An MSA Review Should Test the Liability Cap Against Your Smallest, Riskiest SOW

A master services agreement (MSA) sets the legal terms for a commercial relationship. Each statement of work (SOW) signed under it adds the scope, deliverables, and fees for one project. An MSA review is the legal review of those master terms before signature, and because SOWs usually inherit them, it also sets the rules for SOWs nobody has drafted yet.

Take a hypothetical MSA your company is about to sign with an IT services provider. SOW-1 for implementation ($1.2 million) and SOW-3 for support ($300,000, billed annually in advance) are signed with the MSA. SOW-2, a $40,000 migration of customer personal data, follows four months later. All figures in this example are illustrative.

Ten months after the MSA is signed, partway through SOW-2, a breach exposes the migrated customer data and leads to a $2 million claim against the provider. Whether the cap limits that claim to $40,000 or leaves room for all of it turns on a few words in the MSA's limitation of liability. Those words get settled during the MSA review, months before SOW-2 is written.

We’ll follow this MSA from the provider’s first draft to the SOW-2 signature and show where legal AI helps. Harvey takes the first pass, finding the cap, precedence, and survival terms and comparing them with your playbook, so counsel’s time goes to the terms that decide the claim.

The Cap Definition Decides Whether a $2 Million Claim Gets Limited to $40,000

The provider's draft caps its liability at the fees paid or payable under "the applicable SOW" in the 12 months before the claim. That reads as standard until you run it against SOW-2, the smallest SOW and the one carrying customer data.

Here’s how far the same $2 million claim could go under three hypothetical cap wordings, assuming the cap is the only limit in play:

The provider’s draft lands at the bottom because the riskiest SOW carries the smallest fees. Counting fees under all SOWs, plus a data super-cap, puts the limit above the full claim. Harvey can do this reading for counsel. With the draft MSA, the SOWs signed alongside it, and the team’s executed MSAs in Vault, a review table lines up the cap wording against each SOW’s fees and against the cap positions the team has accepted before, each answer linked to its source. Counsel sees how small the cap gets on a low-fee, high-risk SOW before negotiation starts.

A weak cap in the MSA carries into every SOW signed under it, which is why the cap sits near the top of any contract review checklist.

An MSA Review Should Test Three Terms That Reach Into Future SOWs

The cap basis, the order of precedence, and the termination and survival terms all bind SOWs that don't exist yet. Here's the hypothetical wording your team negotiated for each one, and why it matters for SOW-2. Harvey checks each of these terms in the provider’s draft against your playbook and marks where the draft departs from it, so counsel negotiates three clauses instead of hunting for them in a long draft.

Cap Basis Sets Which Fees Count and When

"Each party's total liability under this Agreement and all SOWs shall not exceed the fees paid or payable under all SOWs in the 12 months before the claim arose. For breaches of Section 11 (Data Protection), the limit is the greater of $1,000,000 or 3 times those fees."

"Paid or payable" counts fees owed but not yet paid, while "paid" alone can shrink the base if your company withholds payment during a dispute. The phrase "under all SOWs" raises the limit on the SOW-2 claim from $40,000 to $1,540,000, and the Section 11 sentence lifts it above the full $2 million. In this example, the super-cap replaces the general cap for Section 11 claims, so the two limits don't stack. It covers all Section 11 claims together, the consequential loss exclusion still applies, and the claim here is a direct Section 11 claim, outside the MSA's indemnities.

Order of Precedence Controls Whether an SOW Can Rewrite the Cap

"If this Agreement conflicts with an SOW, this Agreement controls. No SOW may amend Section 9 (Limitation of Liability) or Section 11 (Data Protection), which change only by a written amendment to this Agreement signed by both parties."

The provider's draft said the SOW controls any conflict, so one sentence in a later SOW could rewrite the cap. A common middle ground lets the MSA control unless the SOW expressly identifies the MSA section it modifies, which still leaves a narrow route open. Locking Sections 9 and 11 to MSA amendments narrows that route. How far a court honors the lock against a later signed SOW depends on the wording and your governing law.

Termination and Survival Decide What Outlasts Each SOW

"Termination of one SOW doesn't end any other SOW. If this Agreement ends, each open SOW continues under these terms until it ends. Sections 9, 10 (Indemnification), and 11, and the confidentiality obligations, survive termination."

The provider's draft ended all open SOWs when the MSA ended and listed only payment and confidentiality as surviving. Under that wording, terminating the relationship for cause after the SOW-2 breach would also stop SOW-1's implementation midstream. Naming Section 9 expresses the parties' intent for the negotiated cap and data super-cap to apply after termination, subject to the governing law. Section 11's data return and deletion duties also need to outlast the migration they cover.

A One-Line SOW Override Can Reopen the Cap Months After Signing

In the example, four months after the MSA is signed, the provider sends SOW-2 for the data migration. Its liability paragraph contains one sentence: "Solely with respect to this SOW, Provider's total liability shall not exceed the fees paid under this SOW." If that sentence holds, the $2 million claim is limited to $40,000, and to less if only part of SOW-2's fees were paid when the breach hit. The super-cap would no longer reach SOW-2 claims either.

Drafters have used this move before. In DecisivEdge v. VNU Group (Del. Super. Ct. 2018), a later agreement the parties called an SOW deleted the MSA's limitation of liability section "solely with respect to this Statement of Work." The court never decided which document controlled, so the case shows the drafting pattern rather than a rule.

Under your negotiated MSA, Section 9 changes only by a written amendment, so the SOW-2 sentence conflicts with the lock. Counsel strikes it before signature anyway, because how a court treats a later signed SOW depends on its wording and the governing law. Privacy and security reviewers also sign off on SOW-2, since it moves customer personal data, and SOW-2 is signed without the override. The same playbook review works after signature. Harvey checks SOW-2 against the negotiated MSA terms in the playbook and flags the liability sentence that conflicts with Section 9, so the override gets caught in the SOW review instead of after a claim.

Harvey Runs the First Pass on an MSA Contract Review so Counsel Can Focus on What SOWs Inherit

Most of an MSA's first pass goes to finding the cap, precedence, and survival terms in a long provider draft and comparing them with your positions. Contract Intelligence, Harvey’s contract review AI, reviews the provider’s draft against your playbook as it arrives and returns redlines on the terms the playbook covers. Counsel starts from those redlines and checks them against the MSA before anyone relies on them.

Those positions have to exist first. Harvey's Playbook Builder can build them from your standard MSA template and the MSAs you've already signed. For the cap, that gives counsel a rule based on the positions the team has accepted before, with citations back to the agreements behind it.

For a team that signs MSAs every month, that first pass is where legal AI saves the most time. The same positions apply to every inbound draft and every SOW that follows, and counsel’s review goes to the exceptions.

In Practice: Dentsu used Harvey on a large outsourcing agreement with 112 change notes accumulated over four years, which needed to be consolidated and restated. Dentsu says that with Harvey, it could save time and cost on the initial review and documentation of the revised agreement.

For a closer look at clause-level drafting, this Harvey in Practice video shows how Harvey can help strengthen contract clauses and make agreements more consistent.

Watch Video

Six Checks Show Whether the MSA Will Work Before You Sign

The three terms above set the structure, and a few checks decide whether the structure holds in your company. This master service agreement checklist covers what the cap test and the SOW-2 override don’t. Harvey can pull the defined terms, carve-outs, and caps from your executed MSAs into a review table, so the first three checks start from your own deal history:

• Price the cap against the riskiest SOW you expect. Run the worst plausible claim from the SOW with the least fees and the most sensitive data, the way SOW-2 tested the provider's draft.
• Read the defined terms behind the cap. If "Agreement" excludes SOWs, or "Fees" excludes pass-through costs, a whole-agreement cap can count far less than it appears to.
• List what sits outside the cap. Indemnities, confidentiality, and IP claims often carry their own carve-outs, so compare them with past deals by benchmarking indemnification clauses against your deal history.
• Add specialists by trigger. Privacy and security join when an SOW touches personal data, insurance compares any gap above the cap with your cyber coverage, and IP counsel joins for licensed software. An unfamiliar governing law or contracting entity also goes back to counsel.
• Name who reads each new SOW. Decide who checks each SOW's liability language against Sections 9 and 11 before signature. Teams that let the business run first passes on supplier contracts can add that language to their escalation triggers.
• Confirm who can sign an SOW. Match SOW signing authority to your delegation of authority, so no one signs an SOW that accepts terms the MSA reserved for an amendment.

Harvey Gives Counsel Time for the Terms Each SOW Inherits

The provider's MSA arrived with a cap that would have limited a $2 million SOW-2 claim to $40,000. After the review, the $4,620,000 data super-cap sits above the same hypothetical claim, and SOW-1 and SOW-3 no longer end automatically if the MSA ends after the breach. The MSA review set those terms before SOW-2 existed, and the SOW-2 review kept them in place by striking the override.

For in-house legal teams that review MSAs at volume, Harvey runs the playbook first pass on inbound MSAs, so counsel's time goes to cap basis, precedence, and survival. Request a demo to see Harvey review an inbound MSA against your playbook.

MSA Review Questions, Answered

What does MSA stand for in a contract review?

In contract review, MSA stands for master services agreement, and an MSA contract sets the default terms each SOW signed under it inherits. In workers' compensation, the same letters usually mean a Medicare Set-Aside, an unrelated arrangement with its own review process.

Which document wins in an MSA vs SOW conflict?

The order of precedence clause decides first, so read it before anything else. Without one, courts usually try to read the MSA and SOW together so both can stand. If they still conflict, courts may favor the more specific term or the later document, and results turn on the wording and your governing law.

Is there a faster way to review MSAs with AI?

Yes. Harvey reviews an inbound MSA against your playbook and returns redlines on the terms it covers, so counsel starts from a marked-up draft. Speed also comes after signature. Once Sections 9 and 11 are locked, each new SOW needs a shorter check on whether its liability language tries to change them.

Is it safe to let AI review redlines on an MSA?

It can be, when a lawyer checks each redline against the MSA and your playbook before it goes to the provider. Check the tool's data handling too, since an MSA draft carries pricing and commercial terms your team keeps confidential.