Cloud computing has transformed how businesses operate. From hosting websites and storing customer information to running accounting systems and managing entire IT networks, businesses now rely heavily on services they don’t physically control.
But what happens when those services suddenly stop working?
Imagine an IT company managing cloud infrastructure for several clients. One morning, a major cloud provider experiences an outage. Websites go offline, employees can’t access essential applications, and businesses begin losing revenue.
The IT company hasn’t done anything wrong. The problem originated with the cloud provider. Yet its clients are frustrated, and some are demanding compensation.
So who’s actually responsible when a cloud service goes down?
The answer isn’t always straightforward. Liability can depend on the cause of the outage, contractual obligations, service level agreements and the steps taken to prevent or minimise disruption.
Understanding Responsibility for Cloud Services
When a business relies on cloud technology, there are often several parties involved.
The cloud provider, such as Amazon Web Services (AWS), Microsoft Azure or Google Cloud, supplies the underlying infrastructure or services.
An IT services company might configure, manage and maintain those cloud environments on behalf of its clients.
And the client relies on the arrangement to keep its business operating.
Each party has different responsibilities.
Cloud providers are generally responsible for the infrastructure and services they agree to deliver. IT providers may be responsible for configuration, monitoring, security, backups or technical support, depending on their contract.
Meanwhile, clients retain responsibility for certain aspects of their own technology and business continuity arrangements.
This division is often referred to as the shared responsibility model.
The difficulty arises when something goes wrong and it’s unclear where one party’s responsibility ends and another begins.
Is the Cloud Provider Responsible for an Outage?
If an outage originates within a cloud provider’s infrastructure, it’s reasonable to expect that provider to take responsibility for restoring its services.
However, responsibility for fixing the problem isn’t necessarily the same as legal liability for the financial losses it causes.
Most major cloud providers operate under detailed service agreements that outline their availability commitments and limitations of liability.
These agreements commonly include service level agreements (SLAs), which specify expected uptime and the remedies available if those commitments aren’t met.
For example, a cloud provider might offer a 99.9% monthly uptime commitment for a particular service.
If actual availability falls below that threshold, eligible customers may receive service credits.
But here’s the catch.
Service credits are not necessarily compensation for the financial damage caused by an outage.
A business might lose thousands of dollars in sales during a disruption but only qualify for a relatively small credit against its cloud hosting fees.
Some cloud agreements also restrict liability for lost profits, business interruption and other consequential losses.
These contractual limits are subject to applicable law, and enforceability can depend on the circumstances.
Still, businesses should never assume that a cloud provider will automatically reimburse every loss resulting from downtime.
Can an IT Company Be Liable for a Third-Party Cloud Outage?
This is where the situation becomes particularly relevant for managed service providers, IT consultants and cloud implementation specialists.
An IT business may have no direct control over the infrastructure that failed, but that doesn’t necessarily prevent a client from making a claim against it.
Whether the claim succeeds is another matter.
Several factors can influence the outcome.
The IT Company’s Contractual Commitments
Suppose an IT company promises its client 99.99% system availability.
However, the underlying cloud provider only offers an SLA with a lower availability commitment.
If the cloud service goes down and the IT company fails to meet its contractual promise, the client might argue that the IT company has breached its agreement.
The company could face a contractual dispute despite not causing the original outage.
Whether it’s legally liable will depend on the wording of the agreement, any exclusions, the nature of the promise and applicable law.
This is why IT businesses should be particularly careful about offering uptime guarantees that exceed the commitments of their underlying suppliers.
Failure to Implement Appropriate Backup Systems
Consider another scenario.
An IT provider recommends moving a client’s business-critical applications to the cloud. It manages the migration and ongoing infrastructure.
When the cloud provider experiences an outage, the client discovers there is no practical recovery arrangement.
The outage lasts several hours, disrupting operations and causing financial losses.
The client might allege that the IT provider failed to recommend or implement appropriate business continuity measures.
In this case, the dispute isn’t necessarily about who caused the outage.
It’s about whether the IT company fulfilled its professional responsibilities when designing and managing the client’s systems.
Poor Configuration or System Management
Not every apparent cloud outage is caused by the cloud provider.
Incorrect settings, failed software updates, inadequate monitoring or misconfigured network connections can all make cloud-hosted services unavailable.
If an IT provider’s mistake causes the interruption, it may face a stronger claim for professional negligence or breach of contract.
For example, a configuration change could accidentally disconnect a client’s production environment or prevent essential applications from functioning.
The resulting losses may be significant, particularly for businesses that depend on continuous online access.
What If the IT Company Resells Cloud Services?
The liability question can become even more complicated when an IT company resells cloud services rather than simply managing a client’s existing cloud account.
In some arrangements, the client contracts directly with the underlying cloud provider.
In others, the IT company contracts with the cloud supplier and then provides those services to its customer under a separate agreement.
That distinction matters.
When an IT company is the direct contractual supplier to its client, the client may look to that company to resolve service failures and honour contractual commitments.
However, the IT company’s rights against the underlying cloud provider may be considerably more limited.
This creates a potential mismatch.
An IT company might owe obligations to its customer that are broader than the remedies available from its cloud supplier.
Carefully drafted customer agreements and appropriate supplier contracts can help manage this exposure.
Can IT Insurance Cover Cloud Outage Claims?
Insurance can play an important role in protecting IT businesses against certain liabilities associated with cloud service failures.
However, different types of insurance address different risks, and not every outage will trigger cover.
Technology Professional Indemnity Insurance
Technology professional indemnity insurance, sometimes called technology errors and omissions insurance, can protect against certain claims arising from mistakes, negligence or failures in professional services.
For example, an IT company might face a claim after incorrectly configuring a client’s cloud environment or failing to implement agreed backup procedures.
Depending on the policy, professional indemnity insurance may cover certain compensation payments and legal defence costs.
However, policies commonly contain exclusions or limitations relating to contractual guarantees, penalties and liabilities assumed beyond ordinary legal obligations.
A claim arising solely because a third-party cloud provider experienced an outage may not be covered unless the IT business has an insured legal liability.
Businesses reviewing insurance for IT firms should therefore consider the professional services they provide, the contractual commitments they make and their reliance on external technology providers.
Cyber Insurance
Cyber insurance addresses a different collection of risks.
Depending on the policy, it may provide protection against cyber incidents, data breaches, system failures and business interruption.
Some policies also include contingent or dependent business interruption cover.
This may respond when a third-party technology provider experiences a covered incident that interrupts the insured business’s operations.
For example, an IT company that relies on a particular cloud platform might experience its own financial losses when that platform becomes unavailable.
However, there are important differences between policies.
Some contingent business interruption cover is triggered by cyberattacks or security incidents affecting external providers. Other policies may extend to non-malicious system failures, such as accidental software or infrastructure faults.
Businesses should check whether their policy covers outages involving third-party cloud providers, particularly when no cyberattack has occurred.
They should also review waiting periods, financial limits and any exclusions relating to particular services or suppliers.
Importantly, cover for the IT company’s own business interruption losses is different from cover for claims made by its clients.
Does Standard Business Insurance Cover Cloud Outages?
Traditional business interruption insurance is often associated with physical damage to insured property.
For example, a fire might damage an office and prevent a business from operating.
A cloud outage generally doesn’t involve physical damage to the insured business’s premises.
Consequently, standard property-related business interruption insurance may not respond to a cloud service failure.
Specialist cyber or technology insurance may be more appropriate, depending on the nature of the business and the risks involved.
What About Data Loss During a Cloud Outage?
Not all cloud disruptions simply involve temporary downtime.
Some incidents may also result in data becoming corrupted, inaccessible or permanently lost.
For IT providers, this can create additional complications.
A client might allege that inadequate backup arrangements, poor system configuration or failures in recovery procedures contributed to the loss.
Professional indemnity insurance may respond to certain claims involving negligent technology services, depending on the policy.
Cyber insurance may also provide cover for specified data restoration costs or incident response expenses.
However, an outage is not automatically a data breach.
Under Australia’s Notifiable Data Breaches scheme, notification obligations depend on factors including whether personal information was lost or accessed or disclosed without authorisation, and whether serious harm is likely.
A temporary service interruption without a qualifying compromise of personal information will not necessarily trigger those notification requirements.
How IT Companies Can Reduce Their Exposure
Although cloud outages cannot always be prevented, IT businesses can take practical steps to reduce their potential liability.
Some of the most important include:
- Review customer agreements: Ensure availability commitments, liability limitations and service obligations reflect what the business can realistically deliver.
- Understand supplier SLAs: Check the guarantees and remedies provided by underlying cloud suppliers before making commitments to clients.
- Clarify responsibilities: Document which party manages backups, security, monitoring, recovery and incident response.
- Plan for service interruptions: Consider redundancy, alternative infrastructure and disaster recovery arrangements appropriate to each client’s requirements.
- Maintain clear communication: Keep clients informed during disruptions and document the actions taken to investigate and resolve incidents.
- Review insurance coverage: Confirm whether existing policies address technology service failures, third-party cloud outages and related client claims.
It’s also worth regularly testing recovery arrangements. A backup system that hasn’t been tested may provide little reassurance when an actual incident occurs.
What Should IT Companies Do When an Outage Happens?
When an outage affects multiple clients, the immediate priority should be managing the incident and reducing disruption.
Identify the affected services, establish whether the failure originated with the cloud supplier or within the managed environment, and communicate clearly with affected customers.
Document the outage timeline, technical findings, support requests and recovery actions.
These records may become important if a contractual dispute or insurance claim arises later.
If a client alleges that the IT company is responsible for financial losses, the business should consider notifying its insurer promptly in accordance with policy requirements.
It’s also sensible to seek professional advice before admitting liability, agreeing to compensation or entering into a settlement that could affect insurance coverage.
Final Thoughts
Cloud services offer businesses enormous advantages, but they also create dependencies that can become problematic when technology fails.
When an outage occurs, responsibility may rest with the cloud provider, the IT services company, the client or a combination of parties.
The key question isn’t simply who caused the outage. It’s also what each party agreed to deliver, whether those obligations were met and whether any legal responsibility arises from the disruption.
For IT companies, the most effective approach combines realistic contractual commitments, sound technical practices, tested recovery arrangements and insurance appropriate to the services being provided.
Because when a major cloud platform goes down, the resulting financial and legal consequences can extend far beyond the company operating the servers.
Disclaimer: This article provides general information about IT insurance and cloud service liability in Australia. It does not constitute legal or financial product advice. Insurance coverage depends on individual policy wording, exclusions and circumstances. Businesses should seek advice from appropriately qualified legal and insurance professionals when reviewing contracts or insurance arrangements.
