Exclusion clause

An exclusion clause is a provision that expressly removes from the scope of cover certain risks, events or circumstances that would otherwise be covered by the general conditions. It is an essential tool for defining the scope of cover, allowing the insurer to set aside risks that are uninsurable, too volatile, already covered elsewhere or contrary to public policy, such as the insured's wilful misconduct. In law, exclusions are construed strictly and must be formal and limited, meaning drafted unambiguously and without hollowing out the cover, failing which a court may set them aside. This requirement of clarity is precisely the ground of the most frequent disputes, since a poorly drafted or overly broad exclusion is regularly invalidated. In cyber insurance, exclusions strongly shape the cover, whether the exclusion of acts of war, of infrastructure failures, or of bodily injury and property damage falling under other lines. The insured must read the exclusions with as much attention as the covers, because they determine what will actually remain at its own expense in the event of a loss.

A cyber insurer includes an exclusion for a known vulnerability left unpatched for more than forty-five days. When a loss is caused by exploitation of Log4Shell, the underwriter establishes that the insured had received the official alert two months before the attack without applying the patch: the exclusion applies and the 800,000-euro loss remains with the company, effectively transferring the patching incentive from insurer to insured.

exclusion de garantie, clause exclusive