Limitation of liability in RISE.

The limitation of liability clause inside the RISE with SAP contract reads as a routine commercial paragraph. The clause caps the SAP exposure at a multiple of the prior twelve months of fees and excludes indirect damages. The clause is reproduced in almost every cloud subscription contract on the market. What distinguishes the RISE version from the rest is the combination of the cap formula, the carve out structure, the data breach handling, and the interaction with the bundled hyperscaler. The combination determines whether the buyer has a meaningful recovery path in the worst case scenarios. This article walks the clause line by line and identifies the moves that the buyer side legal team should run before the signature.

The cap formula and what it implies

The standard RISE cap is set at the fees paid in the twelve months immediately preceding the event giving rise to the claim. The formula sounds neutral, but it produces specific outcomes against specific scenarios. A breach event in year one of a seven year contract caps the recovery at one seventh of the contract value. A breach event in a low fee year caps the recovery at a fraction of the contract value. A breach event tied to a specific subscription line caps the recovery at the fees attributable to that line, not at the aggregate fees across the contract.

The cap formula systematically understates the buyer exposure on the deals where the buyer is most exposed. A buyer running mission critical workloads through RISE is exposed to operational losses that are orders of magnitude larger than the annual subscription fee. A cap calculated against the annual fee delivers a recovery that does not approach the operational loss. The disproportion is the structural property of the cloud subscription liability model, and the cap formula is the mechanism through which the disproportion is encoded.

The buyer counter is to negotiate the cap upward from the standard formula. A common buyer ask is two times the annual fee, with the multiple scaling against the severity. A more aggressive ask is the aggregate fees paid across the contract term to date, with the cap rising as the relationship matures. The most defensible ask is a separate, higher cap for the carve out categories, with the standard cap retained for the routine claims. The negotiation is rarely won at the cover position, but it is consistently moved past the standard template.

The carve outs that matter

The standard RISE clause carves out certain categories of claim from the cap. The carve outs typically cover gross negligence, wilful misconduct, breach of confidentiality, breach of data protection obligations, and indemnification obligations for third party intellectual property claims. The carve out list is the structural property of the clause that the buyer should examine most carefully, because the carve outs determine which categories of claim retain a meaningful recovery path.

The data breach carve out is the carve out that matters most in practice. The standard RISE template carves out the data breach claims, but the carve out is conditional on the breach being attributable to the SAP gross negligence. The conditional reduces the carve out to a narrow set of facts. A data breach attributable to the SAP ordinary negligence falls inside the cap. A data breach attributable to the SAP sub processor falls inside a separate clause that may carry its own cap. The buyer who is exposed to material data protection liability should not accept the conditional carve out without renegotiation.

The buyer counter is to negotiate the data breach carve out unconditionally, with the carve out applying to any breach of the data protection obligations regardless of the underlying SAP fault classification. The unconditional carve out converts the data breach exposure into a separate liability category with no cap, or with a substantially higher cap, against which the buyer can recover the regulatory fines, the notification costs, and the third party claims that follow a breach. The unconditional carve out is the single most consequential move on the clause for buyers in regulated industries.

Indirect and consequential damages

The standard RISE clause excludes indirect, consequential, special, punitive, and incidental damages. The exclusion is reproduced in almost every cloud subscription contract on the market, and the buyer who attempts to remove the exclusion in its entirety is rarely successful. The buyer who attempts to remove specific categories of damage from the exclusion is more often successful, and the targeted removal is the negotiation pattern that the firm runs.

The targeted removal focuses on the categories of damage that the buyer is most likely to suffer. Lost profits is the category that the buyer is most likely to need recovery against, and lost profits is the category that the standard exclusion most clearly removes. A buyer running a revenue generating workload through RISE has an operational loss profile that the lost profits category is designed to capture, and the exclusion of that category removes the meaningful recovery against the operational loss. The buyer counter is to remove lost profits from the exclusion list, or to convert the lost profits exclusion into a carve out against the higher cap.

The second targeted removal is the cost of substitute services category. A buyer who cannot operate through RISE during an extended outage has to procure substitute services to maintain operations. The cost of the substitute services is excluded by the standard clause. The buyer counter is to remove the substitute services category from the exclusion, with the recovery available against the cost of the alternate provision during the SAP outage period. The substitute services move is less aggressive than the lost profits move and lands more frequently.

The hyperscaler interaction

The RISE subscription embeds a hyperscaler relationship inside the SAP contract. The buyer has no direct contractual relationship with the hyperscaler. The hyperscaler is a sub processor of SAP, and the SAP contract is the only path through which the buyer can recover against a hyperscaler caused incident. The single path is the structural property of the bundled relationship, and the property has specific implications for the limitation of liability clause.

The standard RISE clause flows the SAP cap formula through to the hyperscaler caused claims. A buyer who suffers an operational loss caused by the underlying hyperscaler recovers from SAP at the SAP cap, not from the hyperscaler at the hyperscaler cap. The flow through means that the buyer is structurally worse off on a hyperscaler caused incident inside RISE than on a hyperscaler caused incident inside a direct hyperscaler contract, because the direct hyperscaler contract may carry different liability terms and a different cap formula.

The buyer counter is to require SAP to maintain back to back liability terms with the underlying hyperscaler, with the buyer recovery preserved against the hyperscaler cap when the underlying cause is hyperscaler. The back to back requirement is hard to negotiate fully, but the partial form, in which SAP acknowledges that the hyperscaler caused incidents may benefit from a higher recovery position, is achievable in roughly one third of the deals.

Indemnification and the IP carve out

The standard RISE clause carves out the SAP indemnification obligations from the cap. The carve out covers the SAP defence of the buyer against third party intellectual property claims arising from the buyer use of the RISE software. The carve out is broadly favourable to the buyer, but the indemnification clause itself contains conditions that limit the operational value of the protection.

The standard indemnification is conditional on the buyer using the RISE software in accordance with the documentation, on the buyer not modifying the software, and on the buyer notifying SAP of the claim within a defined notice period. The conditions are individually reasonable, but they create a narrow corridor inside which the indemnification operates. A buyer who runs RISE inside a complex landscape with custom code extensions, with third party integrations, and with operational variances from the documentation may find that the indemnification corridor does not cover the actual claim profile.

The buyer counter is to broaden the corridor by removing the most restrictive conditions, with the indemnification preserved across reasonable buyer use rather than narrow documented use. The broadening typically focuses on the modification condition and the integration condition, with the conditions softened to permit the operational reality. The broadening is a routine negotiation move and lands in roughly half of the deals.

The negotiation playbook in summary

The limitation of liability clause has five recurring negotiation moves. First, raise the cap multiple above the standard twelve months of fees. Second, convert the data breach carve out from conditional to unconditional. Third, remove the lost profits category or convert it into a carve out against the higher cap. Four, require back to back liability terms with the underlying hyperscaler. Five, broaden the indemnification corridor by removing the most restrictive conditions. The combined yield is a meaningfully stronger liability position than the standard template, and the combined yield is the property that distinguishes the deals that close with operational defensibility from the deals that close with cover page protection only.

Closing position. Liability is the silent term

The limitation of liability clause sits in the back third of the RISE contract and rarely attracts the attention that the pricing schedule attracts at the deal table. The clause is the property that determines what the buyer can recover when the worst case happens, and the worst case is the case that the contract has to protect against. The buyer who accepts the standard clause accepts the standard exposure. The buyer who runs the five moves materially reduces the exposure across the seven year term. The clause is silent during the routine operations and dominant during the exceptional events. The discipline of negotiating the silent term is the discipline that distinguishes the strategic RISE buyers from the tactical ones, and it is the discipline that the senior legal teams consistently apply.