Contractual liability exclusion

A liability policy covers the obligation to pay damages that the law places on the insured when it causes harm. It is not meant to cover commitments the insured chose to make by contract that go further: a fixed penalty clause, a waived liability cap, indemnification for all consequences of an incident whatever the cause, an availability guarantee with service credits. Without this exclusion, the insured could increase its insurer's commitment at will by negotiating with its customers. The exclusion usually includes an essential exception: it does not apply to liability the insured would have incurred even without the contract. In cyber policies, it often carries further carve-backs, for confidentiality obligations, for penalties owed to payment card networks, or for data-related indemnity clauses. For an IT provider, whose customer contracts contain heavy service commitments, this is the clause that decides whether the policy is of use: a contract transferring the customer's entire cyber risk to the provider can create an exposure far beyond what insurance will cover. Reviewing one's contracts against one's policy is the first risk management step.