Drones in terms of service: who waived liability and what to do

After the strikes on data centres in October, clients come to me with two opposite questions. Cloud customers and marketplace sellers ask whether anything can be recovered at all now that the terms say "drones are force majeure". Companies that themselves trade on standard terms ask whether they should add such a clause too, and whether it will protect them.

The answer to both is the same: the wording of the terms matters less than it seems, while evidence and deadlines matter more than usual. Below is an analysis based on the documents: who changed what, how the law and the courts treat it, and what each side should do.

Who these companies are and why it concerns everyone

Most of the websites and apps we use every day do not run on the companies' own servers but on capacity rented from cloud providers. These are data-centre owners: huge buildings with thousands of servers that host online shops, delivery and taxi apps, streaming services and banking services. The largest in Russia are Yandex Cloud (Yandex's cloud), Selectel, VK Cloud, Cloud.ru (the Sber group's cloud) and Timeweb Cloud.

An ordinary person has no contract with them but depends on them directly. If a data centre goes down, familiar services stop working, and so does every business renting capacity in that cloud. So what cloud providers write into their contracts ultimately lands on their customers and on their customers' customers.

All these contracts are concluded as standard terms (an offer): the company writes a long text and the customer accepts it in full by clicking "I accept" or simply by starting to use the service. Individual clauses cannot be negotiated, and new versions take effect after notice on the website or by email.

What changed: not the list of events, but the allocation of risk

"Military action" and "terrorist acts" have appeared in bank and cloud contracts for years. What is new in the 2026 versions is different. Companies used three techniques, and each works in its own way.

First: a presumption of force majeure. In the Yandex Cloud terms (version of 11 October 2026, in force from 22 October), the Yandex Drive rental agreement (from 13 October) and the Yandex software marketplace terms, Yandex provided that the listed events, including drone attacks and power and telecom failures, are "presumed to be force majeure". The party that disagrees must prove that the event did not meet the criteria of Article 401(3) of the Russian Civil Code. The general rule is the reverse: force majeure is proved by the party relying on it.

Second: force majeure "down the chain". Yandex Cloud is released from liability if force majeure affects a third party it engaged: a data-centre operator, a telecom operator, a power company. The Drive agreement says the same. In other words, a strike on a substation in another region becomes a ground for not answering to the customer even if the company's own infrastructure is intact.

Third: drones outside force majeure. Selectel, a St Petersburg provider and one of the largest data-centre owners in Russia, in its User Agreement (version of 15 October 2026, for existing customers from 30 October), went furthest. The new clause 6.4 sits not in the force majeure section but in the limitation of liability section: the provider is not liable for the customer's losses if it or its counterparties, including power grids and communication channels, are affected by "any types of weapons and means of destruction… including those used for defensive purposes". Neither extraordinariness nor unavoidability is required, nor any force majeure notice. At the same time, liability is capped at one month's fees, and lost profits are excluded.

For completeness: Timeweb Cloud added drones, "kamikaze drones" and the consequences of air defence as early as February 2026, and Cloud.ru and VK Cloud did so in September. According to business media, similar clauses appeared in the summer in the seller agreements of Wildberries, Ozon and Yandex Market after warehouse fires; I know these texts only from press reports.

How different sectors responded

Laid out by sector, the picture is consistent.

Cloud providers moved from a general "war" clause to specifics: a direct hit and debris, including from air defence; damage at counterparties; government decisions related to the threat. The compensation model is the same everywhere: at most one month's fee, usually as a discount or credits, with no lost profits. As a goodwill gesture, according to industry media, Yandex Cloud is not charging fees from 8 to 31 October. That is more generous than the contract, but it is a gesture, not an obligation.

Yandex rolled out one template across all its documents. Since 10 October the User Agreement for Yandex services has a force majeure section with the same list. Next to it remains the old clause: Yandex's liability to the user is capped at RUB 10,000 "under any circumstances".

Marketplaces called the changes a "clarification". According to the press, Wildberries is released even where the object was declared neutralised, and on 13 October Ozon closed its programme insuring sellers against drone strikes. Who receives how much for burned goods is in practice decided by the platform's voluntary programmes, not by the contract.

Car-sharing shows the problem most clearly. Under the Drive agreement the renter provides their own mobile internet, the car cannot be returned where there is no connection, and waiting time until photos are sent is charged. When mobile internet is shut down, the meter runs at the customer's expense. Competitors address this technically, with finishing by SMS or phone call and recalculation on request. But recalculation remains at the company's discretion.

Banks added nothing, and they did not need to. Sberbank's terms have, since 2021, released the bank in case of "disconnection/damage of power supply and communication networks" and "in other situations beyond the Bank's control". Under T-Bank's terms, the customer ensures their own connectivity and the bank is not liable for network failures.

Telecom operators were released by statute. Federal Law No. 33-FZ of 20 February 2026 amended Federal Law No. 126-FZ of 7 July 2003 "On Communications": an operator must suspend services at the request of the FSB and bears no liability to the subscriber for doing so (Article 68(6.1) of the Communications Law).

Insurers, according to Kommersant, exclude drone attacks from standard policies and sell such cover separately. Note that under Article 964 of the Civil Code an insurer is in any case released from paying out for losses caused by military action unless the law or the policy provides otherwise.

The result is a chain in which almost no one is liable: telecoms are released by statute, clouds and platforms by their terms, banks by old broad wording, insurers by exclusions. The loss stays with the last link, the customer.

What the law says

Four sets of rules are needed to assess these clauses.

Article 401 of the Civil Code. A business is liable regardless of fault and is released only if it proves that performance became impossible due to force majeure, meaning extraordinary circumstances that could not be prevented under the given conditions. The same article states expressly that a breach by the debtor's counterparties is not force majeure. The Plenum of the Supreme Court, in Resolution No. 7 of 24 March 2016, added three important points. Extraordinariness means the event is not ordinary in the specific conditions (para. 8). Force majeure does not terminate the obligation if performance remains possible once it ends (para. 9). The debtor must take reasonable steps to mitigate the creditor's loss and notify the creditor, otherwise it compensates the resulting losses (para. 10).

The words "unless otherwise provided by contract" in Article 401(3) mean that businesses may agree on wider grounds for release. So in contracts between businesses, wording like Selectel's or Yandex Cloud's is lawful in principle. There are three limits: an advance agreement excluding liability for intentional breach is void (Article 401(4)); an adhesion contract can be amended by a court (Article 428); and abuse of rights is not protected (Article 10).

Article 428 of the Civil Code. A party that acceded to a contract may demand its amendment or termination if the contract excludes or limits the other party's liability or contains clearly onerous terms that it would not have accepted had it been able to negotiate. A contract amended by the court is deemed to have been in force in the amended version from the moment of conclusion. The rule also covers contracts where one party, because of a clear inequality of bargaining power, could not agree different terms (Article 428(3)). This is the main tool for a marketplace seller or a cloud customer.

Russian Federation Law No. 2300-1 of 7 February 1992 "On Consumer Rights Protection". A service provider is released only if it proves force majeure or another ground provided by law (Article 13(4)). Unacceptable contract terms are void (Article 16(1)), and the Law expressly lists among them terms that exclude or limit the provider's liability on grounds not provided by law, and terms that place on the consumer a burden of proof not imposed on them by law (Article 16(2)(4) and (12)). Losses caused by such a term are compensated in full, and the claim must be satisfied within ten days.

Which clauses will hold and which will not

Against consumers the new clauses add almost nothing to the law. In my assessment, the presumption of force majeure falls squarely under the ban on shifting the burden of proof onto the consumer. The RUB 10,000 cap "under any circumstances" falls under the ban on limiting liability on grounds not provided by law. The banks' wording on "other situations beyond the bank's control" goes beyond force majeure, which requires extraordinariness and unavoidability. There is no case law on these specific clauses yet, but the consumer protection rule is unambiguous.

Telecoms are the exception. The operator's release when services are suspended at the FSB's request is set by statute, so the ban on limiting liability "on grounds not provided by law" does not apply. What remains is the argument that release from liability does not entitle the operator to charge for a service it did not provide, but there is no case law on that yet.

Against businesses the clauses work until challenged. Three factors decide the outcome.

1. The chain. Force majeure at a counterparty is expressly excluded by Article 401 and by Plenum Resolution No. 7. According to legal portals, the Russian Chamber of Commerce and Industry follows the same logic in its letter No. PR-0042 of 29 January 2026: it certifies a drone attack as force majeure only for the party whose property was damaged and whose performance became impossible, with a direct causal link. The contractual construction of "force majeure at a subcontractor" contradicts this, and in an Article 428 dispute that is a strong argument.

1. The date of the contract. Published commercial court practice for 2024–2026 is consistent: if the contract was concluded when attacks were already common in the region, courts refuse to treat them as extraordinary. They recognise force majeure where the debtor's own property was damaged, the link to the specific obligation is proved, and the debtor gave notice, looked for alternatives and mitigated the loss.

1. The debtor's conduct. According to Pravo.ru, in September 2026 the Economic Disputes Chamber of the Supreme Court held in the Russian Railways cases that an air-raid alert does not automatically release the carrier: only the time corresponding to the duration of each alert is excluded from the delay, and the court must assess the Chamber of Commerce certificate, which has no predetermined weight.

There is also an argument not yet seen in practice, but which I expect to be raised. A company that in 2026 writes into its contract that drone attacks and power-grid failures are to be expected thereby admits the risk is foreseeable. That undermines the extraordinariness test and strengthens its duty to take precautions: redundancy, physical protection, insurance.

What a consumer should do

1. A written claim through the app, by email or on the website, with two demands: refund or compensation, and removal of the unacceptable term. The company must respond to the second within ten days with a reasoned decision (Article 16(3) of the Consumer Rights Protection Law).
2. Ask for evidence. Let the company show that the failure was caused by an attack and that this is what disrupted your order or rental. The burden of proof is on it.
3. Keep records. Screenshots, receipts, correspondence, the time of the connectivity outage, order numbers. For car-sharing, also your location and the times you tried to end the rental.
4. Car-sharing. Dispute the minutes charged while the rental could not be closed without a connection. Operators recalculate on request, so without a request there will be no recalculation.
5. If refused. A complaint to Rospotrebnadzor: including unacceptable terms is an offence under Article 14.8(2) of the Code of Administrative Offences. A claim can be filed at your place of residence (Article 17(2) of the Consumer Rights Protection Law), and if it succeeds the court awards a fine of 50% of the amount awarded (Article 13(6)).

What an affected business should do

A marketplace seller. If goods were lost at the platform's warehouse, the platform's position as custodian matters: a professional custodian is liable for loss unless it proves force majeure (Article 901(1) of the Civil Code). Ask for documents: which of your units were at the damaged warehouse, what confirms their loss, what protective measures the platform took. In parallel, assess a claim to amend the terms under Article 428. Also check whether you received notice of the change to the terms: the platform economy law, which sets the procedure for changing seller agreements, entered into force on 1 October 2026.

A cloud customer. The deadlines here are short. Compensation under the Yandex Cloud SLA (the service level agreement: what availability the cloud promises and what it pays for downtime) must be requested within 30 days. A Selectel customer who disagrees with the new version may withdraw from the services within 10 days of notice. Miss these, and the dispute will be under the new version. If downtime cost you more than a month's fee, the only way past the cap in a business-to-business contract is to challenge the term itself under Article 428 or to prove intent.

Any business customer. If a contract was not performed because circumstances changed but there is no force majeure, the Chamber of Commerce in such cases points to Article 451 of the Civil Code on a material change of circumstances. It is a way to amend or terminate a contract, not to escape liability after the fact.

What companies that write their own terms should do

This section is for those now rewriting their contracts following the big players.

• Separate consumers from businesses. A force majeure presumption and a hard liability cap in consumer terms will not protect you; they will hand Rospotrebnadzor a ready case under Article 14.8 of the Code of Administrative Offences. In business contracts the same constructions are permissible but must be drafted clearly and without imbalance.
• Do not rely on "force majeure down the chain". Neither the law nor the Chamber of Commerce recognises it. It is safer to state directly which external events postpone obligations and for how long, and to set out your own recovery procedure.
• Gather evidence at the time of the event. Timely notice to customers, a timeline, documents on the damage, an application to the Chamber of Commerce, the criminal case or inquiry materials, mitigation measures. This is what a court checks first.
• Show your precautions. Redundancy, a second data centre, alternative communication channels, insurance. This is both an argument in court and an argument for the customer.
• Goodwill compensation beats litigation. A free month or recalculation on request costs less than mass claims and a regulatory inspection.

What not to do

• Do not take a clause at face value. "We are not liable" in the terms does not mean the company is not liable under the law.
• Do not ignore notices of contract changes. Some providers give only 10 days to withdraw.
• Do not build a claim on emotion. A demand without calculations, documents and a request for evidence is easy to reject with a template reply.
• Do not treat a Chamber of Commerce certificate as a verdict. For a court it is one piece of evidence, nothing more.
• Do not keep everything in one cloud and one warehouse. The cheapest protection against such clauses is organisational, not legal.

Conclusion

The new terms change not so much the list of events as the allocation of proof: a presumption, release for the troubles of counterparties, and moving drones out of force majeure into an unconditional limitation of liability. Against an individual these techniques largely fail because of the express ban in the Consumer Rights Protection Law. Against a business they work until challenged under Article 428, and the first such case will be the real test.

This article is for information only and is not a substitute for advice on a specific matter. Assessments of specific contract terms reflect our opinion; there is no case law on them as of the date of publication.

How we can help

If your business has suffered from a cloud outage, a strike on a warehouse or a connectivity shutdown, or you trade on your own standard terms and want to know what will hold up, contact Kovalev & Partners. What we do:

• Review your contracts and your counterparties' terms: which liability clauses apply, which can be challenged and by when.
• Prepare a defence strategy: a claim letter, a request for evidence of force majeure, negotiations on compensation, a claim to amend the terms under Article 428 of the Civil Code or a claim for damages.
• Rework your own terms and customer contracts so that clauses on external risks are clear, lawful and withstand scrutiny by the courts and Rospotrebnadzor.
• Build the evidence base in case force majeure hits you: notices, a timeline, documents for the Chamber of Commerce and the court.

Write to us — the first consultation is free when an engagement is signed.

Vladimir Kovalev — lawyer, founder and managing partner of Kovalev & Partners LLC