SLA Balance: Penalties and Exemptions Guide

A system outage lasting exactly 15 minutes leads to a client demanding a 50% discount on their total monthly service fee. This is a scenario we frequently encounter at AgreeGold when reviewing Service Level Agreements (SLA) for software-as-a-service (SaaS) providers and data center operators. In these maintenance or operation contracts, the SLA serves as the primary yardstick for measuring performance. However, many small and medium-sized enterprises (SMEs) draft these clauses either too loosely, causing client dissatisfaction, or too strictly, exposing the provider to disproportionate legal risks. Under Article 227 of the Civil Code regarding incomplete performance, a creditor may claim damages when service quality fails to meet the agreed standards. In practice, parties use the SLA to pre-determine liquidated damages, simplifying the difficulty of proving the exact amount of loss. This article breaks down how to design a framework that protects client rights without jeopardizing the provider's financial stability.

How do you define service metrics to avoid performance disputes?

The first step in any SLA is defining what "available service" actually means. If a contract merely states that the "system must remain stable," it relies on an indefinite legal concept. When a dispute arises, the gap in understanding "stability" leads to a performance deadlock. According to Article 153 of the Civil Code, a contract is concluded only when the parties have agreed on all essential points. In a service contract, the service level is an essential point of performance.

We recommend quantifying these indicators into specific percentages. For instance, a monthly availability rate of 99.9% means that downtime cannot exceed approximately 43 minutes per month. You must explicitly state the calculation formula within the clause:

Availability Rate = (Total minutes in the month - Downtime minutes after deducting exempt events) / Total minutes in the month × 100%

Without this formula, if a client’s own local network fails and prevents them from reaching your server, does that count as downtime? This involves Article 230 of the Civil Code: if the failure to perform is due to circumstances for which the debtor is not responsible, the debtor does not bear the responsibility for the delay. Therefore, the definition must exclude scenarios not attributable to the provider. Failing to do so forces you to assume an overly heavy burden of strict liability.

Beyond availability, Response Time and Repair Time are standard metrics. Response Time marks the period from when a client reports an issue to when the provider acknowledges it. Repair Time is the duration from the report until the function is restored. These two metrics are legally classified as "deadlines" for performance. Violating them constitutes a delay in performance under Article 229 of the Civil Code. We suggest setting different deadlines for different fault levels—such as critical errors, general errors, and suggestions. This approach distributes legal risk and prevents a minor display bug from triggering the same high penalty as a total system crash.

How does Civil Code Article 250 and 252 govern your penalty design?

When service levels fall short, the immediate consequence is usually a penalty, often expressed as "Service Credits" or direct deductions. Legally, these clauses fall under the category of liquidated damages as defined in Article 250 of the Civil Code. There are two types: "liquidated damages as a predetermined amount of compensation" and "punitive liquidated damages." If the contract does not specify the type, Article 250, Paragraph 2, stipulates that the amount is deemed the predetermined compensation for damages.

One frequent mistake is setting penalties that are entirely disproportionate to the service fee. For example, a service with a $1,000 monthly fee might have a clause stating a $5,000 penalty for one hour of downtime. While the principle of freedom of contract allows parties to agree on such terms, Article 252 of the Civil Code grants the court a significant power: if the agreed liquidated damages are disproportionately high, the court may reduce them to a reasonable amount. This means even if you write an astronomical penalty, a court will examine the actual damage suffered by the creditor, the social and economic conditions, and the benefits the creditor would have enjoyed had the contract been performed as agreed.

To prevent a clause from being drastically reduced by a court for being excessive, we suggest a tiered penalty structure:

1. Monthly availability below 99.9% but above 99.0%: 5% deduction of the monthly fee.
2. Monthly availability below 99.0% but above 95.0%: 15% deduction of the monthly fee.
3. Monthly availability below 95.0%: 30% deduction of the monthly fee, and the client may exercise the right to rescind the contract under Article 255 of the Civil Code.

You must set a "liability cap." In practice, a reasonable cap is often set at the total monthly service fee or a specific percentage of the average fees over the past twelve months. This aligns with the purpose of damage compensation under the Civil Code—to make the injured party whole without providing a windfall. Without a cap, a provider faces the extreme risk of company-wide insolvency due to a single technical accident, which represents a failure in legal risk management.

What exclusion clauses are required to draw clear liability boundaries?

The balance of an SLA lies not just in how you penalize, but in when you do not penalize. Exclusion clauses are the provider's shield. Without clear exemptions, Article 227 of the Civil Code places the burden of proof on the debtor (the provider) to show they were not at fault for the incomplete performance. This is a heavy burden to carry in a technical environment.

We recommend including the following exemptions in the SLA and ensuring both parties agree that these periods do not count toward downtime:

1. Scheduled Maintenance: As long as the client is notified within the agreed timeframe (e.g., 48 hours in advance), the interruption is not a breach. This is a mutual agreement to modify the performance time.
2. Third-Party Factors: This includes telecommunications failures or major outages of public cloud providers (AWS, Azure, GCP). Although a provider is responsible for the acts of its assistants under Article 224 of the Civil Code, specific contractual agreements can transfer or exclude risks associated with designated third parties.
3. Client-Side Factors: Unauthorized code changes by the client, failure to follow operating procedures, or issues within the client's own network environment. Legally, this falls under "delay in acceptance by the creditor" or "circumstances not attributable to the debtor."
4. Force Majeure: Natural disasters, war, or changes in government regulations. This follows the principle of exemption for impossibility of performance due to force majeure.

To ensure these exclusions hold up in a dispute, you must maintain comprehensive system logs. When a conflict occurs, the data is the key to meeting the burden of proof. The contract should specify that the calculation of service availability is based solely on the provider's monitoring system records. Unless the client can provide concrete evidence to the contrary, those records should be respected. This prevents clients from claiming a breach based on subjective feelings like "the system feels slow."

FAQ

Can a client demand compensation if the SLA does not mention penalties?

Yes. Even if the SLA clause does not specify a penalty amount or credit, the client can still request compensation for damages based on Article 227 (Incomplete Performance) or Article 231 (Delay in Performance) of the Civil Code. However, the client then carries a heavier burden of proof. They must prove that they suffered specific financial losses, such as lost business profits, directly due to the service interruption. The benefit of agreeing on SLA penalties beforehand is that they serve as "liquidated damages," saving both parties from the trouble of proving the exact amount of actual loss.

Can service credits be the only form of compensation?

This depends on the contract wording. If the contract states that "service credits are the sole and exclusive remedy for any failure to meet the SLA," the client generally cannot demand cash compensation. However, if the service interruption is so severe that the purpose of the contract cannot be achieved, the client may still invoke the statutory right to rescind the contract under Article 255 or 256 of the Civil Code. In such cases, they might demand a refund of paid fees or additional damages. Therefore, the credit clause should clearly define its scope of application.

Do Beta versions or trial services need to follow an SLA?

Legally, once a contract is effective, all performance obligations are regulated. If you provide a beta service, you must explicitly label it as provided "AS IS" and state that it is "not subject to SLA guarantees." Under Article 347 of the Civil Code, which applies the rules of sales to other types of contracts, if both parties agree to exclude specific quality guarantees, the provider can be exempted from related liabilities. If not explicitly excluded, even a free test could lead to liability for damages if it causes data loss for the client.

Is setting a compensation cap at the total contract value considered unfair?

In B2B transactions, setting a liability cap is a standard and reasonable method of risk allocation. When examining "standardized contracts" under Article 247-1 of the Civil Code, courts look at whether a clause is "obviously unfair under the circumstances." For SMEs, requiring a provider to bear unlimited indirect losses, such as a client's loss of reputation or expected future profits, might be viewed as obviously unfair to the provider. As long as the cap has a reasonable relationship to the service fees, it is typically viewed as valid.

Am I still liable if the client refuses to provide error screenshots?

This involves the creditor's duty of cooperation. If the contract stipulates that "the client must provide necessary error information (such as logs or screenshots) when reporting an issue," and the client refuses, preventing you from repairing the system within the agreed time, you are not responsible. According to Article 230 of the Civil Code, this is a circumstance not attributable to you, and you do not bear the responsibility for the delay. We recommend adding a "Reporting Procedure" clause to the SLA, making the client's cooperation a prerequisite for calculating repair time.

Who is responsible for outages caused by DDoS attacks?

Responsibility depends on the nature of your service. If you are a cybersecurity service provider, defending against DDoS attacks is your primary performance obligation, making it difficult to claim an exemption. However, if you are a general software provider and have taken reasonable security measures, a massive malicious attack can be argued as "force majeure" or a "non-attributable event." You should explicitly list "third-party attacks not caused by provider negligence" as an exempt event in your exclusion clauses to reduce ambiguity.

Self-Checking Your SLA Framework

High penalties are not a guarantee of service quality. Many SME owners believe that the higher the penalty, the more careful the provider will be. In reality, excessive penalties often lead to negative legal outcomes. When a penalty far exceeds a provider's profit or capacity, their first reaction to a major failure may be to hide logs or declare bankruptcy rather than focus on repairs. This defeats the client's goal of "continuous service."

From the perspective of the principle of honesty and credibility in Article 148 of the Civil Code, the purpose of a contract is to facilitate business, not to punish. A healthy SLA balances incentives with compensation. Instead of setting an astronomical penalty that a court might reduce under Article 252, set a reasonable range that the provider can afford but will feel the impact of. Use the following items to check your current agreement:

• Does the contract include a specific mathematical formula for calculating availability that excludes non-attributable events?
• Are the penalties tiered based on the severity of the service failure rather than a flat rate for any error?
• Is there a clear liability cap that relates to the economic value of the service fees paid?
• Does the agreement specify that the provider's system logs serve as the primary evidence for uptime and downtime calculations?
• Are client cooperation duties, such as providing error reports, explicitly linked to the start of the repair time clock?