 F.2d 1081 (3d Cir. 1980)). The Ninth Circuit, applying California law, upheld an award of consequential damages despite a damages limitation where the seller's default was "so total and fundamental" that the limitation was "expunged from the contract" (RRX Industries, Inc. v. Lab-Con, Inc., 772 F.2d 543 (9th Cir. 1985)). Draft the cap and the exclusion as independent provisions, and expect the result to turn on the facts and the forum.
• Parties and third parties. A cap binds only the parties to the contract. It does not limit what a regulator or a non-party can recover from either of them.

This page is general information, not legal advice. Whether a particular cap holds depends on the governing state's law, the type of loss and the facts, so check the controlling law before relying on one. For the related rule on penalty clauses, see our guide on liquidated damages.

Review checklist: red flags to catch

• The cap is tied to fees but the contract is usage-priced or front-loaded, so "12 months of fees" is a moving or tiny number.
• The consequential-damages waiver is mutual but you are the indemnified party, so the waiver erodes your own recovery.
• No carve-out for the vendor's indemnification, which caps the indemnity at fees paid.
• Data and IP sit inside the general cap with no super-cap.
• The cap is one-sided (limits only the vendor) when the deal is presented as mutual.
• A broad carve-out ("any breach") that quietly removes the cap.
• The exclusion is not conspicuous (lower-case, buried), which hands the other side a fair-notice or unconscionability argument in some states.
• A short claims window (12 months or less) sits in the survival clause and shortens the time to sue.
• The cap is pegged only to insurance proceeds, so a coverage denial leaves nothing to recover.

How it interacts with other clauses

The limitation of liability clause does not stand alone. Read it together with:

• Indemnification: the carve-out that puts the indemnity outside the cap is what gives it teeth.
• Liquidated damages: a separate, agreed sum for a specific breach that the general cap may or may not limit.
• Warranty disclaimer: both must be conspicuous, and a failed exclusive remedy can drag the cap down with it.
• Insurance: the coverage behind an insurance-linked cap, and the buyer's real source of recovery above the fee number.
• Survival: where the claims window and post-termination obligations usually live.
• Data protection: the breach exposure the buyer most wants carved out.

For the full review process, see the in-house contract review playbook and how to review a SaaS agreement.

FAQ

What is a limitation of liability clause? It is a contract provision that limits how much one party can recover from the other. It works in two parts: an exclusion of certain damage types (consequential, indirect, lost profits) and a dollar cap on everything that remains, usually tied to fees paid.

What is a standard limitation of liability cap? For SaaS and services, a common structure is the total fees paid in the 12 months before the claim. Some contracts use a multiple of fees, or the greater of fees paid and a fixed floor. Sensitive risks like data breaches and IP infringement are often given a higher "super-cap."

How is a limitation of liability cap calculated? Most SaaS and services caps use the fees the customer paid in a look-back window, usually the 12 months before the claim. Other structures use a fixed dollar amount, a multiple of fees (2x to 3x), total contract value, or the greater of a fee figure and the vendor's available insurance proceeds.

Can you limit liability for gross negligence or fraud? Not reliably. California's Civil Code 1668 declares contracts that exempt a party from its own fraud or willful injury against public policy, and New York's Court of Appeals will not enforce a limitation of damages against grossly negligent conduct (Sommer). Other states differ, and we did not verify them. Because the cap may fail for these anyway, it is common to carve them out explicitly.

Is a limitation of liability clause enforceable? Often yes, between sophisticated businesses, when the language is clear and the cap is not unconscionable. Some courts refuse to enforce it against fraud, willful misconduct or gross negligence, UCC 2-719(3) treats a limit on personal-injury damages for consumer goods as prima facie unconscionable, and statutes can override it. Enforceability turns on the governing law and the facts of the deal.

What is the difference between the damages exclusion and the cap? The exclusion removes categories of damages (you cannot recover lost profits at all). The cap sets a maximum dollar amount on the damages that are still recoverable. They are separate limits and should be negotiated separately.

What is a super-cap? A super-cap is a higher, separate liability ceiling for specific high-risk obligations (commonly data breaches and IP infringement) while ordinary claims stay at the general fees-based cap. It is the standard compromise between "uncapped" and "capped at fees."

Should the indemnity be inside or outside the cap? The indemnified party wants it outside the cap, otherwise the indemnity is limited to fees paid and provides little protection. The standard compromise is to put indemnification outside the general cap but subject to a negotiated super-cap.

Should a limitation of liability clause be mutual? Usually yes. A mutual cap is easier to defend as reasonable and harder to attack as one-sided overreaching. Parties often make the general cap mutual while leaving certain carve-outs, such as a vendor's IP indemnity, running one direction only.

How long do you have to bring a claim under a limitation of liability clause? Some contracts add a survival or limitation-period clause requiring claims to be filed within a fixed period, such as 12 to 24 months, after they arise. For sales of goods, the uniform text of UCC 2-725 lets the parties shorten the period to as little as one year, though states vary (Texas, for example, voids contractual periods under two years in many contracts). Miss a valid window and the claim is barred no matter what the cap says.

Arshita Anand

Co-Founder & CEO · Attorney

Arshita leads product and strategy at Vaquill AI, the US primary law data API. As an attorney, she decides which law we carry, how each section is sourced and cited, and what legal AI and compliance teams need from the data.