In brief
- A recent Google Cloud outage in London disrupted services for major banks, the courts and millions of end users.
- Businesses affected by cloud outages should review their contracts carefully, including availability obligations, service credits, liability caps and notification duties.
- Those that plan for incidents before they happen will be best placed to manage the impact.
On 20 October 2026, a "power event" at Google Cloud's London data centre knocked out services for around six hours. Millions of end users were said to be affected, with service providers, including major banks and the courts of England and Wales, among those reported to have experienced disruption. The event has attracted significant media attention. On the same day as the outage, Dame Meg Hillier MP, Chair of the Treasury Committee, wrote to the Governor of the Bank of England and the Chief Executive of the FCA seeking details of the incident's impact on UK financial services, the authorities' response and lessons learned for the resilience of the UK's financial system.
In this article, aimed at businesses that operate cloud-based technology products or rely on cloud-based software in their business operations, we unpick the role of cloud providers in the wider tech stack and set out some key contractual considerations for when things go wrong further down the stack.
The (cloud) tech stack
To understand the impact of cloud outages and the associated contractual rights, it helps to understand the tech stack. The stack is a rapidly evolving concept, the shape of which changes depending on the technology it supports. In broad terms, a simple cloud tech stack includes:
- Software as a Service (SaaS) - providers deliver fully built applications to end users over the internet, such as email, collaboration tools or banking platforms.
- Platform as a Service (PaaS) - offers a development environment on top of that infrastructure, allowing customers to build, test and deploy applications without managing the underlying hardware.
- Infrastructure as a Service (IaaS) - offers virtualised computing resources such as servers, storage and networking, giving customers the building blocks to run their own systems in the cloud.
- Cloud providers - principally the “hyperscalers” (Google Cloud, Amazon Web Services and Microsoft Azure). The hyperscalers operate vast data centre networks providing on-demand processing power, storage capacity and networking resources to technology providers further up the stack.
End users typically interact only with the top of the stack and may have little or no visibility of the layers beneath. Many will not know which cloud provider underpins the service they are using. Some technology providers offer solutions designed to operate across more than one cloud provider. In some cases, a single service may draw on infrastructure from multiple cloud providers simultaneously. A cloud outage may therefore affect some users but not others, or may affect only certain features.
What to do if your business is affected
Cloud outages are likely to occur in the future and, as reliance on cloud infrastructure grows, their impact will only become more significant. The following framework sets out the key issues to consider.
Contractual landscape
Businesses hosting their SaaS applications on cloud infrastructure may not always have a direct contractual relationship with the underlying cloud provider. They will, however, have agreements with technology providers at various levels of the stack. Those agreements will typically address a number of key terms:
- Availability obligations: Most service-level obligations do not promise 100% uptime, just a target percentage over a period. There are likely to be carve-outs for maintenance, third-party failures or force majeure. A cloud outage could fall within those carve-outs, but that requires a proper review of the agreement.
- Enhanced terms: Regulated customers, such as banks or operators of critical infrastructure, sometimes have tighter service-level obligations or bespoke remedies. It is important to understand the service provider's obligations.
- Incorporation of cloud providers' terms: Many contracts incorporate the provider's terms by hyperlink to a frequently updated external page rather than appending a static copy. Identify the version incorporated into your agreement and check whether subsequent changes were validly introduced under its variation provisions. Consider whether the contract includes notice requirements for variations to those terms and, if so, whether they have been complied with.
Loss, remedies and response obligations
Businesses should start by working out what loss has been suffered. That could include lost sales, wasted staff time, reputational harm or regulatory exposure. It is important to keep a contemporaneous record while events are fresh (including timestamps, customer complaints, lost transactions and internal communications) in case a claim is pursued at a later stage.
- Service credits: These are often the sole contractual remedy for downtime. Confirm your entitlement, the claims process, time limits and whether credits exclude a separate damages claim.
- Liability caps and exclusions: Review whether the contract excludes liability for certain types of loss, such as indirect or consequential loss, lost profits or loss of data. Even where loss is not excluded, agreements are likely to contain liability caps (often tied to recent fees paid) which can be low relative to losses. A cap may be vulnerable to challenge, particularly where it is contained in standard terms rather than freely negotiated.
- Notification duties: Consider whether the outage triggers your own obligations to tell your customers, regulators or insurers.
- Mitigation: Alternative providers, back-up systems and contingency plans may matter as much as the cause of the failure itself. Parties are expected to take reasonable steps to mitigate their loss, so it is worth reviewing what was done during the outage and whether more could have been done. It is also worth putting a mitigation plan in place now, before the next incident occurs.
How Mishcon de Reya can help
The businesses best placed to respond to cloud outages are those that have already taken the time to understand their contractual landscape, map their position in the tech stack and think through their options before an incident occurs.
If you have questions about your agreements or would like help putting a response plan in place, our Technology Disputes team would be happy to assist. Please do get in touch.