Force majeure

Article 1218 of the French Civil Code, for contracts concluded since October 1, 2016: force majeure exists where an event beyond the debtor's control, which could not reasonably have been foreseen when the contract was concluded and whose effects cannot be avoided by appropriate measures, prevents performance of the obligation, and the debtor is then released. The text keeps two of the three classic conditions. The event was unforeseeable when the contract was concluded. It was irresistible, meaning its effects could not be avoided. The third, externality, gives way to an event beyond the debtor's control: an internal strike or a failure of the debtor's own system can therefore come within scope, where the externality requirement kept it out. If the conditions hold, non-performance is not a fault and liability falls away. Force majeure is a contract law concept, distinct from insurance, but the two sit close together: a provider released from liability toward its client means the risk changes hands and the chain of recoveries, subrogated ones included, gets redrawn. Applied to cyberattacks, the notion is contested. An attack of exceptional scale might qualify. Courts, though, tend to treat cyber risk as widely known and foreseeable by now, so it struggles with the unforeseeability test, and an organization is expected to protect itself. That puts the weight on contract clauses that define force majeure precisely, since they are what allocates digital liability among providers, clients and insurers.