The day
the inbox went silent
When court staff in
Britain start looking for fax machines and NHS clinicians fall back on paper
records, something more than an inbox has failed.
That was the scene on 13
November, as a Microsoft 365 disruption that began the previous day disrupted
access to Outlook and Exchange Online and affected features of Teams, Copilot
and other connected services.
Downdetector recorded reports from more than 70
countries and territories, while police forces, schools and courts were among
the public services caught up in the disruption.
Microsoft apologised,
said the incident was not related to a cyberattack or AI agents and, on 14
November, announced that it had restored service to the remaining affected
customers and regions, following more than a day of disruption.
The apology was
the right gesture. But an apology is not a remedy, and it does not answer the
question that boards, general counsel and public bodies are now asking: when a
cloud platform fails, who bears the loss?
The answer is less
obvious than it seems, because not everything failed at once.
Microsoft
initially classified the event as a service degradation, and its incident
updates confirmed that features not dependent on Exchange Online continued to
function.
Some core Teams functions remained operational, while files stored
directly in SharePoint Online remained accessible.
A widespread outage, in
other words, does not mean that every service, every customer or every
contractual availability commitment was affected in the same way. That is where
the contract, and the law that governs it, have the final say.
What Microsoft Said
Microsoft apologised
to customers and partners. In its public explanation, it attributed the
incident to an issue introduced during an earlier network-capacity upgrade,
which surfaced following a subsequent network change.
The company said the
incident was technical and unrelated to a cyberattack or AI agents, and
committed to publishing a full post-incident report once its investigation is
complete.
These statements set out Microsoft’s preliminary account of the
technical cause; they do not, by themselves, determine contractual liability.
An apology can
acknowledge disruption without necessarily constituting an admission of
contractual breach, independently establishing legal causation or creating an
entitlement to damages.
Those questions require examination of the relevant
agreement, the nature of the service commitments, the circumstances of the
failure and the law governing the contract.
What Research and Market Evidence Show
Academic research on
cloud contracting anticipated these questions more than a decade ago.
In Contracts
for Clouds (2011), Simon Bradshaw, Christopher Millard and Ian Walden of
Queen Mary University of London examined the standard terms and conditions of
cloud service providers, highlighting the contractual uncertainties and risks
facing customers.
A year later, Kuan Hon, Millard and Walden’s Negotiating
Cloud Contracts (2012) examined how customers sought to negotiate more
favourable terms, identifying provider liability, service-level agreements,
data protection, security and termination rights among the principal areas of
negotiation.
The economic stakes
are substantial. Uptime Institute’s Annual Outage Analysis 2026,
drawing on its 2025 annual survey of data centre owners and operators, reports
that 57% of respondents said their most recent major outage cost more than
$100,000, while one in five reported costs exceeding $1 million.
The July 2024
CrowdStrike incident offers a further illustration of the potential scale of
disruption. Parametrix estimated direct financial losses of approximately $5.4
billion among US Fortune 500 companies, excluding Microsoft, with only 10–20%
of those losses likely to be covered by cyber insurance.
The contractual
dimension was equally striking. Delta Air Lines estimated the financial impact
of the incident at approximately $500 million. CrowdStrike, however, maintained
that its contractual liability to Delta was capped at a single-digit-million-dollar
amount. The underlying agreement provided for a liability cap of twice the fees
paid for the relevant subscription services during the applicable subscription
term, alongside exclusions for certain categories of damages.
The
enforceability and application of those provisions remain contested in the
litigation. Although CrowdStrike involved a different type of technical
failure, the dispute illustrates how operational losses can substantially
exceed the amounts potentially recoverable under contractual liability
provisions and available insurance coverage.
What the Courts Tell Us
Under English law, Hadley
v Baxendale (1854) remains a starting point for assessing whether
contractual losses are too remote. In St Albans City and District Council v
International Computers (1996), the Court of Appeal held that a limitation
clause in the supplier’s standard terms failed the reasonableness test under
the Unfair Contract Terms Act 1977. By contrast, Watford Electronics v
Sanderson (2001) demonstrates the weight the Court of Appeal was prepared
to give to contractual risk allocation agreed between commercially experienced
parties of comparable bargaining strength.
Together, these cases show that
neither a standard-form limitation nor an agreed liability cap is automatically
unenforceable or automatically safe.
French law offers
another perspective.
In Faurecia v Oracle (2010), the Commercial
Chamber of the Cour de cassation upheld the limitation clause at issue,
notwithstanding the supplier’s failure to perform an essential contractual
obligation, because the clause did not deprive that obligation of its
substance. This principle is now reflected in Article 1170 of the French Civil
Code, introduced by the 2016 reform and effective from 1 October 2016, which
provides that any clause depriving an essential obligation of its substance is
deemed unwritten.
The litigation
arising from the 2024 CrowdStrike disruption shows why procedural rulings must
be read carefully. On 16 May 2025, the Fulton County Superior Court in Georgia
granted CrowdStrike’s motion to dismiss in part and denied it in part, allowing
certain claims brought by Delta Air Lines, including gross negligence and
computer trespass, to proceed. This was a procedural ruling, not a final
finding of liability or a definitive determination of the enforceability of any
contractual liability cap.
As of the latest available company filing in August
2026, the case remained pending, with discovery ongoing.
The Contract Comes First, but the
Law Matters
A cloud customer should begin with the actual contract: the
subscription terms, the applicable service-level agreement (SLA),
limitation-of-liability provisions, exclusions, claims procedures and any
negotiated amendments. Microsoft publishes service-specific availability
commitments and service-credit arrangements, whose thresholds, eligibility
requirements, exclusions and claim deadlines vary according to the service and
the applicable contractual version.
Credits are not applied automatically: the
customer must submit a claim, which is subject to Microsoft’s assessment and
approval. A reported interruption does not, by itself, establish an SLA breach
or an entitlement to a credit.
Service credits are commonly calculated by reference to
subscription fees rather than the customer’s wider business losses. Microsoft’s
published SLA terms describe service credits as the sole and exclusive remedy
for performance or availability issues covered by the applicable agreement and
SLA.
Whether that exclusivity holds, or whether other claims remain available,
depends on the wording of the complete agreement and the applicable mandatory
law. Likewise, a force-majeure clause does not automatically excuse an internal
technical failure. Its application depends on the contractual wording, the
cause of the event and the governing law.
The distinction between legal systems can be significant.
English law generally respects the allocation of risk negotiated between
commercial parties, while subjecting certain exclusion and limitation clauses
to statutory and common-law controls, including the reasonableness test under
the Unfair Contract Terms Act 1977 where applicable.
French law, under Article
1170 of its Civil Code, treats as unwritten any clause that deprives an
essential obligation of its substance. Separately, Article 1231-3 of the same
Code limits contractual damages to losses that were foreseen or foreseeable
when the contract was concluded, except where non-performance results from
gross or wilful misconduct.
Article 217 of the Egyptian Civil Code permits
contractual exclusions of liability for non-performance, except for the
debtor’s own fraud or gross fault, while allowing the debtor to exclude
liability for fraud or gross fault committed by persons engaged in performing
the obligation. These rules illustrate why contractual protections cannot be
assessed in isolation from the governing legal system.
The forum also matters. Court jurisdiction, arbitration
clauses, mandatory rules and procedural requirements may determine where and
how a claim can be pursued.
In regulated sectors, the EU Digital Operational
Resilience Act (DORA), applicable from 17 January 2025, imposes requirements on
financial entities concerning ICT risk management and third-party service
providers. Its contractual requirements include provisions addressing service
levels, subcontracting, termination and data access and recovery.
For arrangements
supporting critical or important functions, additional requirements apply, including
more detailed performance targets and rights of access, inspection and audit.
The regulation therefore adds an important regulatory dimension to
cloud-service contracts in the financial sector.
The Lesson Beyond the Outage
This incident should
not be reduced to a debate about blame. Microsoft communicated during the
disruption, explained its preliminary findings and apologised, and that
response deserves to be assessed fairly. Yet restoring a service and restoring
a customer’s legal rights are two different things.
Operational recovery means bringing
systems back online, restoring access to data and applications, and enabling
the business to resume its activities. Legal
recovery, by contrast, means determining whether contractual
obligations were breached and whether the affected customer is entitled to
service credits, damages or other remedies. Such entitlement depends on the
contract, the applicable law, proof of loss and a demonstrable link between the
breach and that loss.
The practical lesson
is preparation rather than litigation. Boards and general counsel should
understand what level of service availability has actually been promised, what
remedies may be available, how liability is capped, which law and
dispute-resolution forum apply, whether insurance covers the relevant risks,
and whether tested business continuity and disaster recovery arrangements can
keep critical operations running during a prolonged interruption.
Cloud contracts are
usually signed when everything works; their true value is tested only when it
does not. When the cloud fails, an apology may explain what happened, and
technical recovery may restore the service.
But neither necessarily resolves
the question of who bears the financial consequences. That question must be
answered by the contract, interpreted in light of its governing law and any
applicable mandatory rules.
