When Credits Aren’t Enough: Preserving Remedies for Catastrophic Service Failures

Why Service Level Credits Often Fall Short
Service level credits are designed to adjust the price paid for a tool in a manner that incentivizes better supplier behavior in the future. They are typically capped at a small percentage of monthly fees, an amount that may not bear a relationship to the actual cost of an outage.

This incentive structure makes sense in the context of minor downtime. One hour of service unavailability at 3:00 AM on Saturday morning might not warrant pursuing remedies for material breach, and service credits are a perfect way to encourage a supplier to avoid allowing that one hour to turn into five.

However, when something catastrophic happens, like multi-hour downtime with no workaround available or resolution time provided, using service level credits as the exclusive remedy cannot adequately incentivize better behavior. The harm caused is disproportionate to the remedy available, and customers are left with little more than a modest invoice reduction after a catastrophic failure.

Better Remedies for Bad Failures
Customers should consider pursuing a tiered set of remedies that scales with the severity of the failure. The earlier tiers focus on keeping the business running and limiting harm while the vendor works toward resolution; the later tiers preserve meaningful recourse when a failure is chronic or catastrophic.

Tier 1: Business Continuity Obligations. The first line of defense is a clear business continuity and disaster recovery (BCP) commitment. Vendors should be required to promptly notify the customer of any material service disruption, maintain and regularly test documented BCP and disaster recovery plans, and use best efforts to identify and implement workarounds or alternative solutions (such as failover to secondary environments or manual processing support) until full service is restored.

Tier 2: Response Time Service Levels with Teeth. Communication during an outage can be key to mitigating harm. In addition to availability metrics, contracts should include response time service levels tied to incident severity, such as acknowledgment within minutes for critical incidents, regular status updates at defined intervals, escalation to senior vendor personnel, and a dedicated point of contact. Requiring appropriate responses while the vendor works on resolution provides an interim remedy, and these service levels should carry their own credits or escalation consequences, so they are not treated as aspirational.

Tier 3: Post-Incident Support. After a significant failure, the vendor should be accountable for explaining what happened and preventing a recurrence. Customers should require the vendor to make its executives available to meet with customer leadership, deliver a written root cause analysis within a defined period, and provide a corrective action plan with milestones that the customer can track and enforce.

Tier 4: Termination and Step-In Rights. For chronic failures (e.g., repeated service level misses over a defined period) and catastrophic failures (e.g., a prolonged outage of a critical service), customers should have the right to immediately terminate the affected services, or the agreement as a whole, without penalty and with transition assistance. Precise failure triggers related to chronic and catastrophic failures should be clearly defined to avoid disputes on whether a failure constitutes a chronic or catastrophic failure. For managed services, customers could also negotiate step-in rights, allowing the customer, or a replacement provider, to take over the affected function temporarily at the vendor’s cost.

Tier 5: Right to Seek Other Relief. Finally, customers should preserve the right to pursue damages and equitable relief beyond service level credits. Useful protections include higher or separate liability caps for significant service failures, reductions in minimum spend or volume commitments, and uncapped recovery of cost of cover damages (i.e., the cost of procuring replacement services) or other consequential harm. Regulated entities should also align these rights with supervisory expectations on operational resilience and third-party risk management, which increasingly require exit strategies and enforceable remediation rights.

Practical Drafting and Negotiation Guidance
The most important contractual fix to avoid the problem of insufficient remedy for a catastrophic failure is to reject “sole and exclusive remedy” language applying to service level credits, or, at a minimum, limit it so such exclusivity does not apply to catastrophic or chronic misses. Negotiating leverage is greatest before signature, so these points should be addressed as early in the process as possible (e.g., during request for proposal (RFP) or initial commercial negotiations), instead of being left to be resolved as a pure legal issue.

Operational Mitigants Within the Customer’s Control
Contract remedies help allocate risk after a failure, but they do not keep the business running during one. Customers should pair strong contract terms with their own operational resilience measures, so that a vendor outage becomes a manageable disruption instead of a business-stopping event.

Good starting points are as follows:

• Map Critical Dependencies. Identify which business processes depend on each third-party service, including indirect dependencies (e.g., authentication, notifications or approvals routed through email), and rank them by impact and tolerable downtime. This exercise should inform which vendors warrant enhanced contract protections and which processes need documented fallbacks.
• Maintain Internal Business Continuity Plans. The customer’s own BCP should address the loss of each critical vendor service, not just the loss of the customer’s own facilities or systems. These plans should document incident response procedures. 
• Establish Alternative Communication Channels. For email and collaboration tools in particular, customers should maintain backup channels that do not rely on the same provider or infrastructure, such as a secondary messaging platform, an emergency notification system, and current offline contact lists for employees, key clients and counterparties.

A Cautionary Note on AI and Untested Vendors
We have entered an era in which it is increasingly normal for organizations to build critical workflows on top of vendors that are, by most traditional measures, untested. For example, many AI providers are early-stage companies, or established companies offering new products, whose infrastructure has never been battle-tested against sudden and dramatic spikes in demand or traffic. Yet many businesses choose to integrate these tools into core operations before the vendor has demonstrated that it can operate reliably at scale.

Customers should approach engagements with these new services and vendors with the same discipline applied to any other critical service. Where the AI tool will support a critical business process, customers should seek to negotiate the tiered remedies described above. Customers should also diligence the vendor’s infrastructure and hosting dependencies (including any reliance on third-party model providers or cloud platforms), financial stability and incident history before signing.

Where better contractual risk allocation is not achievable, which is often the case with large or highly sought-after AI providers offering non-negotiable terms, the answer is to avoid overreliance on the AI tool. Customers should limit the use of these tools in processes where an outage would halt operations and consider multi-vendor or model-agnostic architectures that allow traffic to be shifted to another provider. In short, if the contract will not allocate the risk of failure to the vendor, the customer’s operational design must account for that risk instead.

Conclusion
Service level credits are a useful tool for managing routine performance, but they are not a risk-allocation strategy for critical services. Customers that preserve remedies for performance failures will be far better positioned when a significant or continuous failure occurs. For more information on service levels and how best to ensure performance for critical outsourced services, please contact the authors.