After a recent engagement where a client faced a six-figure surprise invoice and a 90-day data lock-in following a generative AI model deployment, I was compelled to systematize my review process. The contracts for AI/ML runtime services—from hyperscalers and specialized vendors alike—are a distinct breed, blending traditional SaaS pitfalls with novel computational and data hazards. My resulting checklist is born from scars, not theory.
The core differentiator from standard cloud contracts is the opaqueness of unit economics and the entanglement of your trained models and data with the provider's platform. Below is the distilled checklist I now apply, categorized by critical risk domains.
**1. Pricing & Opaque Overage Definitions**
This is the primary cost trap. "Tokens," "GPU-seconds," "model parameters served"—all are abstract and subject to redefinition.
* Verify if the contract defines the pricing unit with technical specificity, ideally referencing a measurable metric in the service's API (e.g., `input_tokens` and `output_tokens` as defined in the OpenAI API). Vague terms like "API call" are insufficient.
* Scour for **buried overage clauses**. Does the committed tier have a soft limit that triggers a much higher pay-as-you-go rate, or a hard limit that simply stops service? A "best-effort" provision to notify you of overages is a red flag.
* Calculate the effective cost per thousand inferences at both your expected and peak loads. Model this in a spreadsheet against alternative providers.
**2. Data & Model Portability and Licensing**
Your competitive advantage is often your fine-tuned model and your proprietary data. The contract must protect it.
* **Training Data:** Confirm in writing that your training data is not used to improve the vendor's base models unless you explicitly opt-in. Look for language like "shall not use Customer Content to improve the Service."
* **Resultant Model:** Who owns the weights of the model you fine-tuned on their service? Is there a fee to export it? Can you run it elsewhere? The answer must be that you own it and can export it without a recurring "runtime license."
* **Data Deletion:** Upon termination, what is the SLA for deletion of your data and models from all backup and live systems? "Reasonable efforts" is not acceptable. Demand a specific timeframe (e.g., 30 days).
**3. Performance & SLA Nuances**
Uptime SLAs for AI services are often meaningless if latency degrades unusably.
* The SLA must cover **latency percentiles** (e.g., P95 inference latency < 500ms) for your region and instance type, not just HTTP `200` responses.
* Check for **capacity guarantees**. Can the vendor throttle your requests during "high demand periods" despite you being within contracted limits? This is common and often buried.
* Is the SLA remedy service credits, which are worthless if the outage disrupts your business? For critical workloads, negotiate for a financial penalty clause.
**4. Termination & Renewal Traps**
* **Auto-renewal:** The notice window to prevent auto-renewal is often absurdly short (30 days). I advocate to strike auto-renewal entirely or extend the notice window to 90 days.
* **Termination for Convenience:** Can you exit the contract without cause? What are the exit fees? Is there a "data extraction fee"? Map the full decommissioning cost.
* **Vendor Lock-in:** Review all dependencies: custom APIs, proprietary model formats, unique feature stores. Document a migration plan *before* signing.
For illustration, here is a Terraform snippet I use to codify some of these requirements as tags and alerts, ensuring the operational team is aware of contractual thresholds.
```hcl
# Example: Tagging resources tied to a contracted AI service with cost/performance limits
resource "aws_cost_anomaly_subscription" "ai_runtime_spike" {
threshold_expression {
dimension {
key = "SERVICE"
values = ["Amazon SageMaker", "Bedrock"]
}
}
# Alert if monthly forecasted spend exceeds committed tier by 20%
threshold = 1.2
}
resource "aws_cloudwatch_metric_alarm" "inference_latency_breach" {
alarm_name = "ai-contract-p95-latency-breach"
metric_name = "ModelLatency"
namespace = "AWS/SageMaker"
statistic = "p95"
period = 300
evaluation_periods = 2
threshold = 0.5 # Contractual 500ms P95
alarm_description = "Breach of contractual P95 latency SLA"
}
```
The final step is to run a tabletop exercise: simulate a termination notice. Walk through the process of extracting all models, deleting all data, migrating to a competitor, and calculating the final invoice. The friction you discover is the true cost of the contract.