Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The agreement establishes two aggregate liability thresholds: a standard cap at the greater of 12 months of paid fees or $250,000, and an elevated cap for data breach and confidentiality claims at the greater of twice 12 months of paid fees or $500,000. Certain claims are excluded from these caps, including payment obligations, indemnification obligations, and claims for gross negligence or intentional misconduct.
This analysis describes what Harvey AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the maximum recoverable damages under the agreement for most claim types and sets a distinct higher threshold for data breach and confidentiality-related claims. Compliance teams should map their actual annual fee payments against these caps to assess whether the contractual risk transfer is adequate relative to the organization's data exposure.
Under this clause, the agreement limits aggregate liability for most claims to $250,000 or 12 months of fees, whichever is greater. Claims arising from data breaches or confidentiality breaches are subject to a separate higher cap of $500,000 or twice 12 months of fees.
Cross-platform context
See how other platforms handle Differentiated Liability Caps and similar clauses.
Compare across platforms →Monitoring
Harvey AI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"in no event will either party's total liability to the other party or any third party for all claims in the aggregate (for damages or liability of any type) in connection with these Terms exceed the greater of (x) the amount actually paid or payable to Harvey by You in the prior 12 months relating to Your use the Service or (y) $250,000 (the "Liability Cap"). For claims relating to data breaches of Your Customer Data caused by Harvey's breach of its obligations under our Security Addendum or the DPA, as well as either party's breach of its obligations relating to confidentiality, total liability to the other party or any third party for all claims in the aggregate (for damages or liability of any type) in connection with these Terms will not exceed the greater of (x) two times the amount actually paid or payable to Harvey by You in the prior 12 months relating to Your use of the Service or (y) $500,000 (the "Data Breach Cap").Excerpt from Harvey AI's Terms of Service
(1) REGULATORY LANDSCAPE: Contractual liability caps engage general commercial contract law under California law (for non-EEA/UK customers) or English and Welsh law (for EEA/UK customers). GDPR Article 82 establishes independent data subject compensation rights that are not necessarily constrained by contractual liability caps between data controllers and processors, which may be relevant if the DPA governs Harvey as a data processor. (2) GOVERNANCE EXPOSURE: Medium. The exclusion of gross negligence and intentional misconduct claims from the liability caps provides a carve-out for the most serious misconduct scenarios. The data breach cap floor of $500,000 may be insufficient relative to the cost of a significant data breach involving legal sector Customer Data, depending on the volume and sensitivity of data processed. (3) JURISDICTION FLAGS: EU member state courts applying GDPR may not give full effect to contractual liability caps where data subject rights under GDPR Article 82 are implicated. UK data protection law contains similar independent compensation provisions. California CCPA does not establish a specific statutory damages floor for B2B processor arrangements but may affect the broader regulatory exposure. (4) CONTRACT AND VENDOR IMPLICATIONS: The aggregate cap applies across the contracting entity and all Affiliates combined, per Section 11.4, which is operationally significant for enterprise deployments where multiple Affiliate entities submit Customer Data. Procurement teams should assess whether cyber insurance coverage aligns with the contractual cap structure. (5) COMPLIANCE CONSIDERATIONS: Legal teams should model the effective cap value based on current and projected annual fee payments and compare against the organization's data risk profile. The exclusion of indemnification obligations from the caps means that intellectual property indemnity claims may not be subject to the dollar thresholds stated here.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes the maximum recoverable damages under the agreement for most claim types and sets a distinct higher threshold for data breach and confidentiality-related claims. Compliance teams should map their actual annual fee payments against these caps to assess whether the contractual risk transfer is adequate relative to the organization's data exposure.
Under this clause, the agreement limits aggregate liability for most claims to $250,000 or 12 months of fees, whichever is greater. Claims arising from data breaches or confidentiality breaches are subject to a separate higher cap of $500,000 or twice 12 months of fees.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Harvey AI.