“Signing a vendor contract is a business negotiation.”
Many see the vendor contract as a standardized formality. In reality, investing in drafting it carefully is one of the most profitable investments an organization can make.
The key is to accept that these returns are not generated on the day of signing, but on the day of the incident. Crises have a way of revealing the value of a balanced contract, one you can genuinely rely on.
My thesis is this: it is better to invest your efforts in a calm negotiation than in an unbalanced dispute.
This op-ed is not a collection of legal recommendations. Without claiming to be exhaustive, it simply offers a framework designed to save time and resources in managing vendor risk.
The 5 foundational questions
A contract must answer five questions. It is precisely because they seem obvious that we tend to overlook them.
Who is contracting? As you will have guessed, the point here is to identify precisely which subsidiary is committing, because it is not always the entity you have in mind. The signing legal entity is not necessarily the one that holds the assets, nor the one that is insured. Yet it is that entity, not the group, that will be answerable on the day of the dispute.
Why, and for what purpose? Take care to clearly define the scopes of intervention and liability. This requires a precise description of the service provided. Without it, you do not know what you have bought, and you will not know who bears the liability either.
How is the service delivered? Clarifying expectations and resources defuses future disputes. Where are the gray areas? What resources is the vendor committing? What SLAs or service levels are expected? Are they clearly stipulated in the contract?
How do we exit? In other words, is there a reversibility clause? Does it specify the concrete exit terms in the event of the vendor’s failure or bankruptcy? Speaking from experience, I can assure you that a conflict is not when you want to have this discussion. The formalities must be understood and pre-approved by both parties at signing. The goal: a clause that can be executed immediately, without negotiation.
At what cost? Make yourself put a figure on any potential exit. What penalties can you commit to? Are they trivial or real?
Beyond the 5 questions, the key here is to adopt a proactive stance. Commit to reading the contract interactively and asking questions, even, and especially, if you did not draft it.
You do not need to be a lawyer to clarify these points. What matters is doing it before contracting, not after.
Liability is negotiated on the consequence, not on the price
The liability clause is not a boilerplate clause. It is written case by case, and it is written differently depending on whether you are on the client side or the vendor side.
One guiding principle to keep in mind: the amount of liability is not defined by the price of the service, but by the consequences of its interruption.
For example, a common practice is to cap liability at the sums paid under the contract, often the last twelve months of fees. While the reasoning seems defensible, it aligns compensation with the value of the service, not with the damage it can cause.
An inexpensive service whose interruption paralyzes your business deserves more than the cost of a one-year license. So be sure to negotiate a robust liability clause.
Consistency across the whole chain
Your liability position must hold from the final subcontractor all the way to your own customer. It is a requirement for consistency, and it is where many arrangements crack.
A SaaS vendor cannot guarantee its customer an audit right that its own hosting provider denies it. Even if the commitment exists contractually, it is unenforceable in practice. The customer must therefore know the subcontracting chain and have it explained.
One distinction is worth making: the right to know is not the right to act. Obtaining a map of the value chain is one thing. Being able to audit, to be notified before a change of subcontractor, to object to it, is another. Many contracts generously grant the former and silently refuse the latter. You end up with visibility but no leverage.
Then remains the real underlying question of vendor risk: how far do we go? What is reasonable, useful and responsible to put in place?
This question continues to fuel plenty of debate. To cut it short, there is no universal answer. It is up to you to settle it for your own situation, but always at the time of contracting, not after.
The clauses we forget, and the one we include without (enough) thought
Reversibility and audit: As discussed above, this clause must be adapted to the use case. Never adopt generic clauses. If your clause has been copied over, it will most likely be of no use.
Intellectual property: Always strategic, this clause has now become critical with AI. Check the status of incoming and outgoing data, remain the owner of your datasets, keep control over them… What the vendor allows itself to do with your data to improve its service can no longer remain implicit.
Assignment of the contract: This clause is a blind spot we run into far more often than you might imagine. If the vendor is acquired, what happens to your relationship? A change of shareholder redraws a subcontracting chain without anyone thinking to tell you.
Governing law and jurisdiction: At the risk of stating the obvious, you need to define contractually on which liability ground you operate. I would point out that there is no such thing as a neutral law. When in doubt, it is better to anchor on the registered office and the place of performance than on a “supposedly neutral Swiss law”.
Sovereignty: knowing where your data lands
I will finish with a widely held and largely biased perception: extraterritoriality does not only concern the United States. Canada, Australia and the Five Eyes countries have comparable access mechanisms. Reasoning that “data outside the US is therefore protected” is a comfortable shortcut, but a false one.
The right reflex is methodological: conduct a Transfer Impact Assessment. The aim is not to tick a transfer box, but to answer two concrete questions:
who can access this data,
and through which channel?
Bear in mind that when facing a foreign request, you are not alone. In France, the SISSE (the government’s economic security service) issues opinions, and the 1968 blocking statute can be used to justify refusing disclosure.
It all happens before signing
I will conclude by saying that crises are inevitable. A contract certainly does not protect us from them. It does, however, allow both parties to think constructively about an exit plan when such situations arise.
This op-ed covered the preventive measures to consider at the time of contracting. My next op-ed will address the steps to take in the event of an incident to avoid litigation.
In the meantime, if these topics resonate with challenges in your organization, we have put together a concrete, practical guide in this book.
We will also have the opportunity to discuss it on September 30 at 10am with 5 other vendor risk experts. Free registration.
I look forward to discussing it with you.