Duty of care IT supplier: does the IT client also have obligations?

In the article What does the duty of care for the IT supplier entail? I discuss what efforts are expected from an IT supplier. In the article, I also briefly discuss the consequences of breaching the duty of care. However, the IT supplier is not the only one who has responsibilities when executing the contract. The client also has certain responsibilities besides, of course, its obligation to pay. What is expected of the client? And what if the client breaches these responsibilities? This will be discussed in this article.

Does the IT client have a duty of care?

No, a client does not have a duty of care like the IT supplier does. Although it is not explicitly stated in the law, it is assumed that the client, on the other hand, does have a general obligation to act as a good principal. This means that the client should not hinder the IT supplier in his or her work. The client must also, to some extent, ensure that the IT supplier can properly execute the assignment. Just like the IT supplier’s duty of care, the obligation to act as a good principal applies, even if nothing about this is stated in the contract.

What is expected of the IT customer?

In order to determine what responsibilities the client has, one should first look at the contract. Does the contract say nothing about the client’s responsibilities in a specific situation? Then it is necessary to determine what can be expected of a ‘good principal’ in that situation. In general, the following is expected of the client:

• Cooperation: As mentioned, the client is expected to provide the necessary cooperation and to not obstruct the IT supplier in the execution of the project.
• Providing information: The client is expected to provide the requested information needed by the IT supplier to properly execute the assignment.
• Project discipline: In order to not unnecessarily frustrate execution of the assignment, the client is expected to stick to the project plan and agreements made therein. This could for example include agreements on task allocation and responsibilities.
• Following advice: To some extent, the client is also expected to listen to and follow the supplier’s advice. After all, the IT supplier is the expert.
• Timely warning: Does the client notice that something is not going entirely as planned? Then the client is expected to timely warn the IT supplier.

What if the client does not act like a good principal?

Has the client breached certain responsibilities, but have you not included these responsibilities in the contract? Then this will not be seen as a breach of the contract, as it would be the case with a breach of duty of care. In other words, the IT supplier cannot enforce that the client acts as a good principal. Only the specific responsibilities mentioned in the contract can be enforced.

That said, acting as a bad principal can affect the consequences of a breach of the IT supplier’s duty of care. An example from case law:

Let’s say, after a ransomware attack at the client’s premises, it is determined that the IT supplier has breached its duty of care. This because insufficient security measures were implemented in the IT infrastructure the supplier has provided. As a result, the client may for example claim damages from the supplier. However, it was the client who had rejected the proposed measures due to the high costs and who had set up easy passwords.

You may already sense that, in this case, it is unfair to hold IT supplier accountable for all damages when the client also contributed to them. Acting as a bad principal may therefore, in specific situations, result in the IT supplier having to pay less or even no damages when it is determined that it has breached its duty of care. When assessing whether and to what extent the IT supplier’s liability to pay damages should be reduced, factors such as the client’s expertise and the scope of the project will be taken into account.

Contact

Do you have any questions following this article? Or other questions about IT and ICT law? Then contact one of our lawyers by mail, telephone or fill in the contact form for a free initial consultation. We will be happy to think along with you.