Skip to main content
Readiness Authority
Category: Policy Exclusions

Contractual Liability Exclusion

Simply put

A contractual liability exclusion is a provision in a liability insurance policy that limits or removes coverage for obligations the insured voluntarily took on by signing a contract or agreement, rather than obligations imposed by law. In other words, if a business promises in a contract to be responsible for someone else's potential liability, the insurer may decline to pay for that assumed obligation. It generally does not bar all liability connected to a contract, only a specific type of liability that the insured expressly agreed to assume.

Formal definition

A standard third-party liability exclusion, appearing in commercial general liability forms such as the CG 00 01, that operates to exclude coverage for damages the insured is obligated to pay 'by reason of the assumption of liability in a contract or agreement.' The exclusion is generally construed narrowly: authorities note it does not bar all contract-related liability but is limited to a special category in which the insured has expressly assumed the tort liability of another party. Its purpose is to confine the insurer's obligation to liability the insured would bear under law and to avoid responsibility for liability the insured voluntarily contracted to assume; commonly excepted from the exclusion are certain 'insured contracts' and liability the insured would have absent the contract, though scope depends on the specific policy wording, endorsements, and jurisdiction. Application typically concerns bodily injury or property damage in CGL contexts; how it interacts with cyber and other specialty forms is subject to the specific wording and is out of scope for this evidence.

Why it matters

The contractual liability exclusion matters because businesses routinely sign agreements, vendor contracts, service agreements, leases, construction subcontracts, that contain indemnity or hold-harmless clauses in which one party promises to take on another party's potential liability. A business may assume that its liability insurance stands behind these promises, only to discover after a loss that the insurer declines to pay because the obligation was one the insured voluntarily accepted by contract rather than one imposed by law. Understanding the exclusion helps risk managers and brokers avoid a gap between what a contract requires and what a policy will actually respond to.

Crucially, the exclusion is generally construed narrowly. Authorities note that it does not bar all contract-related liability; it is limited to the special category in which the insured has expressly assumed the tort liability of another party 'by reason of the assumption of liability in a contract or agreement.' Liability the insured would have borne under law even absent the contract is typically not defeated by this exclusion, and standard forms commonly carve out certain 'insured contracts.' Whether a particular obligation falls inside or outside the exclusion turns on the precise policy wording, applicable endorsements, and jurisdiction.

The practical stakes are highest where contract drafting and insurance coverage are managed separately. A company can negotiate a broad indemnity into an agreement, believe it is transferring that exposure to its insurer, and still be left funding the assumed obligation itself if the exclusion applies and no exception is triggered. This is fundamentally a risk transfer question: signing an indemnity does not reduce the likelihood of an underlying loss, and it does not guarantee that the loss is insured. Aligning contractual commitments with the actual scope of coverage is what closes the gap.

Who it's relevant to

Risk managers
Risk managers responsible for aligning contractual commitments with insurance programs need to identify indemnity and hold-harmless clauses that may trigger the exclusion. Where a contract requires the business to assume another party's liability, they should confirm whether that assumed obligation falls within an 'insured contract' exception or whether it is effectively uninsured, rather than assuming the CGL policy automatically responds.
Insurance brokers and underwriters
Brokers advising clients on contract-driven exposures should explain that assuming liability by agreement does not by itself secure coverage, and should review how a given form's exclusion and its exceptions interact with the client's contracts. Underwriters use the exclusion to keep the carrier's obligation tied to tort liability the insured would bear under law, and evaluate the scope of assumed liabilities being brought into the program.
Legal and compliance professionals
Attorneys drafting or reviewing indemnity provisions, particularly in construction and vendor agreements, need to reconcile the contractual liability being assumed with the coverage actually available. Because application depends on the specific wording, endorsements, and jurisdiction, counsel should assess whether an assumed obligation qualifies for an 'insured contract' exception before relying on insurance to backstop a negotiated indemnity.
Resilience and continuity planners
Planners should recognize that a contractual promise to assume another party's liability is a risk transfer arrangement, not a mitigation measure, it does nothing to reduce the likelihood of the underlying event. Where the exclusion could leave an assumed obligation unfunded, that residual exposure should be accounted for in financial resilience planning rather than presumed to be covered.

Inside Contractual Liability Exclusion

Assumed Liability Under Contract
The core mechanism of a contractual liability exclusion is to remove coverage for liability the insured takes on by agreement rather than liability imposed by law. It targets obligations the insured would not otherwise have owed but for entering into a contract, such as indemnification or hold-harmless promises made to another party.
Third-Party Coverage Context
This exclusion operates within the third-party (liability) side of a cyber policy, affecting the insured's obligations to others rather than first-party losses like the insured's own business interruption or data restoration. Its practical effect is to narrow when the insurer will respond to liability the insured has contractually assumed on behalf of a counterparty.
Common Carve-Backs and Exceptions
Many forms include exceptions that preserve coverage for liability the insured would have had even without the contract, and some preserve coverage for liability assumed under specified categories of agreements. Subject to the specific wording, these carve-backs are frequently the decisive part of the clause, because they determine which assumed obligations remain within scope.
Interaction With Other Policy Provisions
The exclusion does not operate in isolation; its effect depends on the insuring agreement, definitions, other exclusions, conditions precedent, and any endorsements. Whether a particular indemnity obligation is excluded turns on how these provisions read together and on the governing jurisdiction's approach to interpreting such clauses.
Scope Boundaries
A contractual liability exclusion generally does not eliminate coverage for liability arising by operation of law, and it is distinct from war, infrastructure, and failure-to-maintain-standards exclusions, which address different risks. It is a coverage term, not a security control or resilience metric, and it says nothing about the likelihood of an incident occurring.

Common questions

Answers to the questions practitioners most commonly ask about Contractual Liability Exclusion.

Does a contractual liability exclusion mean my cyber policy won't cover anything related to a contract?
No. This is a common misreading. The exclusion typically applies to liability the insured assumes under a contract that it would not otherwise have had under general law, not to all contract-adjacent losses. Many policies carve back liability that the insured would have faced regardless of the contract, and some restore coverage for liability assumed under specific defined agreements. Whether a particular claim is affected depends on the precise wording, the carve-backs, and the applicable jurisdiction, so the exclusion should be read alongside its exceptions rather than in isolation.
If I have a contractual liability exclusion, is there any point buying coverage for the indemnities I sign in vendor and client contracts?
The exclusion does not automatically render such coverage pointless. It often coexists with carve-backs that preserve coverage for liability the insured would have borne anyway, and some forms specifically address liability assumed under defined 'insured contracts' or written agreements. The practical question is whether your policy's wording and endorsements align with the indemnity obligations you actually take on. Because this is a matter of matching specific contract language to specific policy language, it warrants review of the exact terms rather than a general assumption that coverage is or is not available.
How can I tell whether liability I have assumed in a contract would still be covered despite this exclusion?
Start by identifying whether the liability in question would exist under general law absent the contract; liability that arises independently of the assumed obligation is often outside the reach of the exclusion, subject to wording. Then locate any carve-backs or exceptions in the exclusion itself, and check whether the policy defines categories such as 'insured contract' or 'written agreement' that restore coverage. Because outcomes turn on the interplay of these provisions and on jurisdiction, this analysis is typically done with input from your broker and coverage counsel rather than from the exclusion clause alone.
What should I look for when comparing contractual liability exclusions across competing policy forms?
Compare the breadth of the exclusionary language, the presence and scope of any carve-backs, and how key terms are defined. Note whether the exclusion is limited to liability the insured would not otherwise have had, whether it references defined agreement types, and whether it interacts with other exclusions or conditions precedent. Also consider how the exclusion sits alongside the coverage grants you rely on. Since forms vary between insurers and versions, treat any summary comparison as a prompt for detailed wording review rather than a conclusion.
How does this exclusion interact with the indemnification clauses my organization negotiates with third parties?
The exclusion can affect whether losses flowing from indemnities you grant are recoverable under your policy, which is why aligning contract drafting with policy wording matters. Where a contract requires you to assume liability beyond what general law would impose, that additional assumed liability may fall within the exclusion unless a carve-back applies. Coordinating the negotiation of indemnity language with a review of your coverage helps avoid gaps, though the effectiveness of any alignment depends on the specific policy terms and the governing jurisdiction.
Can endorsements modify or narrow a contractual liability exclusion, and what should I ask about them?
Endorsements can, in many cases, amend how an exclusion operates, for example by adding carve-backs or by clarifying defined terms, though the effect depends entirely on the endorsement's wording and how it integrates with the base form. Useful questions include which specific assumed liabilities an endorsement is intended to address, whether it introduces sublimits or conditions, and how it interacts with other exclusions. Because endorsement effects are not uniform across insurers, confirm the intended result in writing and review it with your broker or coverage counsel.

Common misconceptions

A contractual liability exclusion means the policy will never respond to any claim connected to a contract.
The exclusion typically targets liability the insured assumed by agreement that it would not otherwise have owed, not every claim that happens to involve a contract. In many policies, liability the insured would have faced under the law regardless of the contract, and liability falling within stated carve-backs, may still be covered subject to the specific wording.
Signing a contract with a strong indemnity clause transfers the insured's risk to its cyber insurer.
Contractual indemnity is a form of risk allocation between the contracting parties; it is not the same as risk transfer through insurance. Whether the insurer will fund an assumed indemnity depends on the contractual liability exclusion and its exceptions. Assuming broad indemnity obligations can, in fact, take liability outside coverage rather than shift it to the carrier.
The exclusion applies identically across all cyber policies.
Wording varies among insurer forms, and the presence, breadth, and carve-backs of a contractual liability exclusion differ from policy to policy. Interpretation may also vary by jurisdiction, so two seemingly similar clauses can produce different outcomes depending on the exact language and applicable law.

Best practices

Read the contractual liability exclusion together with its carve-backs, the insuring agreement, and definitions to determine which assumed obligations remain covered, rather than assuming the clause is fully exclusionary or fully benign.
Before signing vendor, client, or service agreements, review the indemnification and hold-harmless language against the cyber policy to identify assumed liabilities that may fall outside coverage under the exclusion.
Coordinate the risk manager, broker, and legal counsel when negotiating both the contract wording and the policy wording, so that contractual indemnity obligations and available coverage are assessed against each other.
Where material assumed liabilities are identified, discuss with the broker whether an endorsement or broader carve-back can address them, recognizing that availability and terms are subject to insurer appetite and specific wording.
Document the analysis of which liabilities arise by operation of law versus by contract, since coverage for the former is generally less affected by this exclusion than the latter.
Confirm how the governing jurisdiction and the chosen insurer form interpret assumed-liability language, and avoid treating outcomes under one policy as predictive of another.
a promotional banner asking how ready are you for PCI DSS 4.0? With a call-to-action to get the checklist now.