When a customer demands unlimited liability: what to do first
A customer's demand to remove your liability cap turns every operational fault into unlimited exposure, not exposure limited to the price paid or to available insurance. Before any redraft, three things need answers: which clause carries the demand, whether a response deadline is already running, and who inside your company can approve or reject an uncapped position. Do not counter-sign until that person has seen the exact wording.
Basis
No EU regulation sets or removes the liability cap between two commercial parties. Liability allocation is a matter of the contract and the law that governs it. Customers sometimes point to Directive (EU) 2022/2555 (NIS2) or Regulation (EU) 2024/1689 (AI Act) as though a security incident or an AI failure automatically triggers unbounded exposure. Neither instrument does that.
NIS2 sets security and incident-reporting duties for the entities it covers. It does not set a private-law standard of damages between supplier and customer. The AI Act sets conformity and risk-management duties for providers and deployers of AI systems. It does not displace the liability clause of a commercial contract. Directive 2009/24/EC protects the computer program and the licence to use it. It says nothing about the size of damages a licensor may owe if the program fails.
If a customer's legal team cites one of these instruments as the reason for an uncapped clause, ask them to point to the specific provision that does that. In most cases, none exists, and the demand rests on a template rather than on the law it names.
Practical consequence
An uncapped clause converts a small delivery fault into an unbounded claim. If the contract also carries broad indemnities or wide warranties, a single incident can reach the whole balance sheet, not the fee paid for the engagement. Insurance rarely extends above the policy limit, so the gap between the limit and the claim sits with the company.
The commercial effect is immediate even before any dispute arises. A signed uncapped clause changes how the deal is priced internally, how much insurance cover the finance team should hold, and how the deal is reported to the board.
What to do first
- Isolate the exact clause and send the verbatim wording to legal within one business day; the account manager, not the sales lead, is responsible for this step.
- Check for a response deadline in the order form, the cover email, or the redline comments; treat it as running from receipt, not from your acknowledgement.
- Route the clause to whoever the company's authorisation matrix assigns for uncapped financial exposure, usually the board or a risk committee.
- Draft a fallback cap tied to fees paid in the preceding twelve months, or to available insurance cover, whichever figure is higher.
- Ask the customer's negotiator what triggered the demand — a prior incident, a security review, or an unmodified template.
- Hold the mark-up until the internal approver has confirmed the fallback position in writing.
Who decides
Internally, the decision belongs to whoever the authorisation matrix assigns to uncapped exposure — the board, a risk committee, or, in a small company, the owner. A sales lead's approval does not bind the company on this point.
On the customer's side, the negotiator rarely has authority to accept a capped alternative alone. The demand usually has to travel back through the customer's legal or procurement function before a compromise is confirmed. Treat any verbal concession from a single negotiator as provisional until it appears in the redline.
| Signal | Likely meaning | First action |
|---|---|---|
| Clause added at the order-form stage, no discussion | Standard template, not a considered position | Ask for the rationale before drafting a counter |
| Clause follows a disclosed prior incident | Customer is pricing in a specific risk | Request the incident description and scope it precisely |
| Deadline stated in the email, short turnaround | Deal pressure, not legal urgency | Confirm the deadline in writing and hold your position |
| Demand tied to a security or AI compliance claim | Likely a misreading of a regulatory duty | Ask for the specific provision relied on |
Branches
- If the response deadline has already passed by the time legal sees the clause, treat it as not accepted and confirm in writing that the contract has not entered into force on those terms.
- If the demand follows a disclosed security incident, request the incident report before pricing any concession; a clause negotiated on an unclear incident is negotiated on incomplete information.
- If the contract also carries a tokenised licence term, the liability question sits next to a separate licence question: see When a token claims to carry a licence.
Limit
This page does not draft a liability clause, calculate an appropriate cap figure, or represent either side in the negotiation. It does not opine on any national law of damages, because that assessment depends on the governing-law clause, which this page has not reviewed.
If the demand traces to a doubt about the counterparty itself rather than the clause's wording, a due-diligence report answers the factual question this page cannot: see Counterparty in Lithuania and its limits and the deadline. If it traces to a specific document — a prior contract, an incident record, an insurance certificate — see Document in Lithuania and what to prepare.
Verified
Checked against Directive (EU) 2022/2555 (NIS2), Regulation (EU) 2024/1689 (AI Act), and Directive 2009/24/EC, current as of the date of publication of this page. This page does not track national contract law; verify the governing-law clause and the applicable national provisions on limitation of liability separately, with counsel qualified in that jurisdiction.
For how this site handles cookies and analytics, see Cookies and what is switched off by default overview.
Related reading
A parallel situation arises when security terms, rather than liability terms, arrive attached to the order form: see When a security addendum arrives with the order form.
FAQ
What is the first step when a customer demands unlimited liability?
Isolate the exact clause and send the verbatim wording to legal within one business day. Do not respond to the commercial team's redline until the clause has been reviewed on its own terms, separate from price or delivery schedule.
Which deadline is already running?
Check the order form, the cover email, and any redline comments for a stated response date. Treat that date as running from receipt of the document, not from your internal acknowledgement, and confirm it in writing to avoid a later dispute about timing.
Who decides, and on what evidence?
The decision belongs to whoever the company's authorisation matrix assigns to uncapped financial exposure — typically the board or a risk committee. The evidence needed is the exact clause wording, the stated rationale for the demand, and a fallback cap figure tied to fees or insurance cover.