You have just been sent a services contract to sign, or you are about to send your own terms to a client, and attached to it is a schedule headed "Service Level Agreement". Everyone treats that schedule as the operational part, the page with the uptime percentages and response times. In practice it is the clause that gets tested first, the moment anything goes wrong.
An SLA, short for service level agreement, is a contractual document that sets measurable standards for an ongoing service and states what happens if those standards are missed. There is no statutory definition of an SLA in Australian law. It is a creature of contract, which means it binds the parties only because it sits inside, or alongside, a services agreement. It supplements the main contract by spelling out how well a service will be delivered, and it displaces informal promises like "we'll look after it" with targets either side can actually check.
The clauses that do the work
Whether your SLA covers IT support, software as a service, a marketing retainer or outsourced logistics, most well-drafted Australian SLAs use the same building blocks. Each one below has a job to do, a drafting choice that matters most, and a trap that causes downstream problems.
Services in scope, and what is out of scope
The SLA should state precisely which services it applies to, which systems, locations and users are covered, and what the customer must provide for the service to work. Assumptions matter here: the customer supplying access, credentials and a named point of contact, or keeping its own environment patched, are classic conditions on which every target depends.
- Scope: define the covered services by reference to the services schedule in the main contract, not by repeating it.
- Assumptions: list what the customer must do, because missed targets are usually argued over who failed first.
- Exclusions: state what is not covered, such as changes outside the agreed environment or work that is really a new project.
The trap is scope creep. Once a provider has fixed a fault, the customer often assumes every related task is included "because you're our provider". An exclusions list is the cheapest way to stop that assumption becoming a dispute. If the parties cannot agree on what is in scope, they should not be signing the SLA.
Support hours and how a request gets logged
Spell out when support is available, business hours or 24/7, how a request must be made, by portal, email or phone, and what information the request needs to contain. State what happens on public holidays and after hours, and whether an automated acknowledgement counts as a response.
- Service hours: business hours only is a legitimate choice for a small provider; the error is leaving the position unstated.
- Request channels: require requests through a single tracked channel so that response times can be measured honestly.
- Public holidays: a one-line carve-out avoids arguments about whether Christmas Day counts toward a four-hour response target.
The drafting choice that matters is making the hours match the team. A two-person support desk that promises round-the-clock coverage has created a target it cannot meet, and the SLA will record that failure every month.
Priority levels
Most SLAs grade faults into severity levels, usually labelled P1 to P4, and attach different targets to each. The categories only work if they are concrete.
- P1 critical: a full outage or a severe security incident affecting all users.
- P2 high: a major function is impaired and there is no workaround.
- P3 medium: partial impairment with a workaround available.
- P4 low: a minor issue or a general question.
The drafting choice is to anchor each level to examples rather than adjectives. "Major functionality" invites argument; "the invoicing module cannot be used and no workaround exists" does not. Customers will always want faults classified at the highest level, and providers at the lowest, so the SLA should say who decides, and how a wrong classification is appealed.
Response and resolution targets
This is the heart of the SLA. Response time means how quickly the provider acknowledges the request and starts work. Resolution time means how quickly the fault is fixed, or a workaround provided. They are different promises and should carry different targets, usually a faster response and a slower resolution.
- Response vs resolution: a one-hour response promise says nothing about when the fault will actually be fixed.
- Automated vs human: if the provider uses an automated ticket acknowledgement, the SLA should say whether that satisfies the response target or whether a person must engage.
- Third-party delays: resolution targets should allow for factors outside the provider's control, such as a downstream supplier's outage or the customer waiting to provide information.
There is also a legal reason to be careful with targets. Statements in an SLA are representations made in trade or commerce, and promising a response time the provider knows it cannot sustain can expose it to a claim under s 18 of the Australian Consumer Law (the ACL), which is Schedule 2 of the Competition and Consumer Act 2010 (Cth), for misleading or deceptive conduct. The safer drafting approach is a target the provider has actually met in practice, plus an agreed exclusion list.
How performance is measured and reported
A target that cannot be measured is not a target. The SLA should fix how performance is calculated, what tools are used, what counts as downtime, whether scheduled maintenance is excluded, and how often the provider reports, monthly or quarterly, and to whom.
- Uptime calculation: define the measurement period and method, because 99.5% looks different calculated over a month than over a year.
- Downtime definition: state whether scheduled maintenance counts, and how monitoring is performed.
- Reporting: fix the cadence, the recipient and the format, so missed targets cannot be buried until renewal.
The drafting choice that matters most is objectivity. If the provider measures its own uptime with its own tool and the customer has no right to verify, the metric is effectively unenforceable. A right for the customer to inspect the monitoring data, or to nominate an independent monitor, is worth far more than a higher percentage.
Remedies for missed targets
This is the commercially sensitive part of the SLA. Common remedies include service credits, usually a percentage of the monthly fee, repeat service at no cost, an escalation process with agreed service improvement steps, and termination rights if failures are repeated or severe. The drafting choice is whether the remedy is the customer's only recourse or sits alongside other rights.
Where the customer is a business and the services are not of a kind ordinarily acquired for personal, domestic or household use, s 64A(2) of the ACL allows the contract to limit liability for a failure to comply with a consumer guarantee to re-supplying the services, or paying the cost of having them supplied again, and that limitation is not void under s 64. So a B2B SLA can legitimately say "our only liability for a missed target is a service credit", but only if the term is fair and reasonable in all the circumstances, which s 64A(3) asks a court to assess by reference to the parties' bargaining power and whether the customer had a real alternative. For a consumer customer, that route is not available, because the statutory guarantees cannot be excluded at all.
A small provider should also check the numbers before promising credits. A remedy of 50% of the monthly fee for a P1 breach sounds generous, but if one breach wipes out the margin on the whole engagement, the provider will be tempted to fight every classification, and the relationship deteriorates.
Data handling and privacy obligations
Many SLA-covered services involve personal information: customer records, employee details, system logs or marketing databases. The Privacy Act 1988 (Cth) applies where the entity handling the information is an APP entity. Under Australian Privacy Principle 11, an APP entity must take such steps as are reasonable in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Part IIIC of the Privacy Act also requires an APP entity to notify affected individuals and the Office of the Australian Information Commissioner when an eligible data breach occurs.
- Flow-downs: the main contract should require a provider handling personal information to comply with the APPs, maintain reasonable security safeguards and cooperate with any breach notification.
- Confidentiality: treat the customer's data as confidential and restrict its use to performing the service.
- Notification: agree who tells the customer about a suspected breach and how quickly, so the customer can meet its own obligations.
Even where the provider is not itself an APP entity, the customer often is, and will want contractual assurances it can rely on. An SLA that says nothing about data handling leaves that gap open.
The guarantees an SLA cannot override
Where services are supplied to a consumer, the ACL implies guarantees that the services will be rendered with due care and skill (s 60), will be reasonably fit for any purpose the customer made known (s 61), and will be supplied within a reasonable time where the contract fixes no time or method (s 62). A person is a consumer for these purposes if the price is $100,000 or less, or the services are of a kind ordinarily acquired for personal, domestic or household use, under s 3 of the ACL.
Section 64 of the ACL makes void any term that purports to exclude, restrict or modify those guarantees. This means an SLA cannot be drafted as a complete code of the provider's obligations for consumer customers: a clause saying "service credits are the customer's only remedy" does not stop a consumer relying on the statutory guarantee of due care and skill. For most business-to-business services, the guarantees do not apply at all, which is why the s 64A(2) cap described above works in that context.
There is a second overlay for standard form contracts. Under s 23 of the ACL, a term of a consumer contract or a small business contract is void if it is unfair, meaning it causes a significant imbalance in the parties' rights and obligations, is not reasonably necessary to protect the legitimate interests of the party advantaged by it, and would cause detriment if relied on, as s 24 defines the test. A small business contract is one where at least one party employs fewer than 100 persons or has an annual turnover under $10 million. Proposing or relying on an unfair term in that setting is now itself a contravention attracting civil penalties, not just a void term. A one-sided SLA that gives the provider discretion to reclassify faults, extend targets unilaterally, or deny credits while the customer gets no corresponding right is exactly the kind of term that attracts this risk.
Optional clauses worth adding
These do not belong in every SLA, but each earns its place in a particular deal:
- Change control: a mechanism for updating targets and scope without renegotiating the whole agreement, with a review after the first 30 to 90 days of live data, then quarterly or after major incidents.
- Escalation and service improvement plans: a path from repeated misses to a formal improvement plan, before anyone reaches for the termination clause.
- Exclusions for third parties and customer delay: the provider is not responsible for time lost waiting on the customer, or for outages caused by a downstream supplier it does not control.
- Business continuity commitments: recovery time and recovery point objectives for disaster scenarios, separate from ordinary uptime.
- Right to verify: the customer's right to inspect monitoring data or commission an audit of the provider's reported performance.
When an SLA deserves a lawyer's review
An SLA looks operational, but it is drafted against a legal background that most business owners never see. An Artificer Legal practitioner reviewing your SLA, whether you are the provider or the customer, would read it as part of the whole contract package, not as a spreadsheet of targets. We check that the SLA's definitions of services, service hours and fees match the main agreement, that the remedies clause aligns with the limitation of liability and indemnity clauses instead of fighting them, and that the credits are genuinely enforceable rather than illusory.
We also check the statutory exposure: whether the services are supplied to consumers so that the s 60 to 62 guarantees apply and cannot be excluded, whether the contract is a standard form small business contract exposing one-sided terms to the unfair contract terms regime, and whether the data handling clauses satisfy the customer's privacy obligations. For a provider, we would push to anchor targets to your actual capacity, cap remedies by reference to s 64A(2) where the deal is B2B, and keep exclusions tight. For a customer, we would insist the remedies are cumulative, that the liability cap does not swallow the credits, and that you can verify the provider's numbers. The order we negotiate in matters too: scope first, then targets, then measurement, then remedies, then caps, because each earlier choice determines what the later ones can realistically say.
The remedies clause and the liability cap together
If you remember one thing from this guide, make it the interaction between the remedies clause and the liability cap. The most common way an SLA fails in practice is not a badly chosen percentage. It is a remedies clause that promises service credits while the master agreement's liability cap, or an exclusion for indirect loss, makes those credits the only thing the customer can ever recover, or worse, makes them unrecoverable altogether because the provider's liability is capped below the value of the credits owed.
A court will enforce the SLA as a contract, but only the words on the page. If the SLA says credits are the customer's exclusive remedy and the main agreement caps total liability at one month's fees, then a customer who loses a week of trading because of a P1 outage gets a credit worth less than the damage, and a provider who promised more than it could deliver has created a misleading representation under s 18 of the ACL. Both sides should draft the remedies and the cap in the same document, by the same hand, and check them together.
The rest follows from that habit: define the scope, measure the targets honestly, cap the remedies fairly, and never promise a level of service you have not actually delivered. An SLA drafted that way gives both parties what they actually want from it, a service relationship that does not end up in a dispute about what was promised.