There is a difference between a contractual clause and a contractual right, and enterprise AI agreements are where the difference becomes expensive.
A clause is language. A right is language that can be exercised against the counterparty’s resistance, on a day of your choosing, with a consequence attached. Most AI contracts contain the first and are drafted, without anyone intending it, to withhold the second.
A clause is language. A right is language that can be exercised against the counterparty’s resistance, on a day of your choosing, with a consequence attached.
Four places this happens, each checkable in a document you already have in your possession.
Contract Audit
Four places the clause withholds the right
1. The audit clause that requires notice
Almost every enterprise AI agreement grants the buyer audit rights. Read yours and extract three parameters:
How much notice must you give? Who selects the sample or the period being examined? And if the audit finds a discrepancy, what is the vendor obliged to do?
Thirty days’ notice, vendor-selected sample, findings advisory only. Each term is individually defensible and commercially ordinary. Together they convert an audit into a scheduled demonstration — an examination the examined party had a month to prepare for, of material the examined party chose, with no consequence attached to the result.
The case that made this concrete is now well documented: a platform valued at over a billion dollars sold AI-automated development that reportedly relied on hundreds of human engineers, for years, while clients held audit rights throughout. The rights were never the problem. The conditions on exercising them were.
2. The termination clause that returns nothing specific
Every AI contract says what happens on termination. Very few say what arrives.
Your data comes back — that has been standard for a decade. But a system that has run inside your institution for two years is not only your data. It is the fine-tuned weights, the embeddings, the retrieval index, the prompt library your own staff wrote and refined inside the vendor’s console, and the evaluation set assembled from your edge cases.
The diagnostic is to read the termination clause looking only for nouns: the specific artefacts named as returnable. Most institutions find one.
Then ask the question in a form that cannot be answered in the abstract: On the day we terminate, what arrives, in what file formats, and could a competing vendor load it? A supplier who cannot answer that in writing is describing a dependency, not a service.
3. The model version nobody named
Search your agreement for the words version, model, and material change.
You evaluated a specific system. Your team ran a pilot, measured it, and signed on the strength of those measurements. The vendor then upgrades the underlying model — as their roadmap requires, as competitive pressure demands, and as nearly every AI contract silently permits.
The system you tested and the system now in production are not the same system. Nothing was breached; the contract simply never identified what you were buying. Uptime and latency SLAs, the usual response, measure neither of the things that changed.
If a substitution of the underlying model does not trigger re-testing at your discretion, your acceptance testing certified an artefact that no longer exists.
4. The regulatory obligation with no contractual counterpart
On 23 February 2026 the Central Bank of the UAE issued its Guidance Note on the responsible adoption and use of AI and machine learning by licensed financial institutions, setting out five principles: governance and accountability, fairness and non-discrimination, transparency and explainability, effective human oversight, and data management and privacy.
Every one of those obligations attaches to the licensed institution. None attaches to the vendor who built the system. That is not an oversight — it is how financial regulation has always allocated responsibility, and it is correct. But it produces an asymmetry that has only recently become acute.
You owe the regulator explainability. Your vendor may owe you nothing that would let you produce it.
So use the five principles as a contract checklist rather than a compliance one. For each, ask what in the agreement obliges the vendor to supply what you need in order to satisfy it. Begin with transparency and explainability, where the answer is most often nothing.
Comparison Matrix
The Four-Point Verification Matrix
Synthesis
What the four have in common
None of these is a case of a vendor behaving badly. Each is a case of a document that reads as protective and functions as permissive, because the party who drafted the first version was the party the clause would be exercised against.
That is the whole of it. Contracts are not neutral instruments; they are authored. And in AI procurement, the authoring party is usually the one selling.
Closing Action
Run the four-check audit on one live agreement:
Take one live agreement and run the four checks: Notice period and sample selection. Nouns in the termination clause. Version language. Regulatory obligations against vendor obligations.
An hour, on a document already in your possession.