---
title: "Do the Applicant's client contracts contain limitation of liability clauses benefiting the Applicant?"
url: https://insuranceposture.com/questions/services-and-contracts/applicant-s-client-contracts-contain-limitation-liability-clauses-benefiting
category: "Services and contracts"
canonical_key: q_pro_008
evidence_state: attested
updated: 2026-08-24
---

# Do the Applicant's client contracts contain limitation of liability clauses benefiting the Applicant?

URL: https://insuranceposture.com/questions/services-and-contracts/applicant-s-client-contracts-contain-limitation-liability-clauses-benefiting
Section: Services and contracts
Evidence state: Attested, not tenant-verifiable

The liability cap is the single most consequential commercial term in a professional services contract, and the carve-outs are where it stops applying.

## What the carrier is actually asking

The carrier is asking whether your client contracts contain limitation of liability clauses that benefit you, typically capping liability at fees paid or a multiple of them.

## Why it is underwritten

The cap sets the ceiling on what a client can recover, which is the ceiling on the carrier's exposure per relationship. Contracts without caps, or with caps carved out for data breach, expose the full limit and beyond. Carriers price the contractual position because it determines their maximum loss per client.

## Where the answer lives in Microsoft 365, Entra ID, and Azure

This is a contract estate question, and the executed terms matter rather than the template.

| Platform | Where the setting lives | What has to be true |
| --- | --- | --- |
| Templates | Standard limitation clause and its cap basis | A cap expressed in a way that scales sensibly, such as fees paid in the preceding twelve months. Attested |
| Contract estate | What was actually agreed after negotiation with major clients | Executed caps, which frequently differ from the template |
| Carve-outs | Exceptions to the cap | Data breach, confidentiality, and indemnity carve-outs, which are where the cap stops applying |
| Uncapped | Contracts with no cap or an uncapped data liability | Identified and quantified against your policy limit |
| Enforceability | Whether caps are enforceable in the governing jurisdictions | Legal review, since some jurisdictions restrict limitation clauses |

**Data breach carve-outs are the standard ask**

Enterprise clients routinely negotiate the cap away for data breach specifically, which is exactly the loss your cyber policy is meant to cover. That carve-out converts a bounded exposure into an unbounded one for the loss most likely to occur.

## What a defensible yes requires

- Standard terms include a liability cap on a defensible basis.
- Executed contracts with major clients have been reviewed for what was actually agreed.
- Carve-outs are inventoried, particularly for data breach.
- Uncapped exposure is quantified and compared against the policy limit.
- Enforceability has been checked in the governing jurisdictions.

## How this answer goes wrong

The template caps liability at fees paid, and the three largest clients negotiated an uncapped data liability. Those three contracts represent most of the revenue and effectively all of the exposure, and nobody compared them against the limit.

## If this answer turns out to be wrong

Technology E&O questions describe what you promised your own clients, and the policy language decides how strictly your description of that is held. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [whether an answer is a warranty or a representation](https://insuranceposture.com/glossary/warranty). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary).

## Frequently asked

### What cap level is normal?

Fees paid in the preceding twelve months is the common baseline, with multiples negotiated upward for larger engagements. It varies widely by sector.

### What if a client demands unlimited data liability?

Price it, quantify it against your limit, and take the decision deliberately. Some organisations accept it commercially; the mistake is accepting it without noticing.

### Are caps always enforceable?

Not everywhere and not for every category. Some jurisdictions restrict limitation for certain conduct, so local advice matters.

### Does the cyber policy respond above the cap?

The cap limits what the client can recover from you. Where it is carved out, your exposure runs to the policy limit and beyond it.

## Related questions

- [Do the Applicant's client contracts exclude consequential damages in the Applicant's favor?](https://insuranceposture.com/questions/services-and-contracts/applicant-s-client-contracts-exclude-consequential-damages-applicant-s)
- [Does the Applicant use written contracts or agreements with its customers for the provision of services or products?](https://insuranceposture.com/questions/services-and-contracts/applicant-written-contracts-agreements-customers-provision-services-products)
- [Do written agreements with third parties contain defense/indemnification + insurance requirements?](https://insuranceposture.com/questions/third-parties/written-agreements-third-parties-contain-defense-indemnification-insurance-requirements)
- [Will the Applicant have an active Tech E&O / Professional Indemnity policy concurrent with this insurance?](https://insuranceposture.com/questions/business-profile/will-applicant-active-tech-e-o-professional-indemnity-policy)

---

Insurance Posture by SecValley. https://insuranceposture.com
The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished.
SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact.
Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.