Crafting Vendor Contracts

Thought to share my step-by-step playbook framework that cuts contract execution time by up to 60% and gives you back the strategic work that matters. Cut down week long negotiations over the same liability clauses you argued last month and stop starting from scratch every time. Step 1: Start with your biggest time sink For me, that was procurement contracts. I was redlining the same issues over and over: • Liability caps (always pushing for mutual, capped at contract value) • Indemnity scope (carving out IP infringement for vendor) • Data protection clauses (our DPA template, non-negotiable) • Termination rights (30-day notice, immediate for breach) Instead of reinventing these positions every time, I documented them. My first playbook entry: "Procurement Liability: Standard position = mutual cap at 12 months contract value. Fallback = 2x annual fees. Never accept unlimited liability except for IP infringement and data breaches." Step 2: Capture the decision logic, not just positions This was my biggest early mistake. I documented what to negotiate but not when to compromise. Wrong approach: "Always require 30-day termination notice." Better approach: "Termination notice: 30 days (standard) → 60 days (if vendor is business-critical) → 90 days (if vendor integration exceeds 6 months to replace)." The playbook should think through the business context, not just legal positions. Step 3: Build templates with embedded guidance For SaaS agreements, I created templates that included: • Standard terms (what we always want) • Alternative language (when standard doesn't work) • Red flags (issues that trigger escalation) • Business context questions (when to be flexible) Example from my SaaS playbook: Data Processing Addendum: Always required for EU personal data. Use our standard DPA [you could link this here]. If vendor insists on their DPA, escalate if it lacks: adequacy determination, SCCs for non-EU transfers, or audit rights. Step 4: Document your "never again" moments Every mistake became a playbook entry. Investor side letter disaster: I once agreed to a "standard" information rights clause that required board-level reporting on metrics we didn't even track. Playbook entry that followed: "Information rights: Review reporting requirements against current metrics. Flag any operational burden >2 hours/month. Alternative language: 'Information reasonably available in ordinary course of business.'" Step 5: Make it searchable and living I used Notion with: • Tags by agreement type (SaaS, procurement, investment) • Tags by legal issue (liability, termination, IP) • Last updated dates • Links to actual executed agreements as precedents Every time I negotiated something new, I updated the playbook and I think you should too. #LegalOps #SoloCounsel #LegalPlaybooks #ContractManagement #InHouseCounsel #StartupLawyer #KnowledgeManagement #LegalEfficiency #ProcessImprovement #LegalTech #StartupGC #ContractStrategy

⚖️ AI vendor contracts aren’t just SaaS agreements—they’re risk management tools. Colin S. Levy’s Contracting with AI Vendors highlights how legal teams must rethink contracts to address unique AI risks: data use, output ownership, bias, and model drift. It’s a practical roadmap for lawyers negotiating with AI providers. Here are 5 quick insights: 🔍 Training data restrictions matter - Without explicit limits, vendors may use client data to retrain models—creating confidentiality and privilege risks. 📊 Output ownership is unsettled - Contracts must clarify who owns AI-generated outputs, regardless of evolving copyright law. 🛡️ Bias and fairness obligations - Vendors should bear responsibility for testing and mitigating bias, especially in regulated decisions like hiring or credit. ⚡ Model drift & transparency - AI performance degrades over time—contracts should require monitoring, thresholds, and audit rights. 📑 Redlining is essential - Liability caps, indemnification, unilateral modification clauses, and NDAs must be tailored to AI-specific risks. AI contracts define trust. Lawyers who negotiate beyond “standard terms” will protect clients, ensure compliance, and enable responsible innovation. #AIContracts #LegalTech #ResponsibleAI #AIgovernance #AIethics #AItrust #AIoversight #AIcompliance #AIstrategy #AIRiskManagement #DigitalTransformation #FutureOfLaw #LinkedInLeadership

Someone DM’d me asking about the IT contract from my previous post. So instead of replying one-to-one, aku share kat sini terus, lebih clear, and semua orang boleh belajar sekali [𝗪𝗵𝘆 𝗦𝗼 𝗦𝗲𝗿𝗶𝗼𝘂𝘀?] A Contract Should Start from Procurement Not Just at Signing Kalau kita hanya ‘masuk’ dalam kontrak selepas award, kita bukan protect project kita baru nak belajar berenang bila dah jatuh dalam sungai. 𝗠𝘆 𝗕𝗲𝘀𝘁 𝗣𝗿𝗮𝗰𝘁𝗶𝗰𝗲: “I always co-develop contracts with Procurement + Legal from Day 1.” Why?  • Procurement understands vendor behavior and costing  • Legal protects the organization’s risk exposure  • Technical team ensures clause enforceability and operational fit Pre-Tender: Lay the Foundation Key Actions: Define clear Scope of Work (SOW) Identify risk areas (e.g. data location, integration points, vendor lock-in) Draft intended clauses (SLA, IP, Exit Strategy, etc.) 𝗥𝗲𝗮𝗹 𝗖𝗮𝘀𝗲: A GLC ERP project had overlapping roles between vendor and internal IT due to vague SOW. 𝟲𝟬%of project delay traced back to this early gap. 𝗧𝗲𝗻𝗱𝗲𝗿 𝗗𝗼𝗰𝘂𝗺𝗲𝗻𝘁 𝗣𝗿𝗲𝗽𝗮𝗿𝗮𝘁𝗶𝗼𝗻 Include from the start (not post-award): SLA: uptime, RTO, response, escalation UAT process and test ownership Payment milestones linked to acceptance Subcontracting visibility + disclosure IP rights and source code handover Data residency clause (PDPA/ISO compliance) Escrow clause (for proprietary source code) Real Case: A local agency’s web app hosted personal data in Singapore. Audit revealed PDPA non-compliance no Data Residency clause in RFP. 𝗘𝘃𝗮𝗹𝘂𝗮𝘁𝗶𝗼𝗻 𝗦𝘁𝗮𝗴𝗲 (𝗧𝗲𝗰𝗵𝗻𝗶𝗰𝗮𝗹 + 𝗖𝗼𝗺𝗺𝗲𝗿𝗰𝗶𝗮𝗹) “This is the most underutilized risk filter.” Watch for: Unrealistic SLA Price too low for complex work No mention of subcontractors IP rights not discussed Real Case: Vendor bid RM98k for a mobile app with integration. Issued RM300k in CRs midway. Why? Vague CR clause. No cost threshold. Procurement missed the red flag — too focused on pricing. 𝗖𝗼𝗻𝘁𝗿𝗮𝗰𝘁 𝗙𝗶𝗻𝗮𝗹𝗶𝘇𝗮𝘁𝗶𝗼𝗻 Finalize: Escrow mechanism with agent Jurisdiction (don’t default to vendor’s country) Enforcement clause (penalties, audit, compliance access) Payment & milestone clarity Termination clause with data handover + exit readiness Real Case: A GLC couldn’t terminate a vendor after 6 months of delay. Termination clause required proof of non-performance but didn’t define what that meant. 𝗗𝗼 𝗖𝗼𝗻𝘁𝗿𝗮𝗰𝘁 𝗥𝗲𝘃𝗶𝗲𝘄𝗲𝗿𝘀 𝗡𝗲𝗲𝗱 𝘁𝗼 𝗕𝗲 𝗧𝗲𝗰𝗵𝗻𝗶𝗰𝗮𝗹? 𝗬𝗘𝗦. 𝗔𝘁 𝗹𝗲𝗮𝘀𝘁 𝗼𝗻𝗲 𝗼𝗳 𝘁𝗵𝗲𝗺. Legal can’t review backend access. Procurement can’t judge tech stack suitability. You need someone technical enough to understand:  • What’s actually being delivered  • Where risk lies (integration, uptime, APIs, data transfer)  • If the clause is enforceable in real ops "You don’t enforce contracts at go-live. You enforce them at procurement." "Clause yang tak difahami, tak dimiliki, dan tak diaktifkan adalah clause yang tak wujud."

𝐀𝐈 𝐯𝐞𝐧𝐝𝐨𝐫 𝐜𝐨𝐧𝐭𝐫𝐚𝐜𝐭𝐬 𝐚𝐫𝐞 𝐧𝐨 𝐥𝐨𝐧𝐠𝐞𝐫 𝐣𝐮𝐬𝐭 𝐚𝐛𝐨𝐮𝐭 𝐩𝐫𝐢𝐜𝐢𝐧𝐠 𝐚𝐧𝐝 𝐟𝐞𝐚𝐭𝐮𝐫𝐞𝐬. In 2026, they need to clearly define control, ownership, compliance, and exit rights. 𝐁𝐞𝐜𝐚𝐮𝐬𝐞 𝐨𝐧𝐜𝐞 𝐀𝐈 𝐛𝐞𝐜𝐨𝐦𝐞𝐬 𝐩𝐚𝐫𝐭 𝐨𝐟 𝐲𝐨𝐮𝐫 𝐰𝐨𝐫𝐤𝐟𝐥𝐨𝐰𝐬, 𝐭𝐡𝐞 𝐫𝐢𝐬𝐤𝐬 𝐛𝐞𝐜𝐨𝐦𝐞 𝐝𝐞𝐞𝐩𝐞𝐫: Your data may move across regions. The vendor may change the underlying model. Your AI-generated outputs may create ownership confusion. Your workflows may become hard to migrate. Your compliance claims may lack real evidence. That is why every AI vendor contract should include these 5 clauses: 1. Data Residency Define where your data is stored, processed, backed up, and who can access it. 2. Model Swap Rights Get visibility and approval rights before the vendor changes the AI model behind the product. 3. Output IP Clarify who owns AI-generated reports, code, workflows, prompts, and business-critical outputs. 4. Exit & Portability Make sure you can leave without losing your data, workflows, history, or operational continuity. 5. Audit Access Ask for evidence through reports, logs, compliance proof, and incident records. AI tools can create speed. But without the right contract terms, they can also create lock-in, compliance gaps, and ownership risk. Before signing with any AI vendor, don’t just ask: “What can the tool do?” Also ask: “𝐖𝐡𝐚𝐭 𝐡𝐚𝐩𝐩𝐞𝐧𝐬 𝐭𝐨 𝐨𝐮𝐫 𝐝𝐚𝐭𝐚, 𝐨𝐮𝐭𝐩𝐮𝐭𝐬, 𝐚𝐧𝐝 𝐜𝐨𝐧𝐭𝐫𝐨𝐥 𝐨𝐧𝐜𝐞 𝐰𝐞 𝐬𝐭𝐚𝐫𝐭 𝐮𝐬𝐢𝐧𝐠 𝐢𝐭?” ♻️ Repost to help a team understand where they truly fit. ➕ Follow Prem N. for more

Today's contract tip is about customizing your service levels and performance metrics for your SaaS vendor contracts. So much of contract drafting is about making sure the terms match the parties' needs and the transaction's risks. This principle is especially true when selecting service levels. We need to include service levels that reflect the customer's priorities, not just which service levels are the most common. Customers cannot always dictate service-level options. With larger platforms, you get what you get. But even then, we must understand our customer's needs to invest our negotiating currency into securing the best terms possible for the more important ones. I have seen so many lawyers fight hard for uptime guarantees for SaaS agreements at the expense of other metrics that were strategically much more important for this particular platform. Let's say a customer is looking at a platform that will be used infrequently and without any particular urgency. A six nines uptime (99.9999%) may not even be a concern for this customer. They may be OK with just three nines (99.9%). But what they may REALLY need is a speed of processing. It may kill the team's productivity if each transaction takes too long to process. In this case, a great uptime is meaningless for transaction processing speed is everything. To figure out the right service level, think about the service and what could go wrong. Not just the big end-of-the-world-as-we-know-it disasters, but the mini-disasters and inconveniences that use the product are so much more challenging or more expensive. Build service levels around what matters to this business for this service, not just common metrics that matter to others. Of course, to do that, you have to understand the customer's priorities and vision for this product. But we need to know that for every contract, don't we? What other insights or advice would you add about service level selection? #ElevatorSLAs #contracts

Your healthcare AI vendor contract was written for software that answers questions. The AI your health system just deployed makes decisions on its own. There is a reckoning coming. According to a Feb 2026 Deloitte report, MUSC Health is running 40% of prior authorizations through AI agents with no human involvement. Tasks that took 30 minutes finish in one minute. Sentara Health reclaimed thousands of nursing hours with a virtual nursing platform. Mayo Clinic is exploring AI agents for eligibility, authorization, and claims. The trend is accelerating. The contracts (from both sides) governing these deployments are rarely built for it. Buyers are going to start pushing back. Hard. Here are some standard terms I've seen: ➡️The vendor disclaims accuracy and reliability. The contract says outputs "should not be relied upon." ➡️Indemnities cover IP claims only, not harm caused by the agent's actions. ➡️Compliance responsibility falls on the buyer even though the vendor controls the agent's behavior. ➡️Consequential damages are excluded; liability is capped at fees paid. For a SaaS tool, these terms may be standard. When AI just answered questions, those terms were fine. But when AI acts on its own (i.e., triaging patients, processing prior authorizations, routing referrals), and the vendor controls what the agent does, and the contract just says they're not responsible when it gets it wrong, you're basically just waiting until the buyers get savvy to what they're signing. If you're building AI tools for health systems, your buyers' legal teams are about to start asking harder questions. Get ahead of it. Contracts that assign fair liability and include outcome-based SLAs tied to decision accuracy, for example, will close faster than contracts that disclaim everything. Build in audit-ready decision logs before your buyer's counsel asks for them. Prepare for the AI governance and security review before you get there. And if you're signing on buyer paper instead of your own, expect terms you haven't seen before: AI-specific indemnification carve-outs, supercaps on liability for patient harm that sit well above the standard fees-paid ceiling, mandatory bias audits, and requirements to carry AI-specific E&O coverage with the buyer named as additional insured. These aren't edge cases anymore. They're becoming standard in enterprise health system procurement. One more thing builders need to know: the insurance market is tightening. Verisk introduced optional AI exclusions effective January 2026 across its property-casualty templates. AIG and WR Berkley Capital Trust II followed with broader exclusions. If you haven't locked in AI-specific coverage yet, it's getting harder and more expensive. Your buyer is going to ask for proof of it. https://lnkd.in/e973kC2u

⚖️ The Indemnity Clause That Backfired A software vendor includes this clause: "Company shall indemnify Client against all losses arising from third-party claims." Six months later, the client faces a data breach lawsuit. The vendor refuses to defend, claiming the breach resulted from client's poor security practices, not the software itself. Indemnity provisions allocate risk between parties - the vendor controls software development and is better positioned to handle IP infringement claims, while the client controls implementation and usage environments. COMMON DRAFTING GAPS: Vague Scope: "All losses" sounds comprehensive but creates disputes over what constitutes covered losses. Missing Triggers: When exactly does the indemnity obligation kick in? First notice? Actual payment? Court judgment? No Procedure: How does the indemnified party claim protection? What documentation is required? BETTER STRUCTURE: Define Coverage Precisely: "Vendor shall defend, indemnify and hold harmless Client from third-party claims alleging that the Software infringes patents, copyrights, or trade secrets, excluding claims arising from Client modifications or misuse." Specify Obligation Types: - Defend: Vendor takes control of legal proceedings - Indemnify: Vendor reimburses actual losses - Hold Harmless: Vendor shields from liability before payment Include Carve-Outs: "Excluding losses arising from: (a) Client's unauthorized modifications, (b) use outside permitted scope, (c) combination with third-party systems not approved by Vendor." NOTICE AND CONTROL PROVISIONS: Claim Notice: "Client shall notify Vendor within 30 days of receiving any claim. Failure to provide timely notice relieves Vendor's obligations only if Vendor suffers material prejudice." Control Rights: "Vendor may assume defense through counsel of its choice. Client shall reasonably cooperate and may participate through separate counsel at its own expense." Settlement Authority: "Vendor may settle claims with Client's consent, not to be unreasonably withheld. No settlement admitting Client liability without Client's written consent." FINANCIAL PROTECTIONS: Caps and Thresholds: "Vendor's total indemnity liability shall not exceed the fees paid under this Agreement in the 12 months preceding the claim." Insurance References: "Vendor maintains professional liability insurance of Rs. 50 million. Indemnity obligations are primary to any insurance coverage." PRACTICAL CONSIDERATIONS: Mutual vs Unilateral: Service providers typically give indemnities; clients rarely reciprocate unless they provide data or specifications. Consequential Damages: Standard exclusions may conflict with broad indemnity language - address this explicitly. Survival: "Indemnity obligations survive termination for claims arising during the contract term, with no time limit for assertion." #IndemnityClause #ContractDrafting #RiskAllocation

Locked-in contracts are sinking businesses. Here’s why flexibility is your life raft. We’re living through rapid change: • AI is evolving faster than we imagined. • Cyber threats are adapting every day. • Cloud computing is transforming how we build our systems. But here’s where many companies stumble: Their contracts don’t move as fast as their industries do. → You want better cybersecurity, but your agreement locks you out. → Your business scales up, but penalties hold you back. → New tech emerges, but you’re stuck waiting—watch competitors take advantage. Sound familiar? Locked-in contracts don’t just cost money. They cost you: • Agility. • Growth. • Resilience. (Three things every business *needs* today.) Here’s how I negotiate contracts that adapt, not restrict (and you can too): ✅ Build periodic review clauses → Don’t let your agreements collect dust. Negotiate moments for both sides (you and your vendor) where terms *must* evolve with time. ✅ Add exit clauses → Give yourself an "out." Even if you don’t leave, these clauses provide leverage for renegotiation if something stops working. ✅ Remove penalties for upgrades → Vendor says no? Push back. "Lockdown" clauses benefit vendors, NOT you. ✅ Promote collaboration, not punishment → Pick vendors who act like true partners. Behavior matters. You want allies who cheer for your success and pivot with you. Flexible contracts = long-term wins. → They turn disruption → opportunity. → They transform unknowns → your competitive edge. Ask yourself: If everything changed tomorrow, would your contracts keep you afloat—or drag you under?

You receive a shipment from a new international vendor. But as it turns out that half the items are wrong, the rest arrive late, and follow-ups go unanswered. Meanwhile, your contract sits on the shelf collecting dust. And what will you do at that time? Have you realised what was the reason behind it? Most companies don’t realise that international vendor agreements can hide very serious risks that come with payment issues and unclear responsibilities. And your ideal deal can quickly become a problem if the vendor is not properly checked. I often see contracts where termination clauses are added without thinking through how they will actually play out.  As a lawyer, it is my duty to review how these clauses will work internationally instead of relying on copy-paste standard language. I am sharing a 7-Step checklist to vet international vendors agreements properly: 𝟏. 𝐂𝐥𝐚𝐫𝐢𝐟𝐲 𝐞𝐯𝐞𝐫𝐲 𝐞𝐱𝐩𝐞𝐜𝐭𝐚𝐭𝐢𝐨𝐧 Product specs, delivery timelines, compliance standards. Write them down and get the agreement upfront. 𝟐. 𝐕𝐞𝐫𝐢𝐟𝐲 𝐯𝐞𝐧𝐝𝐨𝐫 𝐫𝐞𝐩𝐮𝐭𝐚𝐭𝐢𝐨𝐧 𝐚𝐧𝐝 𝐬𝐭𝐚𝐛𝐢𝐥𝐢𝐭𝐲 Check financial health, past client feedback, and legal history. 𝟑. 𝐂𝐡𝐞𝐜𝐤 𝐫𝐞𝐠𝐮𝐥𝐚𝐭𝐢𝐨𝐧𝐬 Local and international laws, labour rules, and trade regulations cannot be ignored. 𝟒. 𝐀𝐬𝐬𝐞𝐬𝐬 𝐨𝐩𝐞𝐫𝐚𝐭𝐢𝐨𝐧𝐚𝐥 𝐜𝐚𝐩𝐚𝐜𝐢𝐭𝐲 Ensure their facilities, quality control, and processes match your needs. 𝟓. 𝐍𝐞𝐠𝐨𝐭𝐢𝐚𝐭𝐞 𝐬𝐭𝐫𝐨𝐧𝐠 𝐜𝐨𝐧𝐭𝐫𝐚𝐜𝐭 𝐭𝐞𝐫𝐦𝐬 Include penalties, deliverables, IP protection, and dispute resolution. 𝟔. 𝐏𝐥𝐚𝐧 𝐟𝐨𝐫 𝐫𝐢𝐬𝐤 Factor in currency fluctuations, supply chain delays, and political or logistical hurdles. 𝟕. 𝐌𝐨𝐧𝐢𝐭𝐨𝐫 𝐜𝐨𝐧𝐭𝐢𝐧𝐮𝐨𝐮𝐬𝐥𝐲 Set clear metrics, schedule check-ins, and track performance closely. 𝐓𝐚𝐤𝐞 𝐞𝐱𝐭𝐫𝐚 𝐜𝐚𝐮𝐭𝐢𝐨𝐧 𝐰𝐡𝐞𝐧 𝐦𝐞𝐧𝐭𝐢𝐨𝐧𝐢𝐧𝐠: • Cultural and communication differences • Secure payment terms • Full visibility of supply chain • IP and confidentiality protection International vendor relationships fail more during the contract phase than the performance phase. We just don't realise it until something breaks. Before signing a deal, make sure you go though the whole agreement (clause by clause) to understand the crux of the deal. #InternationalContracts #VendorAgreements #ContractManagement #BusinessRisk #CrossBorderBusiness

Contracts are powerful instruments that can help firms navigate the growing uncertainty of global tariffs. In an international trading environment marked by frequent policy shifts, tariff changes can disrupt supply chains, inflate costs, and erode profit margins. Well-crafted contracts allow companies to anticipate these risks and allocate responsibilities in ways that protect operational stability and business continuity: 1). One of the most effective strategies involves specifying the payment of duties and taxes through the USE of internationally recognized INCOTERMS. By clearly defining whether tariffs fall under the responsibility of the seller or the buyer, companies can avoid ambiguity and legal disputes. For example, terms such as Delivered Duty Paid (DDP) place the burden on the seller, while Ex Works (EXW) shifts it to the buyer. This clarity is essential in cross-border trade relationships, where unexpected tariff increases can trigger tension and financial losses. 2). Firms can also EMBED PRICE ADJUSTMENT CLAUSES that allow for contractual prices to shift in response to tariff-related cost increases. These clauses ensure that neither party is disproportionately affected by external economic shocks. If new tariffs raise production or import costs, the agreed price can be renegotiated, preserving the economic intent of the contract. In addition, “change in law” provisions can provide further flexibility. Such clauses allow for contract modifications—or even termination—if new regulations, including tariffs, substantially alter the conditions under which the contract was signed. These mechanisms protect both parties and encourage continued cooperation even amid trade volatility. 3). Another useful feature is the inclusion of hardship or FORCE MAJEURE CLAUSES. While traditional force majeure clauses often cover natural disasters or wars, they may not account for the economic hardship caused by sudden tariffs. Tailoring these clauses to include significant cost increases due to tariffs enables firms to seek relief or renegotiation when fulfilling the contract becomes excessively burdensome. In some cases, this might also lead to the contract’s termination if performance becomes economically unviable. 4). Regular CONTRACT REVIEW is also critical. In a world where tariffs can change with the stroke of a pen, businesses must routinely assess their contractual exposure and ensure terms remain aligned with current trade realities. This includes updating dispute resolution procedures to facilitate quicker, more efficient outcomes if disagreements arise. Firms should also leverage technology, such as contract lifecycle management tools, to monitor obligations, assess tariff impact, and simulate risk scenarios. These systems support informed decision-making and ensure that necessary changes are implemented in a timely manner.