When a customer demands unlimited liability: what it costs to be wrong

A customer's demand to remove your liability cap is not a negotiating tactic to ignore. It shifts every downstream loss — data breach costs, IP infringement claims, regulatory fines — onto your balance sheet without a ceiling. Before you sign, identify which loss category is actually unlimited, because each one runs under different rules and different deadlines.

What sits behind the demand

An uncapped clause rarely covers everything a term sheet calls "liability". It usually targets three loss categories that the customer's lawyer has already priced separately, long before the draft reached your desk. Each category sits under a different act, and each act sets a different starting point for when your exposure actually begins.

Customers are pushing harder on this point for reasons that have little to do with your specific contract. Regulatory duties around software, security and artificial intelligence have expanded in recent years. A customer that is itself exposed to a regulator will often try to pass that exposure down the supply chain through the liability clause, rather than through a separate indemnity that would need its own negotiation. Reading the clause in isolation, without asking which category it is meant to cover, is how vendors sign away more than either side intended.

Directive 2009/24/EC protects computer programs as literary works and sets out what counts as an infringing act, including unauthorised reproduction and adaptation. It gives the legal basis for the infringement claim itself. It does not set the size of the contractual cap that sits around that claim — that remains a matter for the contract, not the directive.

Directive (EU) 2022/2555 (NIS2) sets security and incident-reporting duties for entities within its scope. If your customer falls within that scope, the moment it must notify a regulator can determine the moment your own liability window opens, because the notification becomes evidence of when the loss was known.

Regulation (EU) 2024/1689 (AI Act) adds a further layer once its obligations start to apply from 2 August 2026 (status verified 9 June 2025). A customer negotiating a contract today, for a system that will still be running after that date, may already be pricing the later obligations into the clause it is asking you to sign now.

What changes in practice

An unlimited cap changes three things about your position, and none of them is obvious from the clause text alone.

First, it removes the ceiling your insurer priced the policy against. Most professional indemnity and cyber policies are underwritten against a stated contractual cap. Remove the cap, and the policy may respond only up to its own limit, leaving the gap between that limit and the actual loss uninsured.

Second, it removes the customer's incentive to mitigate its own loss. A capped counterparty still has a reason to contain the damage, because anything above the cap is its own cost. An uncapped counterparty has less reason to stop the loss from growing.

Third, it moves the real negotiation away from the headline number and into every exclusion sitting around it — gross negligence, wilful default, and IP indemnities in particular. Read the exclusions before you read the figure. A generous cap next to an unlimited carve-out for IP infringement is, in practical terms, no cap at all for that category.

What to do

1. Ask your contract owner to list every carve-out already drafted into the clause, not only the headline cap figure.
2. Ask your insurer, in writing, which of those carve-outs currently sit inside your policy's stated limit and which do not.
3. Split the demand by loss category — infringement, security incident, AI component, general breach — and respond to each separately.
4. Set a distinct response deadline for each category, rather than one deadline for the clause as a whole.
5. Escalate to whoever holds signing authority before any concession is made verbally or in a redline comment.
6. Record the date the demand was made and the date your response was sent; both dates matter later if the deal proceeds.

Who decides

The forum is whichever one your contract already names — a specified court, or an arbitral tribunal under the rules the parties chose when the contract was signed. Neither forum rules on the cap figure in isolation.

Both decide on the loss actually suffered, on which exclusions survived the final negotiation, and on the evidence of what each party understood when it signed. A clause that reads as unlimited on paper can still be read narrowly if the surrounding correspondence shows the parties intended a lower figure. Invoices, notice letters and dated emails carry more weight in that reading than the clause text alone.

The deadline already running is rarely the negotiation deadline. It is the notice period written into your existing contract for raising a dispute. That period starts from the date the loss became known, not from the date the unlimited clause was first demanded.

If you are in one of these situations

If the unlimited demand covers only IP infringement, your real exposure is bounded by what the customer can actually prove was copied, under Directive 2009/24/EC. That is a narrower dispute than an open-ended cap first suggests, and it usually turns on technical evidence rather than on the wording of the clause.

If the contract also licenses tokenised rights alongside the software, the same unlimited demand can surface differently — see When a smart contract conflicts with the written licence for how a coded term and a written clause can point in opposite directions on the same deal.

If the customer has already terminated for the alleged breach, the notice clock has already started, and the first task is establishing the termination date itself, before any argument about the cap.

If the deal spans more than one jurisdiction, the forum named in the contract may not be the only place a dispute can actually be brought. That question sits outside what a liability clause alone can answer, and it needs its own check before you rely on the named forum.

If you are the party asking for the removal of a cap you once accepted, expect the same three questions back from the other side: which category, which exclusions, and which deadline. The negotiation runs both ways.

What this page does not resolve

This page does not draft your cap, price your insurance gap, or state whether a specific exclusion is enforceable in your specific contract. Those answers depend on the document and the negotiation history in front of a lawyer, not on a general situation page.

Sources and limit

Checked and dated: 9 June 2025. The three acts named above are given by their official short form, and no article number is stated, because the applicable national implementing provision sits outside what this page covers.

Our method for collecting, cross-checking and dating the facts behind pages like this one is set out in Methodology: collection, cross-checking and dating and what to prepare.

Where the customer or the contracting counterparty is registered in Belgium, the underlying corporate facts about that party can be checked in more depth — see Counterparty in Belgium and its limits in detail.

Where the dispute turns on which version of the contract was actually signed and when, dated document verification for Belgium is covered separately in Document in Belgium and the deadline.

Related publications

A similar allocation problem arises when security terms arrive bundled into an order form after the commercial terms are already agreed — see When a security addendum arrives with the order form.

FAQ

What is the first step when a customer demands unlimited liability?

Separate the demand by loss category before responding at all. An IP carve-out, a security-incident carve-out and a general uncapped figure are three different negotiations. Answering them as one gives away more ground than either side intended, and it makes the later insurance conversation harder to have.

Which deadline is already running?

Usually the notice period already written into your existing contract, counted from the date the loss became known rather than from the date the unlimited clause was demanded. Check that date before you check the cap figure itself, because it will not wait for the negotiation to finish.

Who decides, and on what evidence?

The forum named in the contract — a specified court or an arbitral tribunal — decides on the loss actually suffered and on the exclusions that survived negotiation. The cap figure alone is rarely the deciding fact; the correspondence around it usually carries more weight than the clause itself.

— Rasa Tumenaite, AURELIS