Where the Cap Ends: Uncapped Liability & Indemnification

Every commercial contract carries uncapped exposure. All of them. The limitation-of-liability clause is a negotiated allocation of contract damages between the two signing parties — it was never a ceiling on what a company can lose. Exposure escapes the cap through five doors: liabilities the law refuses to let anyone cap; carve-outs both sides deliberately negotiated out of the cap; claims from people who never signed the contract; indemnities backed by counterparties who cannot pay them; and caps that fail when actually litigated.

So the intelligent board question is never "do we have uncapped liability?" — the answer is always yes. It is "which categories are uncapped, what is the realistic magnitude of each, and is each one insured, carved down, or consciously retained?" A company that can produce that map is managing the risk. A company pointing at the cap clause is not.

The exposure map

Each row is a distinct mechanism by which liability escapes the cap, and each gets a section below.

1. Liabilities the law refuses to let you cap

Start with why nearly every limitation-of-liability clause opens with the same incantation:

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, in no event shall either party's aggregate liability arising out of or related to this agreement exceed…

That preface is a savings clause, and it exists because the drafter knows the cap is partially unenforceable the day it is signed. Certain liabilities cannot be capped as a matter of statute, regulation, or common-law public policy, and a cap that purports to reach them risks being struck down in its entirety in some courts. The savings clause invites the court to trim the clause to its lawful maximum instead of voiding it — a pre-negotiated concession that the cap has holes, written by the party who wants the cap.

The recurring uncappable categories:

• Fraud and intentional misconduct. No U.S. jurisdiction lets a party contract out of its own fraud. California codifies it bluntly: contracts exempting anyone from responsibility for "fraud, or willful injury to the person or property of another, or violation of law" are against public policy. (Cal. Civ. Code § 1668.)
• Gross negligence and willful misconduct. Most states — including New York, the dominant choice of law for commercial contracts — refuse to enforce exculpatory or limitation clauses against grossly negligent conduct, no matter how sophisticated the parties. (Kalisch-Jarcho, Inc. v. City of New York, 58 N.Y.2d 377 (1983); Sommer v. Federal Signal Corp., 79 N.Y.2d 540 (1992); Abacus Fed. Sav. Bank v. ADT Sec. Servs., 18 N.Y.3d 675 (2012).) California extends the rule to releases of future gross negligence. (City of Santa Barbara v. Superior Court, 41 Cal. 4th 747 (2007).)
• Personal injury in consumer transactions. Under the UCC, limiting consequential damages for injury to the person in consumer-goods cases is prima facie unconscionable. (UCC § 2-719(3).)
• Anti-indemnity statutes in specific industries. Most states have statutes voiding indemnity (and often the coupled liability-shifting) for the indemnitee's own negligence in construction contracts; Texas, Louisiana, New Mexico, and Wyoming do the same for oilfield agreements. (E.g., Tex. Ins. Code ch. 151; Tex. Civ. Prac. & Rem. Code ch. 127; La. R.S. 9:2780.) If the company operates in a regulated vertical, assume a statute may be editing its contracts.
• Statutory and regulatory liability. Securities claims, antitrust, employment statutes, consumer-protection acts, and civil penalties generally cannot be waived or capped by private agreement — many statutes void anticipatory waivers outright.

Board translation. This class is why "we have a cap in every contract" is never a complete answer. The cap does not and cannot cover the company's worst conduct — and that is by design of the legal system, not a drafting failure. The mitigation for Class 1 is operational: controls that prevent gross-negligence and fraud findings, plus insurance for what controls miss.

2. Carve-outs: the holes the parties punched on purpose

This is the class most people forget when they picture a "capped" agreement. Even where the law would permit a cap, sophisticated parties negotiate exclusions from it — and the market-standard carve-out list is long. A typical enterprise agreement caps general contract damages and then expressly uncaps some or all of:

• Indemnification obligations — especially IP-infringement and third-party-claim indemnities (the logic: the indemnitor controls the risk, and the indemnitee's exposure to the third party is itself uncapped — see Class 3);
• Breach of confidentiality;
• Data-security and privacy breaches — increasingly moved to a super-cap (a separate, higher ceiling, commonly 2–5× the general cap or a fixed dollar amount) rather than fully uncapped;
• Gross negligence, willful misconduct, fraud — restating Class 1 in the contract so the whole clause is not jeopardized;
• Bodily injury, death, and damage to tangible property;
• Payment obligations — fees owed are a debt, not damages, and sit outside the cap;
• Misappropriation or misuse of the other party's intellectual property beyond the license granted.

The consequence: a fully negotiated, market-standard "capped" contract has multiple deliberately uncapped lanes. When the board asks about uncapped liability, the honest inventory is the carve-out list across the contract portfolio — not the cap number. Two portfolios with identical caps can carry wildly different risk depending on whose indemnities are carved out and how broadly.

Negotiation posture. Each side pushes its own asymmetry: vendors try to cap everything and carve out only the customer's payment obligations; customers try to uncap the vendor's indemnities, confidentiality, and data breach. The mature middle ground is super-caps — a bigger number instead of no number — and insurance sized to the super-cap. Track the carve-outs as a portfolio metric; the general cap is the least interesting term in the clause.

3. The cap binds only the people who signed it

A limitation of liability is a contract term, and contract terms bind the contracting parties. Nobody else agreed to anything:

• Third-party tort claimants. A person injured by the product, the premises, or the joint conduct of the parties sues in tort, unconstrained by any cap in the commercial agreement. The contract cannot shrink the claim — it can only decide which party ultimately funds it, via indemnification.
• Regulators and the government. FTC actions, state attorneys general, privacy fines, HIPAA penalties, tax liabilities — none are touched by a private cap. Worse, indemnification for one's own civil fines and penalties is of doubtful enforceability in many jurisdictions on public-policy grounds, so even the routing mechanism is unreliable here.
• Class actions. A breach affecting the counterparty's customers (a data breach is the canonical case) generates claims from thousands of non-parties. The cap in the B2B agreement governs only the between-the-parties reallocation of that mass exposure.

This class is the reason indemnification clauses exist at all. Since third-party exposure cannot be capped away, the parties instead assign it: one party promises to defend, indemnify, and hold the other harmless against third-party claims proximately arising from the relationship. Which leads directly to the question of whether that promise is worth anything.

4. The paper indemnity: an uncapped promise from a shallow pocket

An indemnity is only as good as the balance sheet — and the insurance — behind it. If a small or thinly capitalized counterparty indemnifies you against a class of loss that could run to eight figures, the contract term is economically irrelevant: when the loss lands, the indemnitor is insolvent, the indemnity is an unsecured claim in a bankruptcy, and the liability boomerangs back to the party with assets (which, to plaintiffs, is whichever party has them). This is the practicability problem: the drafting can be perfect and the risk transfer still fictional.

The standard machinery for making an indemnity real:

Insurance requirements

• Specified coverage and limits — commercial general liability, technology E&O / professional liability, cyber, umbrella/excess, workers' compensation as applicable — with per-occurrence and aggregate minimums sized to the plausible loss, not to a boilerplate number.
• Additional-insured status for your company on the counterparty's CGL (and often auto/umbrella), via endorsement — giving you direct rights against their carrier rather than a contract claim against them.
• Primary and non-contributory language, so their policy pays before yours, and a waiver of subrogation, so their carrier cannot pay and then sue you.
• Endorsements, not certificates. A certificate of insurance is an informational snapshot that confers no rights and typically disclaims itself. Additional-insured status exists only if the policy is actually endorsed; sophisticated counterparties demand the endorsement copy.
• The "insured contract" trap. Liability policies generally exclude liability assumed by contract, then carve back coverage for an "insured contract." Whether the indemnity you negotiated fits the carve-back is a coverage question worth asking before relying on the indemnity — an indemnity the indemnitor's own policy excludes is a paper indemnity with extra steps.
• Notice of cancellation and annual re-certification, because coverage that lapsed quietly eighteen months ago protects no one.

Beyond insurance

• Parent or affiliate guarantees when contracting with a thin subsidiary of a solvent group;
• Escrows or holdbacks for identified, bounded risks;
• Financial covenants or minimum-net-worth requirements in long-lived, high-exposure relationships.

The cut against yourself. This class runs both directions. If your company is the small party giving an uncapped indemnity to an enterprise customer, the enterprise's diligence question — "can they actually fund this?" — is your board's question too: the company has promised away exposure it may not survive, and its E&O/cyber tower is the real cap on that promise. The carve-out list from Class 2 plus the insurance tower is the true statement of what the company has retained.

5. Caps that fail on contact with litigation

Even a lawful, mutually negotiated cap can fail when tested:

• Failure of essential purpose. If an exclusive limited remedy (repair/replace, re-performance) fails of its essential purpose, UCC § 2-719(2) opens the door to all Code remedies — and courts split on whether the consequential-damages exclusion and cap survive independently or fall with the failed remedy. Drafting the cap and the remedy as expressly independent clauses matters.
• Unconscionability and public policy, mostly in consumer, employment, and adhesion contexts — rarely fatal between sophisticated commercial parties, but live wherever bargaining power is lopsided.
• Choice of law changes the answer. Whether gross negligence voids a cap, whether fines are indemnifiable, whether an anti-indemnity statute applies — all vary by state. A cap negotiated under New York assumptions can behave differently under the law a court actually applies.
• Drafting defects. Caps are read narrowly against the drafter: courts have held caps inapplicable to indemnity claims, to tort claims, or to claims "arising outside" the agreement when the clause did not clearly reach them. Conspicuousness requirements (bold, capitals) apply to warranty disclaimers and, in some states, to consequential-damages waivers.

Mechanics that mislead the reader

• The cap and the consequential-damages waiver are different clauses. The waiver excludes categories of damages (lost profits, lost data, indirect damages) entirely; the cap limits the amount of what remains. Losing one does not lose the other — and boards routinely conflate them.
• "Fees paid in the trailing 12 months" is a common cap basket that can be near zero early in a relationship — a cap of almost nothing, which cuts for you as vendor and against you as customer.
• Per-claim vs. aggregate caps, and whether defense costs erode the cap, quietly change exposure by multiples.

Answering the board

When the question comes — "do any of our contracts have unlimited liability?" — the credible answer has three moves:

1. Reset the premise. All of them do, structurally, and so do our counterparties' — the law caps nothing it considers culpable (Class 1), the market carves out the rest (Class 2), and non-parties were never bound (Class 3). "Unlimited liability exists" is the beginning of the analysis, not a red flag.
2. Show the map. For the material contracts: what is the general cap, what is carved out, what super-caps apply, which indemnities run in and out, and what insurance stands behind each promise — theirs and ours.
3. Name the real ceiling. In practice the company's effective liability cap is its insurance tower plus its net assets. Contract caps shape who pays first and how much can be recovered from whom; the insurance program is the instrument that actually bounds enterprise risk. If the two are sized independently of each other, that is the finding to bring back to the board.

A practitioner's primer on U.S. commercial contract practice. General information, not legal advice; state law varies materially and the authorities cited are illustrative, not exhaustive. Insurance and coverage questions warrant review by coverage counsel or a broker against the actual policy forms.