The Business Continuity Clause: What It Means and How to Negotiate It (2026)

What is a business continuity clause? A business continuity clause requires a party, usually the supplier, to maintain a plan that keeps critical services running through a disruption, whatever its cause. Unlike a disaster recovery clause, which focuses on restoring IT systems and data, a business continuity clause covers the whole operation: people, premises, systems and key subcontractors. Its purpose is continuity of service, not just a technical restore. You see this clause in outsourcing, managed-services, cloud and critical-supply contracts, and in any arrangement where the customer could not easily carry on if the supplier stopped delivering. It matters because disruptions are rarely purely technical. A fire, a strike, the failure of a key subcontractor or a pandemic can stop a service as surely as a server crash, and business continuity is the clause that addresses all of them. This article is general guidance, not legal advice. Continuity obligations are mandated by regulators in some sectors, and those rules vary by jurisdiction, so have a qualified professional adapt any clause to your deal and your regulatory position. ## What a business continuity clause actually does A clear clause settles five things: 1. The plan. A business continuity plan (BCP) the supplier must maintain and keep current.

2. Scope. Which services are critical, and the maximum time the business can tolerate them being down (the maximum tolerable period of disruption, or MTPD).
3. Dependencies. How the supplier covers its own key staff, premises and subcontractors.
4. Testing. How often the plan is tested and what evidence the customer receives.
5. Invocation and force majeure. When the plan is triggered, how the customer is told, and that a disruption the BCP is built to handle is not simply waved away as force majeure. ## Sample business continuity clause wording Use this as a starting point, not a finished clause. Adapt the brackets to your deal. ``` BUSINESS CONTINUITY 1. BCP. The Supplier shall maintain and keep current a business continuity plan (the "BCP") to ensure continued performance of the critical Services through a disruption, including loss of premises, staff, systems or key subcontractors. 2. Content. The BCP shall identify the critical Services, the maximum tolerable period of disruption for each, recovery priorities, alternative sites and resources, and communication procedures. 3. Subcontractors. The Supplier shall ensure its key subcontractors maintain equivalent continuity arrangements for the parts of the Services they provide. 4. Testing. The Supplier shall test the BCP at least [annually], provide the Customer a summary of results within [N] days, and remediate material gaps. 5. Invocation. On a disruption the Supplier shall invoke the BCP, notify the Customer within [N] hours, provide regular status updates, and not treat a disruption the BCP is designed to address as a Force Majeure event that excuses performance.

- **Subcontractors (clause 3).** A supplier's continuity is only as strong as its own key suppliers. Flow the obligation down so a subcontractor's failure does not become your outage.
- **Testing (clause 4).** Like disaster recovery, a continuity plan that is never tested is just a document. Require regular tests, shared results and a right to audit.
- **Invocation and force majeure (clause 5).** The common trap is the same as with disaster recovery: a disruption the plan was built to handle gets excused as force majeure. Say clearly that the BCP applies and must be used to keep critical services running. ## Negotiation points **If you are the customer:** - Define critical services and the MTPD precisely, because they set the standard the plan must meet.
- Require the supplier's key subcontractors to have equivalent continuity cover.
- Insist on regular testing with shared results and a right to witness or audit.
- Make clear that a disruption the BCP addresses is not excused by force majeure, and link failures to credits, step-in rights or termination. **If you are the supplier:** - Keep the scope to genuinely critical services, with realistic MTPD figures.
- Keep testing proportionate and define what a material gap is.
- Be clear about dependencies on the customer and on events genuinely beyond any plan.
- Distinguish a true catastrophe (a legitimate force majeure) from ordinary disruptions the BCP must cover. ## Common mistakes to avoid - Treating business continuity and disaster recovery as the same thing, and covering only the IT restore.
- No MTPD or list of critical services, so the plan has no standard to meet.
- Ignoring subcontractors, so a key sub-supplier's failure becomes your outage.
- Letting force majeure excuse disruptions the plan was designed to handle.
- No testing or evidence, and no notification timeline when a disruption hits. ## A note on jurisdiction Business continuity is mostly contractual, but it is reinforced by sector rules that vary by jurisdiction. Financial services regulators in particular require firms and their critical suppliers to maintain continuity and operational resilience: in India the Reserve Bank of India has issued relevant directions; in the EU the Digital Operational Resilience Act (DORA) addresses operational resilience for financial entities and their ICT providers; in the UK the FCA and PRA have operational resilience rules with impact-tolerance concepts similar to the MTPD. The international management standard for business continuity is ISO 22301, which contracts often reference; it is a standard, not a law. If you operate in a regulated sector, align the clause with your regulator's expectations and get local advice. Last verified October 2026. ## Keeping continuity real over the life of a contract Agreeing the plan once is the easy part. The hard part is making sure the supplier actually tests it each year, that key subcontractors keep equivalent cover, that you receive and review the evidence, and that you can find the critical-service list and MTPD quickly when a disruption is unfolding. Drafting a business continuity clause, reviewing it for gaps such as no subcontractor flow-down or no MTPD, and tracking the annual test dates and the evidence you receive can all sit in one AI workspace tuned to how your company contracts, so the critical-service list and test evidence stay findable when a disruption hits. [Adira](https://adiralaw.com) is one such workspace for continuity terms and the obligations behind them. This guide alone is enough to negotiate a fair business continuity clause.