An unforeseeable, irresistible and external event that releases a debtor from contractual liability, a notion debated for cyberattacks.
Force majeure is an event that, meeting certain characteristics, releases a debtor from liability when it prevents them from performing their obligation. In French law, it classically requires the combination of three conditions, the unforeseeability of the event at the conclusion of the contract, its irresistibility, that is, the impossibility of avoiding its effects, and its externality to the debtor. When these conditions are met, the non-performance is not a fault and liability is set aside. Force majeure belongs to contract law and is distinct from insurance, but the two are closely connected, because an event characterized as force majeure can release a provider from liability toward its client, thereby altering the allocation of risks and the chain of recoveries, notably subrogated ones. The application of this notion to cyberattacks is debated. While some attacks of exceptional scale might claim this characterization, courts tend to consider that cyber risk, now widely known and foreseeable, no longer easily meets the condition of unforeseeability, and that an organization is expected to guard against it. Contractual clauses defining force majeure precisely therefore become a major issue in the allocation of digital responsibilities among providers, clients and insurers.
An IT provider, paralyzed by a cyberattack, invokes force majeure to release itself from its commitments to its clients. They contest this, arguing that an attack was foreseeable and that the provider should have protected itself against it, which rules out the characterization.
force majeure, cas de force majeure, act of God