Service Level Agreement — SLA

Availability can be measured at the interface, API, infrastructure or essential-function level. If these reference points are unspecified, two accurate technical reports may produce different percentages.

The SLA specifies the time zone, measurement window, data source and rounding rule. Scheduled maintenance and events beyond the provider’s control are excluded only within clear limits.

Response time is not resolution time. The agreement must separate acknowledgement of the incident, commencement of investigation, workaround, restoration and permanent resolution.

• Severity: objective criteria based on affected users, data and functions.
• Notification channel: portal, email, telephone and authorised persons.
• Coverage: normal business hours, 24/7 or differentiated periods.
• Escalation: technical and management levels with clear intervals.
• Communication: regular updates and minimum information.
• Post-mortem: cause, timeline, impact and preventive measures.

Credits can provide a swift, proportionate remedy, but must have a formula, a cap and a simple procedure. Requiring the credit to be claimed within a very short period can make the remedy illusory.

If service credits are declared the exclusive remedy, exceptions must be established for serious breaches, data loss, confidentiality, security or other situations where a simple discount does not cover the loss.

A provider should not promise customers parameters that its own upstream contracts cannot support. The cloud region, managed services, maintenance and infrastructure provider’s limits must be checked.

For entities and providers within the scope of NIS2, incident management and reporting obligations are not replaced by the SLA. Government Emergency Ordinance No. 155/2024 and Commission Implementing Regulation (EU) 2024/2690 may affect operational processes and deadlines.