Force majeure in IT industry-standard terms and conditions

If a customer of an IT service has suffered loss or damage as a result of a failure in the performance of the contract, a customer may hold the relevant IT service provider liable.

For example, a SaaS service may be taken offline for an excessively long period due to a DDoS attack and, as a result, be unavailable to the customer’s own clients. This causes the customer to suffer loss and, if there is a ‘breach of contract’, they may hold the IT service provider liable. The law stipulates the following in this regard:

Article 6:74(1) of the Dutch Civil Code:
Any failure to perform an obligation obliges the debtor to compensate the creditor for the loss suffered as a result, unless the failure to perform cannot be attributed to the debtor.

 

The requirements for liability for compensation for damage are:

1. Failure to perform an obligation (breach of contract, “wanprestatie”);
2. Damage;
3. Condicio sine qua non relationship (the causal link between the event giving rise to liability and the damage);
4. Default (“verzuim”) or permanent impossibility of performance; and
5. Attributability.

Regarding 4) Default, see also:

Obligations of the IT supplier: Result or best efforts?

A customer seeking compensation for their loss must allege points 1 to 4 and also bears the burden of proof (“bewijslast”) in the event of a substantiated challenge by the IT service provider to the alleged failure to perform.
If the customer has suffered damages, this does not necessarily mean that there has been a failure to perform by the IT service provider. Please see an example of a judgement dated 10 May 2023 concerning damages suffered by the municipality of Hof van Twente as a result of ransomware:

ECLI:NL:RBOVE:2023:1731

The customer does not need to establish 5) attributability within the framework of the factual basis (Article 24 of the Code of Civil Procedure). This is, as it were, granted to the customer as a matter of course. If points 1 to 4 are satisfied, the customer’s case is established and the IT service provider is, in principle, liable for damage suffered as a result of the breach of contract.

If the IT service provider considers that force majeure prevented it from performing its obligations, the IT service provider must raise 5) attributability as an issue in the dispute between the parties; in this regard, the IT service provider bears the burden of pleading (“stelplicht”) and the burden of proof.

 

In summary

Article 6:74(1) is structured as a general rule with an exception (unless). This gives rise to a division of the burden of pleading and the burden of proof. The general rule and the ‘unless’ provision indicate that only an attributable failure to perform gives rise to an obligation to pay compensation.

 

Grounds for attribution

Article 6:75 of the Dutch Civil Code:
A failure to perform cannot be attributed to the debtor if it is not due to the debtor’s fault, nor otherwise for the debtor’s account by virtue of law, a juridical act or generally accepted principles.

Fault is present where the IT service provider referred to above can be blamed for the failure to perform. If there is no fault, the failure to perform may nevertheless be at the debtor’s risk on the basis of the law, a juridical act or generally accepted principles.

A failure cannot be attributed to the debtor if it:

1. is not due to the debtor’s fault, and;
2. is not otherwise for the debtor’s account by virtue of:
   1. law;
   2. juridical act; or
   3. generally accepted principles.

With regard to the law, under (a), particular reference should be made to provisions such as Article 6:76 of the Dutch Civil Code (liability for persons engaged in the performance of an obligation, “hulppersonen") and/or Article 6:77 of the Dutch Civil Code (liability for objects or equipment used in the performance of an obligation, “hulpzaken”). I shall not discuss this section (under (a)) further here.

2. b and c: Liability arising from debtor’s risk based on a juridical act or generally accepted principles

It is particularly in this area that provisions are included in contracts, terms and conditions of purchase and terms and conditions of delivery. In this respect, you could also reverse the order of b) juridical act or c) generally accepted principles.

This is because what, according to generally accepted principles, is the responsibility of the IT supplier is not always clear in advance and may also change over time. See also:

What can you expect from an IT supplier?

Generally accepted principles may mean that the failure is at the IT supplier’s expense and risk, such as in situations that were foreseeable or should have been foreseeable at the time the contract was entered into.

DDoS attack = force majeure?

The first DDoS attack is said to have taken place as early as 1974 on a local network at the University of Illinois. Back in the 1990s, websites would already go offline if the number of visits rose slightly above expectations. There were virtually no defence mechanisms against DDoS attacks at that time. Companies were thus hit hard by downtime.

And if, as a result, the customer is unable to access the IT service they have contracted and consequently suffers loss or damage, the process described above begins: the requirements for liability.
If the customer alleges the aforementioned points 1 to 4 and, where necessary, provides evidence, it is then up to the IT service provider to raise the issue of attributability. What, according to generally accepted principles, is for the account of the IT service provider is not always clear in advance, and so the IT service provider will seek to address this risk in advance.

 

Industry terms and conditions

An interesting approach is to examine when a particular risk has been addressed in the IT sector terms and conditions and to see what falls under the heading of ‘force majeure’ within the context of a ‘juridical act’:

Terms and Conditions	Year	Previous + or –
Fenit terms and conditions	1994	1. a non-attributable failure on the part of the Supplier’s suppliers.
Fenit terms and conditions	2003	1. a situation of force majeure for the Supplier’s suppliers; 2. improper performance of obligations by suppliers prescribed by the Customer for the Supplier; 3. defects in objects, materials or software of third parties which the Customer has required the Supplier to use.
ICT~Office	2008	3. the defectiveness of items, hardware, software or materials provided by third parties that the Supplier has been instructed to use by the Client 4. government measures, 5. electricity failure, 6. faults affecting the internet, computer network or telecommunication facilities, 7. war, 8. workload, 9. strike action, 10. general transport problems; and 11. the unavailability of one or more members of staff.
Nederland ICT	2014	''''
NL Digital	2020	7. war, 8. workload, 9. strike action, 11. the unavailability of one or more members of staff, 12. (cyber)crime, (cyber)vandalism, war or terrorism
NL Digital Terms and Conditions	2025	3. defects in goods, hardware, software or materials of third parties that supplier uses on client’s instructions, 4. measures by public authorities, including import and trade restrictions 5. fire, power failure, 6. failure of the digital infrastructure, the internet, computer networks or telecommunications facilities, 7. strikes or a pandemic, 11. general transport problems

As you can see above, IT service providers who entered into contracts in 2020 on the basis of NL Digital could invoke force majeure in the event of a DDoS attack if they wished to raise the issue of attributability via the juridical act provision (sub-clause b). From this perspective, a DDoS attack falls under the category of (cyber)crime.

It is also worth noting that, under the 2025 terms and conditions, certain topics have found their way back into the list of what constitutes force majeure on the part of the Supplier.

 

Force Majeure and General Terms and Conditions

Even if you have agreed that a failure to perform resulting from a DDoS attack cannot be attributed to the IT service provider, the outcome is still not certain.

Whether a claim based on this will succeed is a question that falls primarily within the scope of the limiting effect of reasonableness and fairness (Article 6:248(2) of the Dutch Civil Code).

A rule applicable between the parties by virtue of the contract does not apply insofar as this would be unacceptable in the given circumstances according to the standards of reasonableness and fairness. Invoking this force majeure clause may, at the time the IT service provider invokes it, have such unreasonable consequences for the customer that the clause – which may be reasonable in itself – is not reasonable in the specific circumstances of the case and is therefore set aside.

The situation is different if the clause is already unreasonable in itself at the time the contract is concluded. If the general term in question (force majeure clause) is deemed to be unreasonably onerous (assessment of general terms and conditions on the basis of Article 6:233(a) of the Dutch Civil Code), then that clause is in itself already unreasonably onerous; it is invalid from the outset and is set aside with retroactive effect.

Conclusion

If, as an IT service provider, you use industry-standard terms and conditions, be aware that clauses such as the force majeure clause evolve over time and that it is advisable either to always use the latest version or to use your own terms and conditions and keep them up to date.
2014: Avoid legacy issues with standard documents: General Terms and Conditions require regular updating

 

Advice

Would you like to make use of our ready-to-hand expertise and contact us on a regular basis? Take out a subscription to the Virtual Legal Department. Please email me directly and you will receive the terms and conditions with no obligation.
Want to know more? Feel free to call or email:

T. +31(0)70-3819281
E. info@wisemen.nl

To stay up to date with the latest developments, sign up now for the

Wisemen News Flash