A company purchased an enterprise AI system after an impressive vendor demo.
The procurement team evaluated features, pricing, and implementation timeline. Legal reviewed the contract for standard terms. IT assessed integration requirements. The deal closed in six weeks.
Eighteen months later, the AI made a series of discriminatory decisions affecting hundreds of customers. Regulators investigated. The company discovered their contract contained no protections for this scenario – no indemnification, no liability sharing, no exit rights, no warranty that the AI actually does what the demo showed.
The vendor pointed to Section 8 of the contract. “Provided as is. No warranties expressed or implied.”
The company owned the liability entirely.
What Procurement Teams Get Wrong
Standard procurement processes weren’t designed for AI purchases.
Teams evaluate AI like they evaluate software – features, price, support, and uptime guarantees. These matter, but they miss the questions that determine who’s liable when AI causes harm.
What data was the AI trained on? How was bias testing conducted? What happens when the AI makes wrong decisions? Who’s responsible for model drift after deployment? Can you exit the contract if the AI produces harmful outcomes? Does the vendor indemnify you for AI-specific failures?
Most procurement teams never ask these questions because they don’t know to ask them. By the time legal gets involved, the vendor relationship is already established and contract leverage is gone.
The Vendor Contract Problem
AI vendor contracts are written to protect vendors, not customers.
Standard terms disclaim all warranties about AI accuracy or fitness for purpose. Liability caps limit vendor exposure to contract value while customer exposure is unlimited. Indemnification covers IP infringement but excludes AI decision-making failures. Data rights allow vendors to use customer data for model training. Exit provisions lock customers in for years regardless of AI performance.
Customers sign these contracts without understanding what they’ve agreed to. The vendor demo showed impressive capabilities. The contract quietly transfers all risk of those capabilities failing to the customer.
When AI harms occur, customers discover their contracts provide no meaningful protection.
What Legal Should Be Reviewing
AI purchases require legal analysis that goes beyond standard software contract review.
Training data warranties matter. Vendors should warrant that training data was legally obtained, properly licensed, and free from prohibited characteristics. Without this, customers inherit liability for discriminatory AI trained on improperly sourced data.
Performance standards need specificity. Vague commitments to “high accuracy” or “industry-leading performance” are meaningless. Contracts should specify measurable performance thresholds, testing methodologies, and consequences when performance falls below standards.
Bias and fairness representations should require vendors to warrant their AI has been tested for discriminatory impact and disclose known limitations. Customers deploying AI without understanding its bias characteristics inherit discrimination liability.
Exit rights need to include AI-specific triggers. Standard termination for convenience clauses aren’t enough. Contracts should allow exit if AI produces harmful outcomes, fails regulatory compliance, or creates legal liability regardless of standard termination provisions.
Indemnification should cover AI decision-making failures, not just IP infringement. Vendors resist this, but customers should push for meaningful liability sharing when AI causes harm.
The Due Diligence Gap
Beyond contracts, AI purchases require technical due diligence that most companies skip.
Requesting documentation of how the AI was trained, what bias testing was conducted, how accuracy is measured, and what known failure modes exist reveals whether vendors actually understand their own systems. Vendors who can’t answer these questions clearly are selling AI they don’t fully understand.
Reference checks should specifically ask how the AI performed in production environments, whether it behaved as promised, and what problems emerged after deployment. Vendor-provided references won’t volunteer this information but will often answer direct questions honestly.
Pilot programs before full deployment reveal real-world performance in your specific environment. Vendors resistant to pilots are often confident their AI won’t perform as impressively outside controlled demo conditions.
The Real Cost of Getting Procurement Wrong
Companies that buy AI without proper legal and technical review don’t discover the consequences until something goes wrong.
By then, they’re locked into multi-year contracts with no exit rights, no vendor indemnification for harms that occurred, and no contractual basis for requiring the vendor to fix problems. They own the liability from AI decisions they can’t explain or defend because they never understood how the AI worked.
The cost of proper AI procurement due diligence is a fraction of the cost of a single regulatory investigation or discrimination lawsuit from AI that wasn’t properly vetted before purchase.
Brian Alexander
Founding Partner, VisionAI+ Consulting Group
Former General Counsel, AI Engineering Firm
Certified ISO 42001 Lead Auditor