Every commercial agreement worth signing has a limitation of liability section, and most negotiations treat it as a single fight over one number: the cap. That framing misses half the clause. A carefully constructed limitation of liability provision contains two separate limitations, not one, and the exceptions you negotiate apply to them independently. Confusing the two is one of the most common and most expensive drafting errors we see in commercial contracts.
This piece walks through the difference between a carveout from the cap and a carveout from the exclusion, why the distinction matters, and how to draft carveouts that actually deliver what you bargained for.
Two limitations, not one
A standard limitation of liability clause does two distinct things.
First, it excludes certain categories of damages. This is the consequential damages waiver: language stating that no party is liable for indirect, incidental, special, punitive, or consequential damages, often including lost profits, lost revenue, and lost data, regardless of the theory of liability. Call this the exclusion. It is a filter on the type of damages.
Second, it caps the total amount recoverable. This is the dollar limit: total aggregate liability shall not exceed the fees paid in the prior twelve months, a multiple of those fees, or a fixed sum. Call this the cap. It is a filter on the amount of damages.
These two filters operate in sequence. For a claim to produce a meaningful recovery, the damages have to survive both. They must be a permitted type, meaning not knocked out by the exclusion, and they must fall within the permitted amount, meaning under the cap. Miss either filter and the recovery shrinks or disappears.
Once you read the clause as two filters rather than one number, the carveout question becomes obvious: a carveout has to specify which filter it pierces.
What each carveout actually does
A carveout from the exclusion removes a matter from the first filter. For that matter, the excluded categories of damages become available again. If a breach of confidentiality is carved out of the exclusion, the injured party can recover consequential damages and lost profits arising from that breach, rather than being limited to direct damages.
A carveout from the cap removes a matter from the second filter. For that matter, liability can exceed the dollar limit, either without any ceiling or subject to a separate, higher ceiling. If indemnification is carved out of the cap, the indemnity can run past the twelve months of fees that would otherwise bound it.
These are different operations on different filters. Carving a matter out of the cap says nothing about whether consequential damages are available for it. Carving a matter out of the exclusion says nothing about whether liability for it can exceed the cap. That independence is the whole point, and it is exactly what gets lost when a clause is drafted carelessly.
Why one carveout alone is often hollow
The danger is granting a carveout that looks powerful and recovers almost nothing.
Suppose a customer negotiates hard and wins an uncapped carveout for breach of confidentiality. Liability for a breach of confidentiality is now unlimited, and the customer feels protected. But the exclusion remains untouched, and the real harm from a breach of confidentiality is almost always consequential: lost business, lost competitive position, lost profits. If those categories remain excluded, the customer has unlimited liability over a set of damages it cannot actually claim. The carveout is theater.
The reverse failure is just as common. A customer wins a carveout from the exclusion for a data security breach, so consequential damages and lost data claims are back on the table. But the cap still sits at twelve months of fees. On a modest subscription, that ceiling may be a tiny fraction of the actual exposure from a serious breach. The damages are now the right type, and still capped at a number that does not come close to covering the loss.
Each of these carveouts does real work only when paired with the right counterpart. That brings us to the matters that usually need both.
The matters that usually need both
Some categories of risk are meaningfully addressed only when they are carved out of the exclusion and the cap together. The usual candidates are indemnification obligations, intellectual property infringement, breach of confidentiality, data security and privacy violations, and fraud, gross negligence, or willful misconduct.
Indemnification is the clearest illustration. When a third party sues your customer, and the customer turns to you for indemnity, the third party claim against the customer may itself consist largely of consequential damages, measured from the customer’s standpoint. If your exclusion knocks out consequential damages and the indemnity is not carved out of it, the indemnity can be gutted precisely when it is needed. A sound indemnity, therefore, usually needs a carveout from the exclusion, so the indemnified amounts are recoverable, and a carveout from the cap, so a large third-party judgment is not squeezed under a fee-based ceiling. Treating the indemnity as a cap question alone is a frequent and serious miss.
A more surgical alternative: the tiered cap
Unlimited liability is not the only answer to a cap carveout. Many sophisticated agreements use tiered ceilings instead. The general cap might sit at twelve months of fees. A second tier, often a multiple of fees or a fixed amount, applies to data, privacy, intellectual property, and confidentiality matters. A third tier, typically uncapped, applies to fraud and willful misconduct. This lets each side calibrate exposure to the actual risk profile rather than choosing between a single low cap and unlimited liability. A tiered structure is simply a more precise way of carving certain matters out of the general cap, and it pairs naturally with targeted carveouts from the exclusion for the same items.
How to draft so the carveouts hold
The fix is structural and unglamorous. Avoid the phrase that causes most of the trouble, which is some version of “notwithstanding the foregoing, the limitations in this Section shall not apply to the following.” When a section contains both the exclusion and the cap, “the limitations in this Section” is ambiguous about which limitation is being pierced, and that ambiguity is what gets litigated.
Instead, give the clause clearly labeled subsections: one for the exclusion of damage types, one for the aggregate cap, one listing the exceptions to the exclusion, and one listing the exceptions to the cap. Then cross-reference by subsection, not by “the foregoing.” Each carveout should state plainly whether it applies to the exclusion, the cap, or both. For every item on a carveout list, ask two separate questions. Does this matter need consequential damages available? Does this matter need to exceed the dollar limit? The answers will not always match, and the drafting should reflect that the decisions are independent.
One last practical note: a carveout to unlimited liability is only as good as the counterparty’s ability to pay or to insure against it. When you are dealing with a lightly capitalized vendor, an uncapped carveout that no insurance backs may be worth less than a lower carveout that maps to real coverage. Carveouts should track the insurance program, not only the risk appetite.
The takeaway
The cap and the exclusion are two filters, and a claim has to clear both. A carveout that pierces only one of them leaves the other standing, which is why so many hard-won carveouts turn out to be hollow. Read every limitation of liability clause as two limitations. Negotiate each carveout against both. And draft so that anyone reading the clause later can tell, without argument, exactly which limitation each exception is meant to defeat.
