Diagnostic

Software as a service agreements: who pays when the platform fails

Mexico has no SaaS statute. The risk of an outage is allocated through clauses that the Federal Civil Code allows the parties to agree on and also limits.

LEXURE Commercial Contracts Practice Team 7 min read Regulatory status verified in 2026

When a plat­form goes down on a clos­ing day, the board wants to know who absorbs the loss. Because there is no spe­cific statute for soft­ware as a ser­vice, the answer is almost never in the law; it usu­ally lies in the con­tract and in what the con­tract can and cannot exclude.

What the law requires

Lia­bil­ity can be agreed upon, within a limit. Under Arti­cle 2117 of the Fed­eral Civil Code (Código Civil Fed­eral), civil lia­bil­ity may be gov­erned by agree­ment of the par­ties, except where the law pro­vides oth­er­wise; that code applies on a sup­ple­men­tary basis to com­mer­cial con­tracts by virtue of Arti­cle 2 of the Com­mer­cial Code (Código de Com­er­cio). That is the legal basis for lia­bil­ity caps. The limit is manda­tory: lia­bil­ity aris­ing from will­ful mis­con­duct (dolo) is enforce­able in all obli­ga­tions, and any waiver of the right to enforce it is void (Arti­cle 2106), so no cap pro­tects a provider that acts with will­ful mis­con­duct.

What is com­pen­sated. A party that fails to pro­vide the ser­vice as agreed is liable for dam­ages and lost prof­its (Arti­cle 2104). Dam­ages are the loss or impair­ment suf­fered in a party’s assets; lost prof­its, the lawful gain that was not obtained (Arti­cles 2108 and 2109). Both must be an imme­di­ate and direct con­se­quence of the breach (Arti­cle 2110). That is why clauses exclud­ing lost prof­its or indi­rect dam­ages only make sense if they define pre­cisely what counts as indi­rect.

Acts of God. No one is liable for an act of God (caso for­tu­ito) unless they caused or con­trib­uted to it, expressly accepted that lia­bil­ity, or the law imposes it on them (Arti­cle 2111). A force majeure clause that lists the fail­ure of the provider’s own sub­con­trac­tor as an excus­ing cause shifts to the cus­tomer a risk that the law, on its own, does not assign to it.

Ser­vice cred­its are a con­trac­tual penalty. The credit that the con­tract sets for miss­ing the avail­abil­ity level oper­ates as a con­trac­tual penalty (pena con­ven­cional). If the par­ties stip­u­late one, dam­ages and lost prof­its cannot also be claimed (Arti­cle 1840), and the penalty cannot exceed the prin­ci­pal obli­ga­tion in value or amount (Arti­cle 1843). In com­mer­cial mat­ters, the injured party chooses between demand­ing per­for­mance or the penalty; once one remedy is chosen, the other is extin­guished (Arti­cle 88 of the Com­mer­cial Code). A small ser­vice credit, with­out a state­ment that it does not exclude other claims, can become the cus­tomer’s only remedy.

The dead­line to claim. The ordi­nary statute of lim­i­ta­tions in com­mer­cial mat­ters is ten years, unless the Com­mer­cial Code sets a shorter period (Arti­cle 1047). A con­tract that requires the cus­tomer to file a claim within a few days or lose its right deserves care­ful review; with respect to con­sumers, a clause pro­vid­ing for lim­i­ta­tion peri­ods shorter than those set by law is deemed not writ­ten, under Arti­cle 90, sec­tion IV, of the Fed­eral Con­sumer Pro­tec­tion Law (Ley Fed­eral de Pro­tec­ción al Con­sum­i­dor).

When con­sumers or per­sonal data are involved. If the ser­vice is offered to con­sumers, a clause releas­ing the provider from civil lia­bil­ity is deemed not writ­ten, unless the con­sumer is in breach (Arti­cle 90, sec­tion II, of the Fed­eral Con­sumer Pro­tec­tion Law). If the provider pro­cesses per­sonal data on the cus­tomer’s behalf, it is a pro­ces­sor (per­sona encar­gada) under the data pro­tec­tion statute, and an affected data sub­ject may claim the appli­ca­ble com­pen­sa­tion from both the con­troller and the pro­ces­sor, under Arti­cles 2, sec­tion XII, and 53 of the Fed­eral Law on the Pro­tec­tion of Per­sonal Data Held by Pri­vate Par­ties (Ley Fed­eral de Pro­tec­ción de Datos Per­son­ales en Pos­esión de los Par­tic­u­lares, LFPDPPP).

What to do and by when

  1. Before sign­ing or renew­ing, define in writ­ing the avail­abil­ity level, how it is mea­sured, which main­te­nance win­dows are excluded, and who keeps the records.
  2. If you agree to ser­vice cred­its, decide expressly whether they are the sole remedy or whether they pre­serve the right to claim dam­ages for seri­ous breaches.
  3. Set the lia­bil­ity cap on a clear cal­cu­la­tion basis, for exam­ple a pro­por­tion of the amounts paid over a given period, and carve out of the cap will­ful mis­con­duct, breach of con­fi­den­tial­ity, and per­sonal data inci­dents.
  4. Review the force majeure clause so that it does not cover fail­ures of the provider’s sub­con­trac­tors or of its own infra­struc­ture.
  5. Agree on the return of your infor­ma­tion in a usable format and on a tran­si­tion period when the con­tract ends.
  6. Keep the con­tract and its sched­ules for at least ten years, as required by Arti­cle 49 of the Com­mer­cial Code.

Recommendations to mitigate risk

The main risk is con­trac­tual: absorb­ing losses the provider caused because the con­tract pro­tects the provider more than nec­es­sary. A cus­tomer that accepts a ser­vice credit as a con­trac­tual penalty, with­out an express reser­va­tion, in prac­tice waives the right to claim greater dam­ages. If the provider pro­cesses per­sonal data and a secu­rity breach attrib­ut­able to the con­troller occurs, the fine ranges from 200 to 320,000 times the Unit of Mea­sure­ment and Update (UMA), that is, MXN 23,462 to MXN 37,539,200, under Arti­cles 58, sec­tion XI, and 59, sec­tion III, of the data pro­tec­tion law. That fine falls on the con­troller, not on the provider, and the con­tract is the only way to pass the cost of the provider’s fail­ure on to the provider.

Self-assessment

Answer yes or no about the soft­ware con­tracts your com­pany signs or sells.

  1. Does the con­tract define how avail­abil­ity is mea­sured and who keeps the records?
  2. Do you know whether the agreed ser­vice cred­its exclude a claim for dam­ages?
  3. Does the lia­bil­ity cap carve out will­ful mis­con­duct, con­fi­den­tial­ity, and data inci­dents?
  4. Does the force majeure clause leave out fail­ures of the provider’s sub­con­trac­tors?
  5. Does the con­tract pro­vide for the return of your infor­ma­tion and a tran­si­tion period upon ter­mi­na­tion?
  6. If your plat­form is sold to con­sumers, do your terms avoid clauses that exclude civil lia­bil­ity?

How we approach it at LEXURE

We review the con­tract from the fail­ure sce­nario: what hap­pens if the plat­form stops, if infor­ma­tion is lost, or if there is a per­sonal data breach. Based on that anal­y­sis, we adjust ser­vice levels, cred­its, caps, exclu­sions, and exit terms so that each risk is allo­cated to the party that can con­trol it and the agreed remedy is pro­por­tion­ate to the poten­tial harm.

If your com­pany depends on a crit­i­cal plat­form or offers one to its cus­tomers, sched­ule a diag­nos­tic meet­ing with us and let us review the con­tract before the next renewal.

Schedule a diagnostic meeting See our service lines

Legal basis

  1. Federal Civil Code (Código Civil Federal), Articles 1840, 1843, 2104, 2106, 2108 to 2111, and 2117. Current text (opens in a new tab)
  2. Commercial Code (Código de Comercio), Articles 2, 49, 88, and 1047. Current text (opens in a new tab)
  3. Federal Consumer Protection Law (Ley Federal de Protección al Consumidor), Article 90, sections II and IV. Current text (opens in a new tab)
  4. Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares), Articles 2, section XII, 53, 58, section XI, and 59, section III. Current text (opens in a new tab)
  5. Value of the Unit of Measurement and Update 2026, National Institute of Statistics and Geography (INEGI). Official publication (opens in a new tab)

This note is for information only and describes the law in force on the verification date. It is not legal advice on a specific matter. It is a translation of the Spanish original: Mexican law is published in Spanish, and the official Spanish texts prevail.

Keep reading

Related notes.

See all notes