Information technology lawyer Paris: the SME and its IT provider, from breakdown to contract exit.

Most often after an event that interrupts business: a server out of service, ransomware, data loss, software delivered unusable or a managed service provider that refuses to hand over access. Other cases begin earlier, when signing a quotation, renewing a maintenance contract or changing provider. In every case, the first question concerns the documents: what do the quotation, the general terms, the service level annex and the preliminary correspondence contain? The second concerns the facts: who administered the system, who received the alerts, who was responsible for backups? The remedies for non-performance are listed in Article 1217 of the French Civil Code (Code civil), but the choice among them depends on the evidence available and the seriousness of the breach. The firm can examine these elements, draft a formal notice, negotiate an orderly exit or bring the matter before the court. Drafting and negotiating clauses are covered on the page on IT contracts, and the conduct of proceedings after a failed project on the page on IT litigation.

Yes, to an extent that depends on the client's own competence. The professional must find out about the company's needs and inform it whether the proposed solution is suitable. The Reims Court of Appeal held that it was for the provider, “if it considered itself insufficiently informed, to refuse to commit, to enter reservations or to invite the client to specify its needs” (our translation) (CA Reims, 28 April 2026, No. 24/01502). In that case, an SME without in-depth IT skills had suffered a ransomware attack after an installation carried out by the provider; the court found a breach of the duty to advise. It nevertheless left half of the loss with the client, for lack of a specification and of sufficient information given to the provider. The pre-contractual duty of disclosure under Article 1112-1 of the Civil Code also has its limits: the Court of Cassation holds that “the pre-contractual duty of disclosure covers only information that has a direct and necessary link with the content of the contract or the capacity of the parties, and whose importance is decisive for the other party's consent” (our translation) (Cass. com., 14 May 2025, No. 23-17.948, published). It is therefore necessary to show what information was missing and why it would have changed the decision.

No, but the absence of a specification changes the discussion. The court then looks at whether the provider itself analysed the needs and supported its lay client. In a case concerning enterprise management software, the Paris Court of Appeal noted that “While the absence of a specification cannot be held against Avenir Déconstruction, a layperson” (our translation), the analysis days provided for and the exchanges showed that the provider had performed its obligation (CA Paris, pôle 5 ch. 11, 22 November 2024, No. 21/08604). The outcome went against the client: no serious breach having been shown, its termination was held wrongful and the contract was terminated at its sole fault, with payment of the sums due. Conversely, the Reims Court of Appeal found liable a provider that had not asked its client about its security needs, while sharing the loss equally (CA Reims, 28 April 2026). These decisions show that a case is decided on the real exchanges: the provider's requests, the client's replies, meeting minutes and alerts raised in writing. The firm reconstructs this thread before assessing the SME's position.

Its liability depends on the scope entrusted to it. If the contract made it responsible for administering and securing the system, a flaw attributable to its intervention may engage its contractual liability under Article 1231-1 of the Civil Code. The Paris economic activities court (tribunal des activités économiques) thus ordered a provider that, according to the judgment, “was responsible for setting up and maintaining the IT systems and was required to ensure their security” (our translation), to pay damages after an intrusion made possible by an overlooked filter (TAE Paris, ch. 1-3, 8 October 2025, No. 2024005541). This first-instance decision remains tied to its facts, notably the provider's written admission. Where the client itself contributed to the loss, for example by not expressing its security needs, liability may be shared, as the Reims Court of Appeal did. If the provider processes personal data on the company's behalf, it is a processor within the meaning of Regulation (EU) 2016/679 and must in particular comply with the security obligations in Articles 28 and 32. The firm begins by establishing the scope entrusted, the timeline of the attack and the technical report available.

Whoever was actually responsible for them, which the contract and the parties' practice allow to be established. A clause giving the client the daily checking of backups does not settle everything. The La Roche-sur-Yon commercial court held such a clause unenforceable, as it appeared in a draft contract that was never signed, and found that practice confirmed that the provider was responsible, noting that the client's staff “were neither competent, nor trained, nor involved in the management of backups” (our translation); it held the provider fully liable (T. com. La Roche-sur-Yon, 14 January 2025, No. 2023005634). The technician had disconnected the backups for tests and was the only one to receive the daily reports. A separate case concerns the erasure of backups on termination in 2023. The Paris Court of Appeal held that the action of a company whose data had been deleted on termination was manifestly doomed to fail, clear clauses having informed it of this deletion, noting that “The obligation to return intact files referred to in this article binds Nemoxia during the performance of the contract” (our translation) (CA Paris, pôle 1 ch. 2, 9 April 2026, No. 25/11299). This outcome does not prejudge the data-retrieval obligations that now apply to services falling within the scope of Regulation (EU) 2023/2854. The firm therefore reads the backup and termination clauses before a contract is ended.

It is possible, but risky if the non-performance cannot be shown. Article 1219 of the Civil Code allows a party to refuse to perform its own obligation where the other party fails to perform theirs and the failure is sufficiently serious. The burden of proving that seriousness lies on the party that suspends payment. The Rennes Court of Appeal recalled this to a catering business that complained of malfunctions by its till and software supplier: it had signed the last acceptance record without reservation and “shows no detailed request for intervention, as provided for in the contract”; the court concluded that “Consequently, the defence of non-performance is not justified” (our translation) (CA Rennes, 3e ch. com., 9 September 2025, No. 24/03931). The client was ordered to pay the invoices with interest. Another route exists for a poorly performed service: Article 1223 allows, after formal notice and if the price has not yet been paid in full, a proportionate price reduction to be notified as soon as possible; after payment, failing agreement, the reduction is sought from the court. The firm first checks the written reports, the unanswered tickets and the acceptance records signed, then chooses between suspension, reduction or termination.

By termination by notice, which requires a sufficiently serious failure to perform (Article 1224 of the Civil Code). Article 1226 sets out the procedure: prior formal notice, except in urgent cases, stating that failing performance within a reasonable time the contract may be terminated; then notification of the termination and of its reasons. The provider may challenge it before the court, and it is then for the client to prove the seriousness of the breach. For contracts concluded before 1 October 2016, the Court of Cassation also accepts that a party may end the contract at its own risk because of the other's serious conduct, and specifies that “In the event of a dispute, it is for the party that ended the contract to prove such conduct” (our translation) (Cass. com., 22 November 2023, No. 22-16.514, published). The risk is real: an ill-founded termination turns against the client, as in the case decided by the Paris Court of Appeal on 22 November 2024, where the contract was terminated at the sole fault of the company. The firm therefore prepares the formal notice, preserves proof that the breach continues and arranges the resumption of the service before notification.

In specific cases, which the courts apply strictly. Article 1231-3 of the Civil Code limits damages to foreseeable loss, except in the case of gross or wilful misconduct, and Article 1170 deems unwritten any clause that deprives the essential obligation of its substance. The Paris Court of Appeal recalls that “Only a clause limiting compensation that contradicts the scope of the essential obligation undertaken by the debtor is deemed unwritten” and that “clauses limiting liability or compensation may be set aside only in the case of fraud or gross misconduct” (our translation) (CA Paris, pôle 5 ch. 11, 1 December 2023, No. 21/06139). In that case, the compensation of a company that was a client of an operator was reduced to the amount invoiced over six months. For a standard-form contract, Article 1171 also allows a non-negotiable clause creating a significant imbalance to be set aside. Between commercial partners, Article L. 442-1 of the Commercial Code (Code de commerce) penalises submitting or attempting to submit the other party to obligations creating a significant imbalance, and the Court of Cassation specifies that “The assessment of a significant imbalance requires a concrete analysis of the overall economy of the contract” (our translation) (Cass. com., 26 February 2025, No. 23-20.225, published). The best protection remains negotiating the cap before signature.

An SME that leases its copiers, servers or workstations from a financing company, while another provider supplies the maintenance or services, is often caught between two contracts. Article 1186 of the Civil Code provides that, where several contracts are necessary for a single operation, the disappearance of one makes those that depended on it lapse, if the other party knew of the overall operation. The Court of Cassation draws a clear rule from this for operations including a financial lease: “In contracts forming an operation that includes a financial lease, clauses that are irreconcilable with this interdependence are deemed unwritten” (our translation) (Cass. com., 10 January 2024, No. 22-20.466, published). In that case, the lessor had obtained termination at the tenant's fault by relying on a clause requiring the tenant to find a new maintenance provider alone; the judgment was quashed in the tenant's favour. The outcome nevertheless depends on proof that the contracts belonged to the same operation; in the configuration decided, the Court inferred from the contract's inclusion in an operation comprising a financial lease that the lessor necessarily knew of the overall operation. The firm gathers the purchase orders, the delivery records and the correspondence between the supplier and the lessor before answering a claim for a termination fee.

First through the contract, then through the court if the provider blocks the transition. The urgent applications judge may prescribe the measures needed to put an end to a manifestly unlawful disturbance, even where there is a serious dispute, and order performance of an obligation to act whose existence is not seriously contestable (Article 873 of the Code of Civil Procedure). The Marseille economic activities court held that “reversibility is necessary for the client (user of the software or system covered by the contract) so that it can resume, at the end of the contract, the use of the data”, and that “the absence of reversibility of IT data causes a manifestly unlawful disturbance” (our translation); it ordered full reversibility and the handing over of the administrator codes (TAE Marseille, ord. réf., 17 June 2025, No. 2025R00202). For data processing services, notably cloud services, Regulation (EU) 2023/2854, applicable since 12 September 2025, requires in Article 25 a switching notice of no more than two months, a transition period of thirty calendar days in principle, extended to a maximum of seven months where technically unfeasible for stated reasons, then a data retrieval period of at least thirty calendar days. Its Article 29 limits switching charges to direct costs until 12 January 2027 and then prohibits them, with exceptions for custom-built services (Article 31). The firm draws up the list of data and access to be obtained before the exit date.

The judgment opening the proceedings does not end current contracts. Under Article L. 622-13 of the Commercial Code, applicable to reorganisation by Article L. 631-14, where an administrator is appointed, only the administrator may require the contract to continue, and the client must keep performing its own obligations. Where there is no administrator, the debtor exercises this option after the binding opinion of the creditors' representative (Article L. 627-2). The client may send the administrator a formal notice to take a position: if there is no reply for more than one month, the contract is terminated by operation of law, subject to a different period set by the supervisory judge. In liquidation, Article L. 641-11-1 applies the same mechanism to the liquidator. For an SME whose business depends on hosting or maintenance, the stakes are twofold: keeping the service during the transition and recovering its data before the failing company stops trading. Sums already paid for services not provided are a matter for filing a claim in the insolvent estate. The firm can act to question the administrator or liquidator, prepare the formal notice, arrange the return of data and check the filing of claims. Source code deposited with a third party, if provided for in the contract, must also be claimed under the terms of the deposit.

Often, where the technical cause of the incident is disputed. Article 145 of the Code of Civil Procedure allows an investigative measure to be requested before any proceedings if there is a legitimate reason to preserve or establish the evidence of facts on which the outcome of the dispute may depend. The judge does not order the measure automatically. The Paris Court of Appeal recalls that the applicant must “show that the potential dispute is not manifestly doomed to fail and that the measure is likely to improve the applicant's evidential position” (our translation) (CA Paris, pôle 1 ch. 2, 9 April 2026, No. 25/11299). In that case, the expert assessment was refused to a company whose data had been erased on termination, because the general terms provided for this deletion. The decision illustrates a common trap: the urgent applications judge reads the clear clauses of the contract before ordering an expert assessment. The firm therefore checks the provisions on backup, return of data and liability, then prepares a request for an expert assessment targeted at the technical points genuinely in dispute: the origin of the breakdown, the security configuration, the state of the backups or the conformity of the deliverable.

Obligations arising from trade between traders, or between a trader and a non-trader, are subject to a five-year limitation period, unless a shorter special limitation period applies (Article L. 110-4 of the Commercial Code). The general law provides for the same period, running from the day the right holder knew or should have known the facts enabling them to act (Article 2224 of the Civil Code). The starting point is therefore not always the date of signature: it may be the discovery of a malfunction, of a data loss or of a failed restoration. This five-year period should not obscure shorter and more practical deadlines. Technical logs are often overwritten after a few weeks, hosted data may be erased at the end of the contract, and an acceptance record signed without reservation makes it harder to challenge a deliverable. The time limits specific to insolvency proceedings against the provider add to this calendar. The firm establishes the timeline, identifies the basis of the action and checks the applicable period before any formal notice. It recommends acting on the evidence from the moment of the incident, even if the decision to go to court comes later.