Last updated: 23 July 2026. View change log.

This Annex sets out the principles governing risk acceptance, deviations from recommended standards, and continued service delivery where you or End Customers choose not to follow our recommendations.

This Annex is generic and procedural. Any specific risk acceptance or deviation must be recorded separately, typically through a Partner Order, written confirmation or operational record.

1. Purpose

  1. We may identify technical, security, compliance or operational risks during onboarding or service delivery.
  2. In some circumstances, you or an End Customer may choose not to implement recommended actions.
  3. This Annex provides a framework for continuing service delivery while recording and managing accepted risks.

2. Identification of Risks

  1. Risks may arise from, without limitation:
    • end-of-life or unsupported hardware, software or operating systems;
    • lack of security, backup or monitoring services;
    • configuration decisions contrary to best practice;
    • third-party systems outside our control;
    • regulatory or compliance gaps.
  2. We may document identified risks and recommended remediation steps.

3. Communication of Risk

  1. We may communicate identified risks and recommendations:
    • directly to the End Customer;
    • to you for onward communication; or
    • to both, as agreed operationally.
  2. Risk communications may be provided verbally or in writing.

4. Risk Acceptance

  1. Where recommended actions are not implemented, you or the End Customer may choose to accept the identified risk.
  2. Risk acceptance may be recorded by:
    • written confirmation;
    • continued instruction to proceed despite warnings; or
    • other reasonable operational records.
  3. Risk acceptance does not oblige us to provide services beyond agreed scope.

5. Effect on Service Delivery

  1. Where risk is accepted, we may:
    • continue support on a best-efforts basis;
    • apply limitations to service scope or response;
    • exclude certain incidents from support;
    • require additional charges; or
    • require remediation as a condition of continued service.
  2. We are not responsible for failures, incidents or losses arising from accepted risks.

6. Review and Escalation

  1. We may review accepted risks from time to time.
  2. Where risk increases or circumstances change, we may reissue recommendations or escalate the matter.
  3. Continued service delivery remains subject to our right to suspend or withdraw services under the Partner Agreement.
  1. You and the End Customer remain responsible for compliance with applicable laws, including data protection and regulatory obligations.
  2. We do not take responsibility for compliance failures arising from accepted risks.

8. Order of Priority

  1. If there is a conflict between this Annex and the Partner Agreement or Schedules, the Partner Agreement and Schedules prevail.
  2. If there is a conflict between this Annex and a Partner Order, the Partner Order prevails.