Indemnification Clauses, Explained: What 'Hold Harmless' Actually Costs You

A freelance journalist named someone in a "most corrupt" listicle in 2013. The person sued. Forbes pointed at the freelance contract, declined to defend her, and she paid her own legal bills out of pocket. The clause that did that was about a paragraph long, and it's in almost every freelance and B2B contract you've signed.

An indemnification clause is the sentence where one party agrees to pay for the other party's legal problems. In a vendor agreement, an MSA, a freelance contract, or a SaaS subscription, the indemnification clause is usually the part that turns a $5,000 deal into an unlimited bet. Most readers skim it because they've never seen the word "indemnify" in real life. The companies sending you the contract know that.

Here's what the clause actually says, the four flavors and which one is dangerous, and the negotiation ladder that gets you out of the worst version.

TL;DR

• "Indemnify" means "pay the other side back if they lose money or get sued because of you."
• Severity tiers: High risk is uncapped, one-way, with a duty to defend. Medium risk is mutual or capped at fees paid. Low risk is mutual, capped, and limited to fraud or IP infringement.
• The duty to defend is the part that hurts. You pay attorney fees as the case unfolds, even if you eventually win.
• Most indemnity language is negotiable. The negotiation ladder is short: ask for mutual, carve to sole negligence, cap at 12 months of fees, walk if they refuse.

What an indemnification clause actually says

A typical clause in a B2B SaaS agreement:

Customer shall defend, indemnify, and hold harmless Provider, its
affiliates, and their respective officers, directors, employees, and
agents from and against any and all claims, damages, losses, costs,
and expenses (including reasonable attorneys' fees) arising out of or
related to Customer's use of the Services or breach of this
Agreement.

In plain English: if anyone sues the vendor over something you did with their software, or anything they decide is "related to" your use of it, you pay their lawyer. You pay the judgment. You pay the settlement. You pay even if the vendor's own product caused half the problem, unless the clause says otherwise.

Three words to grep your contract for: defend, indemnify, and hold harmless. They look like a single legal phrase but they do different things. "Defend" means you pay the lawyer as the case is fought. "Indemnify" means you cover the loss when the case ends. "Hold harmless" means the other side keeps their money no matter what. A well-drafted clause separates them. A bad one welds them together and you don't notice.

The four flavors, ranked by how much they hurt

High risk One-way, uncapped, broad scope. "Customer shall defend, indemnify, and hold harmless Provider … from any and all claims arising out of or related to this Agreement." No dollar cap, no carve-out for the vendor's own negligence, no mutuality. This is the version enterprise legal teams send to small vendors and freelancers and it's the one that wakes people up at 3 a.m.

Medium risk One-way but capped. "Customer's aggregate liability under this Agreement, including all indemnification obligations, shall not exceed the fees paid by Customer in the twelve (12) months preceding the claim." The cap is doing the work. A $50K project carries $50K of risk, not $50M.

Medium risk Mutual but uncapped. Both sides indemnify each other for their own breaches. Sounds fair on paper. In practice, the bigger party can absorb a $5M defamation suit and the smaller party can't. Mutuality without a cap protects nobody who isn't already insured.

Low risk Mutual, capped, carved out. Each party indemnifies the other for narrow, named triggers: third-party IP infringement, gross negligence, willful misconduct, breach of confidentiality. Cap matches the deal size. This is what reasonable B2B contracts look like and what the negotiation should land on.

The four flavors side by side:

Flavor	Severity	Scope	Cap	Mutuality	Worst case
One-way, uncapped, duty to defend	High risk	"Any and all" claims arising from the agreement	None	One-sided	Unlimited
One-way, capped	Medium risk	Same broad scope	12 months of fees is standard	One-sided	Up to the cap
Mutual, uncapped	Medium risk	Each side's own breaches	None	Both ways	Whatever the suit finds, both sides exposed
Mutual, capped, carved	Low risk	Named triggers only (IP, gross negligence, confidentiality)	Matches deal size	Both ways	Cap, with separate super-caps on named carve-outs

The duty to defend is the part that hurts

The American Bar Association lays it out clearly: the duty to defend triggers the moment a complaint is filed, while the duty to indemnify only kicks in once liability is determined. Translation: if a claim lands tomorrow, your legal bills start tomorrow, even if the claim is bogus and you eventually win.

A freelance writer's typical errors-and-omissions policy covers $1 million per claim from Insureon. Defamation defense alone routinely runs higher. And E&O policies are claims-made and exclude liability assumed by contract beyond common law, which is exactly what an indemnity clause does. So the indemnity obligation you signed is mostly uninsured exposure.

This is the trap inside the trap: you can be solvent, careful, and right, and still go bankrupt paying for a lawyer to prove it. The duty to defend is the part of the clause that does the bankrupting.

The negotiation ladder

The other side expects you to push back. Five moves, in order:

1. Ask for mutuality first. "Each party shall indemnify the other for…" If they're asking you to indemnify them, the simplest fairness move is asking them to do the same. Counterparties who refuse mutual indemnity are telling you who they are.
2. Carve down the scope to "sole negligence." "Indemnitor's obligation applies only to the extent claims arise from Indemnitor's gross negligence, willful misconduct, or breach of this Agreement." Now you're not paying for their bad acts mixed with yours.
3. Cap it. "Indemnification obligations shall not exceed the fees paid by Customer in the twelve (12) months preceding the claim." 12 months of fees is the dominant market standard for SaaS and consulting. Negotiate this in writing or it's not real.
4. Carve indemnity OUT of the cap, narrowly. Enterprise contracts often pull IP infringement and confidentiality breaches outside the general cap, with separate "super caps" of 2x to 5x annual fees. Fine, but only if every uncapped item is named.
5. Walk if the answer is no on all four. If a counterparty refuses mutual, refuses a cap, refuses any carve-out, and insists on duty to defend, that itself is information about the deal. The risk has been priced into the contract and the price is your business.

An indemnification clause is the most common version of the shifted risk shape from the contract red flags playbook. The other side's exposure becomes your exposure, and the language doing the shifting is usually four lines long. The same shape shows up in personal guarantees, the other place small-business owners learn the same lesson the hard way.

The AI indemnification flip

In late 2023 something interesting happened. The vendors started indemnifying customers.

• Microsoft Copilot Copyright Commitment, announced September 7, 2023, effective October 1, 2023. Microsoft agreed to defend paid Copilot customers against copyright claims arising from generative outputs.
• OpenAI Copyright Shield, announced November 6, 2023, covering ChatGPT Enterprise and API customers.
• Adobe Firefly indemnification, launched June 2023 for enterprise commercial users. Firefly was trained on licensed and public-domain content, which made the offer credible.

The pattern is the bigger party with deeper pockets and more legal risk taking the indemnity onto its own side. If your AI vendor isn't offering this, ask why. If it is, read what's covered and what's excluded. "Subject to Customer using the latest version of the Services and not modifying outputs" is the most common limitation and it does a lot of work.

For a related angle, payment-terms language often interacts with indemnification in ways that make a default worse than it looks: late-fee acceleration plus an uncapped indemnity is a much worse deal than either alone. The payment terms in contracts guide covers the acceleration shape.

Redline scans contracts in plain English. Photograph an MSA, paste a vendor agreement, or upload a SOW. It flags indemnification clauses, calls out duty-to-defend language, identifies whether the cap protects or excludes indemnity, and explains exactly what your specific contract puts on the line. One scan, one dollar. Available on iOS and Android.