Summary
This 186th episode of Coffee with Digital Trailblazers covered key negotiation tactics, including competitive bidding, understanding vendor roadmaps, avoiding auto-renewal clauses, and ensuring proper data ownership and security terms. Martin Davis shared elements of his comprehensive three-page checklist for SaaS contracts, which includes 88 clauses to consider. Other participants discussed the importance of reading contracts thoroughly, separating commercial terms from legal terms, and involving the right stakeholders in negotiations. T
he group emphasized the critical need to understand data usage rights, especially for AI models, and the importance of having proper governance processes in place. Several participants highlighted the difference between new vendor contracts and renewals, noting that renewals often require faster decision-making and different negotiation approaches. The discussion also touched on the rising importance of MSP versus SaaS contracts for AI infrastructure and the need for proper audit controls and breach notification procedures.
Speakers
- Host – Isaac Sacolick
- Digital Trailblazers – Derrick Butts, Martin Davis, Joanne Friedman, John Patrick Luethe, Liz Martinez, Heather May, Joseph Puglisi, Elena Putilina
Discussion
- What are your negotiation tactics for commercial and renewal terms, especially as solution providers are increasing prices, underpricing AI services to drive utilization, and introducing consumption-based pricing components?
- What are the key terms you look for around data, IP, AI, and security that you are negotiating and not accepting boilerplate terms around? What are the tough issues that require multiple back-and-forth?
- What’s your approach around exit clauses, term commitments, SLAs, breach definitions, and other clauses needed to future-proof the contract?
Research
Whiteboard
Transcript
[00:00:00] Speaker A: Welcome to this week’s Coffee with digital trailblazers. August 28th, our 186th episode and we’re doing a little bit of a countdown to our four year anniversary which I think is sometime in September or October. I’ll make the announcement then.
We have a topic that one could say maybe a dry topic, but I think we’re going to make it super interesting and informative.
I think we’re going to end up with at least oh I did it again.
I did it again. I can’t believe I did that again. Anyway, back here I have a feeling we’ll end up with at least 10 to 15 concrete ideas, things to put on your checklist that you never thought of before that go into your SaaS, Cloud and now AI contracts. There’s some similarity and some very stark differences as we look across those types of contracts. We’ll be talking about some specifics around that we will not be covering today. Professional service contracts if you’re interested. Yeah, Kristen, four years. If we won’t be, we won’t be covering those contracts.
If you want to hear a separate episode around professional service contracts, let me know and we’ll do a separate session going into Q4 around that topic. So thank you for joining. Oh look at that, Liz is making it here. We haven’t seen her in a while. Thank you for joining. This week I’m going to share some research around this topic. I didn’t even know what I was going to find when I looked for it but I went looking around and said I need some Data points around SaaS, around cloud and around AI. And the first set of data points comes from a company called Zylo who I’ve known for a very long period of time.
We have a lot of SaaS applications out there and we spend a lot of money out there on it. Their median and I think this is for companies that use Zylo as a service to manage costs.
Comes out to almost over 20 million a year and over 240 apps which is just crazy. The average company has 211 SAS renewals every year.
2 out of 26 SaaS Management Index said that an average of 36% of their licenses goes unused.
And Gartner says that by 2027 70% of leading SaaS vendors or offer consumption based pricing across at least part of their portfolio. That means you’re not only going to be paying for a per seat license, you’re going to be paying for overages and for other services that have some kind of token OC mix to it.
Several good reasons there to really be paying attention to your SaaS contracts. Now with cloud the lock in that mattered was written into the agreement. This is from Redress Compliance law firm and they break down a few different areas that for CIOs and enterprises you should be concerned of regarding cloud contracts. The first one is just your exit costs. The egress costs are moving hundreds of terabytes out of your cloud environment become a problem.
There’s often discounts for committed use but how to unwind or relocate those costs within the contract becomes problematic. So if you promise a certain number of services or a certain amount of storage and you shift your strategy, moving cost from pocket A to pocket B is often problematic.
And you know your cloud vendors are generally not on the hook or data extraction or any kind of transition assistance. Just something to be aware of if you think that you’re going to be moving providers in the Future. Now with AI atonement gave me 20 different contract clauses to look at. I suggest looking at these.
Some of them are around IP ownership, data rights, model stability, SLA commercial clauses, exit clauses, insight on opt in, no training or inputs.
Just making sure that your contract is very specific about language that opt in to using these things for data purposes and training purposes.
Watch out for multi year contracts being able to terminate for convenience. I put that there because I had a CIO from our SIM organization here in Fairfield Westchester say to us that you know there’s so much change in AI, we need to be able to have a contract that allows us to leave and we didn’t do that the very first time we signed a contract. Very important to consider and most AI contracts if you’re a medium vendor or smaller are not going to commit to communicating you changes.
I think that’s really important to look for. So just some of the things you should look for in your cloud contracts and if you want access to this slide with the links do visit drive starcio.com coffee you’ll get access to this slide, the dashboard that we create today, the recording when this is available as well as access to previous recording.
So I’m just going to shrink this down for those who come to the party late and we’ll get into our conversation around around SaaS, cloud and AI contracts where technology leaders lose leverage. I want to start by just thanking my team for being here. We have a full house
[00:06:04] Speaker B: of our
[00:06:05] Speaker A: advisors experts here today and I thought it would be interesting. We’ve never shared or discussed this before so I am sure I’m going to learn some things from some CIOs here. Number one, starting out with Martin, who says he has a checklist he uses for SaaS providers in particular.
And my first question, Martin is around negotiating tactics around commercial and renewal terms.
It’s really important as solution providers are increasing prices. In the case of AI, many of them are underpricing their services to drive utilization.
Others are adding consumption based pricing. I’d love to hear your thoughts on how you negotiate this. Welcome, Martin.
[00:06:52] Speaker C: Well, thanks for having me, Isaac. And it’s good to be back after being on the road quite a bit in August.
And yeah, unfortunately put it that way because it’s always painful is dealing with contracts and dealing with particularly SaaS vendors and software vendors generally. And we all know that it’s one of the most painful things you have to do. And you always ask for proof for everything because the amount of things that are said by sales execs, etc. On the software side of things that suddenly vanish once the contract signed is remarkable. So I always work on the basis that I don’t trust anything unless it’s been proven to me.
And with software vendors that seems to be the best approach.
In terms of the whole negotiation thing, I think it’s very different. You need to separate out negotiation with a new vendor or something you’re starting versus renewal because those are very, very different topics.
So let’s focus on the new vendor.
First of all, the key thing here is as often as possible try and do a competitive bid situation.
So let’s say you’re actually selecting vendors. You start with six vendors, you trim it to three, you get into more detail with three, I would then not pick a winner. At that point I would dismiss one vendor and keep two in the running. Hopefully you’ve got two that are relatively comparable.
Relatively similar. And I would do a bake off between those two and I would play them off against each other and they’ll probably work out who the other key vendor is. Yeah, so they’ll probably, if they know their market enough, they’ll probably figure it out.
But yeah, you play them off against each other and that is the best way to do it. And make sure you’re looking at like for, like. Yeah, if one says they’re going to include, I don’t know, a thousand hours of consultancy and the other one says they’re going to include 1200, then for your comparison, make sure you’re, you’re actually, you’re pushing for the same thing. Yeah. If you only need a thousand, then Push the other one to reduce their price and include a thousand.
Or if you need 1200, push the other one to keep the price the same and make it 1200. Yeah, whatever it takes. Push one against the other and drive it from that perspective and also dive into what you are getting. Exactly.
If there is particular compliance aspects that you require from that software, make sure you’ve got proof of that compliance and proof of those things. So drive that if possible. And if you haven’t got maybe the proof from one of the vendors in quite the same way, then use that as a leverage. Use that to negotiate. Say, hey, yeah, we’re going to go with you. You’re not as compliant as the, the other vendor. Yeah, you need to do better on price.
Also find out when their year end is. You know, their quarter end and their year end are key things for salespeople. Find out when those are and say, hey, do you want me to sign by the end of the year? Assuming their calendar year is their fiscal year. If you want me to sign by the end of the year, what’s your best price?
And then push them again and again and again.
Leave it to the last moment because quite often it’s no skin off your nose if you don’t sign until January. But it could be a very big deal to them and their sales bonuses. So push, push, push. Find out when to push and push a bit more.
[00:10:27] Speaker A: Really good points here. Before I go to the floor, I’m going to ask anybody who’s been a active CIO or CISO to give us your benchmark. I mean, how much time do you go from, you know, RFP to bake off to trying to make a decision like how much time do you allocate for that?
[00:10:47] Speaker C: I normally allow three months.
[00:10:50] Speaker A: Okay.
[00:10:51] Speaker C: Because by the time you get into it, get into negotiation, get into terms and conditions and things like that, you’re easily talking three months.
[00:10:59] Speaker A: Okay, let’s keep going around. Hello, John, welcome to the floor.
[00:11:03] Speaker D: Hey Isaac, thank you for having me on. Happy Friday.
[00:11:09] Speaker A: Your thoughts today?
[00:11:11] Speaker D: Well, I think Marcin did a great job of covering the new vendors, but where I’ve really spent a lot of time is going into an organization that already has a lot of SaaS companies. And the first thing I found that you always have to do is, is actually make sure you have the complete list of all the SaaS companies that you’re, that, that you’re dealing with at the company. And so a lot of times you can, you can have to look a lot of different ways. Sometimes we’ve even had to start looking into the finance system to see if people are charging things in on the credit cards. And once you have that list, it’s really important to get your, the date on when the renewals happen and what the renewal terms are. And so you have all that information. And so once, once you have that homework, the most important thing on the negotiation is actually going back to your business and to the users in the company and finding out which of these SaaS things give you value and which of them don’t give you value.
And if you can find the ones that aren’t giving value, you got to figure out how you can reduce the cost. And so when we’re negotiating with the vendors, it’s really important to make sure that you are right sizing the amount that you’re paying with the amount of use that you get and the amount of value that you get from them. And so where I see people really, really getting messed up is that they try to save a bunch of money. And so they, they over purchase a ton of either seats or, or capacity or cloud or, or however it’s measured. But they, they, the, the, the amount that they purchase doesn’t measure up with the amount of usage. And so if you can go and do your homework and really understand where you’re getting value and where you’re not getting value, then you can go back. When you’re negotiating with these companies, it’d be a lot better armed. And for the companies you’re not getting value from, you can either right size of contracts or exit them out. And the ones you are getting value from, you can then try to see if you can get a better, better price. So that’s, that’s the one strategy I’ve used a lot of places. Just, just make sure that you’re getting value from the SaaS companies that you’re using.
[00:13:05] Speaker A: John like how do you create a sort of a decision boundary of where you’re, you can, you know, either qualify or quantify that you’re not getting enough value in this renewal. And maybe you want to do a bake off on, on a switch or a downsize or let’s say a switch or a turn off.
[00:13:27] Speaker D: The first thing we find is, is that there will be a company standard and people are using things that aren’t the company standard. And so, and so then you can either quickly make a decision that you allow exceptions or you have a new company standard or you go and eliminate it. And so that’s one of the biggest savings I found is making sure that we kind of have one product for each function at a company, which is easier in smaller companies.
And then trying to get rid of all the things that have overlapped, things that are duplicates, and then that has the added advantages of everything in the company works better when we’re all using the same software.
The other thing is it’s just actually going in and look to see when people last log in and making sure you have an administrative account on each of these pieces of SAS software, making sure that the bill goes to the IT team.
And I’ve had people go in piece of software by piece of software and see from a login who’s actually using the software. And a lot of times we found that we’re using software, we have several hundred seats for it and we only have two or three people using it while we’re paying for 200, 300 seats of an expensive piece of software. And so those are right targets to eliminate and save a ton of money and, and really improve the efficiency of the organization by using similar software across it.
[00:14:44] Speaker A: Thank you, John. Welcome Joanne. We’re talking about SaaS, Cloud and AI and we’re talking about commercial terms, renewal terms and consumption based pricing.
Your three ideas today, Joanne?
[00:15:03] Speaker B: Write a clause in the contract.
Well, I’m kind of going at the end, but write a clause in the contract that allows you to upsize or downsize at a fixed price.
So for every seat that you want to get rid of, you get a reef, you know, a reimbursement back for every seat that you, if it’s seat based, that you, you have fixed charge for, for any increases and do it by the 50 or 25, 50, 75, 100, blah, blah, that kind of thing.
That’s at the end, but at the beginning.
First of all, I’m curious to, and I’m good, just going to throw this out there, AI can be very good at doing comparative analysis on costs and direct you. And remember also that there’s usually 10 to 15 people, if not more, that are involved in the negotiation or procurement process.
So although it clearly has a voice at the table, look at the terms and conditions.
One of the things that I have advised a lot of companies of late is about the AI and not only the use of their AI and when models change and all of those kinds of things, but also to guarantee that their data is never going to be sold or used by another company. And I don’t mean that in the tenancy model of sas, but I mean that around whichever vendor the SAS provider is using as their AI provider that they are guaranteeing that your data will never be used. And that is a tricky thing to do. But, but I think it’s extremely important that companies start recognizing that there are points of handoff where you may not have control, but you need to exert some level of governance or stewardship around that because anything can get anywhere these days.
So that’s the second thing. And then the third is I used to pull a really dirty trick on the vendors. I would shortlist them, do all the diligence, check with the business, found a lot of shelfware, a lot of the time, and I would make an appointment with each of them, you know, their sales guys or whoever to come in. Never tell one that the other is also going to be there. Have them face to face in a meeting and say, you do this, you do this and you do this. So if you want to renew the contract. And by the way, I always wrote a clause in that gave me liberty to cancel. Not during, not during, at a yearly renewal, but anytime in the middle of that if I didn’t get the adoption rate or if people really were using the software and write that in. And I would literally in a face to face meeting, play them off against each other and tell them put up or, you know, we’re going to change vendors. And I had already worked out what the cost of change would be. And this is for, you know, my experiences with very large enterprise with multiple facilities around the world. And these contracts were big.
Martin can also attest to this in manufacturing. A PLM contract, an MES contract, they’re huge cost, really big cost.
So you start playing them off against each other and you can force change.
You know, I need you to add this feature. I don’t care if it’s only for me, but this is what I demand and it becomes part of the contract.
So those are my three.
[00:18:39] Speaker A: I love those. Joanne, I’m going to ask Liz to comment on switching costs when you get your turn. Liz.
And the reason is that, you know, apples to Apple costs around licensing or storage or any other utilization metric and the project cost to move from point A to point B often doesn’t account for the change management costs. As I’m wondering how Liz thinks about that. And then Joanne, maybe even Derek can comment on this. You know, we used to think about like getting down, you know, negotiating like a car buy where we got down to price and features, figured out what those are and then start getting into the underlying terms. And I think when you talk about data and AI terms today, I think it’s a mistake to leave that later on. Right. I think you got to put that front and center and say, look, there are some data and AI and security terms that are unequal if not more footing than what you’re paying for these days. I’ll let you comment before we go to Derek.
[00:19:46] Speaker B: DEREK Yeah, no, I 100% agree and those have to be very, very specifically done. I would get legal involved to do it, or people who are very familiar with either data sovereignty law, IP protection, you know, all of that kind of stuff. It’s worth spending the money to get legal involved upfront so that you have standard terms and conditions with every vendor. And by the way, I will tell you what I’m seeing a rise in just as a final comment is MSP versus us because you need the infrastructure for AI far more than you need the actual provision of software. It’s software and services, sure, but you need that infrastructure and it’s not necessarily going to come from your cloud provider at a reasonable price.
[00:20:41] Speaker A: I love that. JOANNE and when you think about like Martin was talking about having a checklist, I mean one reason to work with your legal security and compliance teams around this is that they’re overwhelmed and if you take raw contracts and put them in charge of negotiating these things for you, you’re going to be in a long queue and have a long time for them to go back and forth where they have the least context around both risk and benefit.
If you can have a checklist up front, not that everybody’s going to fit into, you know, the, you know, if you end up with round peg, square hole kind of issues, you deal with those. But very often you can get a lot of this pre negotiated up front because you know what your non negotiable standards are. We’re going to bring Derek in.
Derek I’m just.
[00:21:31] Speaker C: Before you do that, Isaac, can I just go ahead, throw one thing in related to that, which is the difference between commercial terms and legal terms.
If you’re unfortunate and legal has to do both, then you can end up in that kind of queue system and it’s terrible.
A lot of companies, either the IT group or maybe a procurement group will negotiate the commercial terms and it’s only the legal terms like limits of liability and other things like that that have to go to legal.
So quite often you, the CIO or IT leaders can get heavily involved in negotiating the commercial terms, which is, and so it’s worth making that distinction.
[00:22:17] Speaker A: I think this is about who has the, who has the decision authorities and that is going to look different in different companies. Right?
[00:22:25] Speaker C: Yeah, very much a distinction there. Sorry.
[00:22:29] Speaker E: Yeah.
[00:22:30] Speaker B: No, no, no, 100% agree. And by the way, if you’d like to as to identify your 88 points, we’re happy to do that.
[00:22:38] Speaker A: Oh boy.
Go ahead, Derek. Jump on in here.
[00:22:43] Speaker F: Good morning. Thanks for having me. Yeah.
[00:22:44] Speaker A: So I’m going to give, I’m going to give you three, Derek. Only three?
[00:22:48] Speaker F: Only three. Oh man, I got more than that. But one of the first things I would say when it comes to contracts, no renewable contract terms, auto renewal, make sure that’s not engaged. That’s one of the things I think that people miss out on. They don’t read the fine print when things are renewed and things are updated. They just kind of get sucked into whatever that particular vendor is working with. The other thing I would really look at in, in as Martin mentioned also, I also form a contract relationship with my legal team and my finance team, my cfo. So I’m trying to figure out what kind of things they’re looking for up front. So I’m interacting with these SaaS vendors and these contracts, getting that stuff done up front. So when it gets to them, they don’t have to go through a whole lot of work to kind of figure out where all the nuances are, all the details in the, in the legal jargon, all the other things that are taking place, the visibility of data, you know, AI, when you look at who owns the data, how is it going to be used. A lot of vendors, how they’re storing the data, how they’re training with the data or even sharing their data, that has to be clear. And a lot of times I think that’s lost in translation when you’re looking at especially artificial intelligence. You know, things come down to like, what kind of things are you working with when it comes to drift and hallucinations, how you protect it against those. The other thing I look at is their security. Their security responsibility is not necessarily ours, but we want to make sure they have some sort of security standard in place.
Technology leaders often outsource this technology, accidentally outsourced accountability when it comes to security. Security is going to be that particular company’s concern. But they want to make sure that the companies and the third parties that they’re dealing with have a flow down cost, are doing some sort of security hygiene, that they’re protecting their own data and there’s going to be no backflow into their particular ecosystem. When you look at it from that perspective, it gives you more of a chance to understand what’s taking place. And the biggest thing I want to say in the last point is making sure they understand your environment. One of the comments in the chat here from Rick was, does that particular vendor understand what your current pain points are now, what your vision statements are in the future, and will their product and services scale to where you need to be? A lot of times when companies, they’re looking at this, they’re trying to sell you a product, they may not fully understand where you are and where you’re trying to go. They’re just trying to sell you a product. But if they understand your roadmap and the technology and how you’re trying to get there can be part of that process. It makes it a whole lot easier when you’re trying to sell it not only to the company, but also when you’re trying to move and migrate these services within the company, within not just your ecosystem, but also your business culture, because everybody has to be able to use and adapt to it. I see too many companies that order products and services, only 30, 40% of the people actually using it, which means they’re wasting money. They don’t have full optimization, they don’t have full agreement, and everybody’s kind of figuring out how to do their own thing. And I think a lot of companies miss out on that and they’re wasting a lot of money because they don’t do the due diligence up front to ask the right questions or engage the right business stakeholders as far as their teams to move forward.
[00:25:31] Speaker A: Interesting.
Derek, when we come back to you and anybody else wants to do this, to share what you see in a contract, that just makes you, like, screaming, ah, this shouldn’t be here. And, you know, it shouldn’t be in here. Now you got to, like, back into. I got to use my negotiating tactics to get, you know, the basics out before I get into what’s really important. So I’m kind of interested in what each of you say to that. Hey, Joe.
Welcome to the floor. Joe, you haven’t negotiated contracts before, have you?
Joe, you’re on mute.
[00:26:08] Speaker G: Yeah, you know, I might have done one or two.
[00:26:11] Speaker A: I wanted to. I wanted to stick to your three points.
[00:26:15] Speaker G: And so I’ve been thinking of something I can say concisely in terms of advice. Okay. Number one, read the documents.
I can’t tell you how many times I’ve asked a question of a senior staff member who is, you know, putting forward some proposal to renew or engage in a new contract.
And I Ask a question or two and say, well, you know, it’s boilerplate or it’s standard language or whatever. No, no, no, you got to read this thing from top to bottom and make sure that you have actually looked at what it says. So point one, read the documents.
Point two, I, I, I really feel there’s a big difference and someone alluded to this earlier, I think John brought this up, you know, a new contract versus a renewal, different time frames and a lot of, of different, a lot of the same considerations, but a lot of different considerations in a renewal scenario.
And I think Derek pointed this out. Wayne Anderson’s made a good point in the comments too. Auto renew is okay as long as you get plenty of heads up, plenty of advance notice. You’ve pre negotiated that no increase for three years or something of that ilk is documented, is in, in the contract. So new to Joanne’s point, you know, you can play all the games in the world, take all the time in the world that you want. If there’s no real time pressure, you’re entering into some new exploratory use of software platforms.
Yeah. Take your time, get your best deal, play one against the other. Absolutely. In a renewal you need to be a little more concerned that, you know, the clock is ticking.
And then finally.
I don’t know about the rest of the world, but I sure am having a heck of a time trying to figure out what things are going to cost.
You can think ahead and try all you want to quantify, put boundaries around govern, but at the end of the day with shadow it, shadow AI use and other things happening around the organization, it’s just there’s always some runaway cost somewhere, some leakage or, you know, some other issue that, that, or just the rates themselves. I mean I remember a few years back asking Microsoft for an Office365 proposal and I couldn’t make head or tails out of what the heck this thing is going to cost. It was just beyond bizarre. So that, those are my quick points, Joe.
[00:28:57] Speaker A: I love it. And one thing I would add to read the documents, don’t use AI to summarize them.
Summarize to an AI means gloss over the details.
When you’re reading a, a contract, you’re reading it to find the details, right? The things that make your skin crawl and say what, what does that mean?
You know, I read, I read contracts with audio, I listen to the whole thing and I’m listening for the thing that, you know, my brain triggers. Hey, that doesn’t sound right. I think it’s really important. Liz, we’re going to go to you next. You had your hand raised. I saw that.
I’d love to hear about my one question about switching costs and then your thoughts. You know, you run PMOs and value management offices. What are you looking for in terms?
[00:29:45] Speaker H: Okay, so in terms of switching costs, I’ll just address that one first.
You know, if the software that we’re talking about is central to your business and the key pieces that need to be in there in your turn, in your T’s and C’s is to make sure that if in fact you want to switch over to another competitor, that there’s actually a way to get your information out.
And also that you should be budgeting for that contingency so that you actually make it so that you’re not tied to them and shackled to them.
The biggest thing that that is detrimental. I know we’re not really talking about organizational change costs because that’s a huge piece of it, but the conversion cost of going from one competitor to another is just, it can be extraordinary.
And if the functions are relatively similar, you know, your org change, yes, it’ll be significant in terms of getting people used to a new system, but the function should be the same, relatively speaking. So I’m much more worried about the data than the org change.
The biggest thing though, if we go Back to the 1, 2, 3 is not being caught on your heels.
Make sure there is no auto renew or if there is, that you negotiated some kind of discount to actually give that to them.
[00:31:11] Speaker A: This is really, this is really it interesting because you know, Derek is on no auto renew.
You’re on also on the auto. No auto renew. Wayne Anderson on the Common stream says he disagrees with that. I, I actually agree with Wayne. I think it’s a good term to negotiate. I mean an auto renew means it’s on you to make sure that you’re going to get in front of that, right?
[00:31:35] Speaker H: That’s correct. That’s correct. And, and as long as you’re getting a discount for it, awesome.
But if you’re not, then make sure that you know when the terms are and you know, tell your vendor up front, by the way, you will be receiving a termination letter, you know, exactly X months because that’s what the contract says. Because at that point I’m going to be evaluating you against your competitors to see if it’s time for me to switch or not. So you need to be on your toes.
[00:32:03] Speaker A: That’s my point.
[00:32:05] Speaker G: Or I suggested. Right. I, I said it earlier, make sure that your auto renew has favorable terms, I. E. No increase and has an adequate alert built into the contract that you have to be told in advance, six, 90 days, whatever. And if, and if they fail, then that’s a breach of contract and you don’t auto renew.
[00:32:28] Speaker H: Lovely. So that’s interesting because usually what they say is that you have to notify them within X days if you’re going to, if you’re not going to auto renew and you know, if you’re not on top of that, it’s a slip pretty quickly.
Anyway, my third point really has to do with negotiating the commercial terms. And I would say beware of bundling these guys. What they like to do, or at least some of the hitters that we’re dealing with now is, oh, and we’re going to give you this for free. You know, then we’re going to give you this for free and oh, we’re going to give you this for free.
And some of them you don’t need.
And some of them are, it’s not even their software. So when it, you get the, you know, oh, we’re getting this for free, they’re not on the hook for maintaining it. Then you end up with another person that is no longer your central point of contact. It just turns into a spider’s mess.
So I would say as far as negotiation and okay, one last thing about commercial terms.
Just because someone has negotiated a contract before does not make them an expert. Just because they’ve done work with their lawyer, whatever, does not make them good at negotiating commercial terms. Really think about that skill set.
This new negotiation is a skill set.
And that’s something that you might want to.
[00:33:53] Speaker A: People forget that. I agree with that.
I think you’re dead on around that, Liz.
[00:34:00] Speaker H: Okay, that was my three or four. I don’t know how many that was,
[00:34:02] Speaker F: but
[00:34:05] Speaker A: Isaac, go ahead.
[00:34:07] Speaker B: Just a quick point because of something that Liz said. One of the things that people never seem to look at is ask for your vendors roadmap their game plan for the following year and put a clause in your contract that if they don’t deliver future function or service as per their, you know, disclosed roadmap, that that’s a reason to exit.
[00:34:35] Speaker A: Interesting.
[00:34:36] Speaker B: Be surprised.
[00:34:37] Speaker H: I like that because they do promise you the world, oh, we’re going to be rolling out this new agent and
[00:34:43] Speaker E: it’s going to do blah, blah, blah,
[00:34:44] Speaker H: but it’s just not ready yet.
[00:34:48] Speaker A: All right, I want to go to Heather in a second. Heather, give me a second to just say welcome to everybody to this hundred whatever 80 186th episode almost four years of coffee with Digital Trailblazers if it’s your first time here, we meet every week or almost every week to talk about issues facing and opportunities facing digital transformation leaders and those of us trying to get value from AI in our organizations. Today we’re talking about where technology leaders lose leverage and about the contracts we negotiate around sas, Cloud and AI. I said almost every week we we have a coffee with digital Trailblazers. We are skipping next week September 4th for Labor Day. I don’t want anybody coming online for anything next Friday. Enjoy your weekend last weekend of September. We’ll be back September 11th the hidden cost of confident AI semantics, guardrails and the context layer. I have a CEO joining us for this one.
I’ll make that announcement at the end of today’s session. Really good session. Do go to drive starcio.com coffee and the link to join that event is already there, as is our next two ones. On the 18th we’ll talk about the budget for 2027 and talk about where to make our AI bets, but also what IT and security to protect in our budgets as we’re going to have to make some choices going into 2027 and on the 25th. This is one of two topics that came up high in my recent poll on LinkedIn. This one will be about getting hired in the AI era, how to stand out, signal judgment and land the role. So there you have it. Our events going into September. Again, visit drive.starcio.com Coffee to sign up for these events, add it to your calendar and look at previous events. Heather, I’m so glad you’re raising your hand. So what do you have for us, Heather, I don’t know where you’re going to go.
[00:37:00] Speaker E: Well, it’s my esteemed colleagues really talked about the technical aspects and as often I do bring in the softer human skills first, Want to get a shout out to Rick, I don’t know how to pronounce your name. Sorry, but it’s we often choose by relationships to make sure that you have a good relationship with your vendor, regardless of what area they’re in. And often I have found that if two people, two vendors provide the same scale, the same products, the same cost, who are you going to go with? The person that you like. So you want to make sure that you have that relationship in place.
From a relationship standpoint, you want to make sure that you hear from them during the year.
You know, all too often it’s renewal Time. Hi, remember me? Sign my contract, give me my commission. But if you don’t speak to them all year where is the follow up where is the updates on what has been around.
So I think that that’s really important.
The some of the contracts that are being negotiated are negotiated by a procurement team but even within that and they could be negotiating paper cups for the cafeteria. So you want to make sure that whoever is going to be doing it ideally if they’re an attorney that does contracts but also that has a specialty in the area of IT software or whatever so that they can at least understand what your needs are and understand what the business counterpoint is. And having a business member, a business unit member being able to communicate with that negotiators so that you have that kind of support and then there are times when you just have to push through a new vendor people are not going to be happy. So to the extent that you can find a have champions that can talk about the benefits of it talking about how how they used it how they how someone other another team can use it I think that’s really important because makes it come to life in a way that the actual black and white paper doesn’t. And I just want to put in my vote for what Liz and and the contrary point that you had Isaac I believe in not auto renew those evergreen contracts you no matter how many alerts you get you put it in your calendar. Who knows if you’re going to be on vacation three years from now and that I think having it auto renew is just a bad idea.
[00:39:35] Speaker A: I think we’re hinting at some governance issues here.
I mean the reason a lot of companies fail around auto renew is the contract ends up in a folder. An owner of the contract was never identified.
That person who should have been identified leaves the company and the CFO IS and the CIO are killing themselves 30 days before an auto renew clause knowing that they have no time to negotiate. This is a governance issue.
It’s a lack of tooling and scheduling to keep track of your contracts and having a succession plan when that person who owns it has left the company. I mean this is all manageable isn’t it Martin
[00:40:21] Speaker C: 100 and most companies are incredibly bad at it which is why I said about no auto renew right I’m going to flip this back on you Isaac. So I have so I’ve got 20 different and then my my stuff I was looking I’ve got 20 different areas to the contract I’m going to get read them out to you and you pick three for me. So SLA for performance to the system. SLA for support, data ownership, data extract and transition, privacy and data protection, CyberSecurity, regulatory compliance, IP ownership software, escrow, subcontractor controls, audit rights, change management, pricing controls, termination and general provisions, feature and functionality testing and acceptance. Key personnel, data residency, business continuity and disaster recovery, confidentiality. So there’s 20 different things of areas you should be considering.
Pick whichever ones we haven’t covered and which ones you fancy me talking about.
[00:41:22] Speaker A: Well, I wanted you to read them all because for those of us who think and wonder why this takes time to negotiate, there you have it. You’re probably dealing with, you know, dial into at least a half a dozen of those things and keep in mind
[00:41:38] Speaker C: each one of those, there’s at least four or five or maybe even seven or eight different clauses related to each one of those.
[00:41:47] Speaker A: Yeah, I’m going to ask you to comment on data and AI if you can. And I’m wondering if Derek can comment on auditing because I’ve seen that come up quite a bit and it’s, it’s one of these things that irk me when I see it. So I’m wondering if Derek wants to comment on that. But Martin, talk about data and AI.
[00:42:08] Speaker C: Okay, so the data ownership piece, we already talked about some of that, about training of AI models and things like that.
I like to go with a more general statement which is all data entered, generated or processed remains solely the property of the customer and should not be used for any other purposes.
Vendor has no right to access, use, disclose or retain that data beyond the delivery of the service you’re paying for.
[00:42:37] Speaker A: Martin, talk to me.
[00:42:39] Speaker C: Just to add one piece to explicit prohibition on use of customer data for AI model trainings.
[00:42:47] Speaker A: Martin, talk to me about when you see clauses around anonymizing data for internal purposes or benchmarking or things like that.
Do you fight those?
[00:43:00] Speaker C: I tend to, yes. Because you’ve got no guarantee they’re actually doing it.
You’re still giving them a bit of an in to start playing with your data. So I tend to try and avoid those. Basically, they are not allowed to use our data for any purpose apart from providing the service we are paying for.
[00:43:20] Speaker A: That’s interesting because you’re going to find that in any smart SaaS company and certainly in AI companies. And I think this is why you need to put data in AI and IP upfront in the discussion because it’s, it’s value to them.
[00:43:37] Speaker C: Right.
[00:43:38] Speaker A: So there’s a value trade off there
[00:43:39] Speaker C: yeah, And I’ve gone into companies before and even internal within the company. Yeah, People say they’re going to do that for testing purposes and things like that. Take copy of production, anonymize it. I have found personal and, yeah, private and identifiable information in test systems because people have, within the company, have copied it back into test and QA systems and not actually taken that extra step. So, yeah, there is some, a slippery slope, let’s put it that way.
[00:44:12] Speaker A: Got it.
[00:44:14] Speaker D: John, the things I really want to look at is where and what countries is this data going to be going to? That’s the first thing I look at.
The second thing I want to really understand is the support team and the customer success team, like, how much access do they have to this data? I won’t name it, but there’s a piece of software that we used to use for very highly confidential stuff. And we’re a public company and we had a question and the customer success manager with us just logged into our system, generated the thing and then sent us a video showing like, how we used our system to get the data.
And from that point forward we just, we knew that we couldn’t use that, that system for anything sensitive. And, and I did hear from a CEO later on that some deep data had leaked from that company.
So those, those are the first two things that I really want to understand. And, and then you have to go to your customers, so the customers that you have, and make sure that you really understand, like what are all the, you know, PCI or HIPAA or whatever certifications you need to support your customers. You need to make sure that any of their customer data is protected by the same things. And so make sure, make sure. And then it’s really good to actually read those reports to make sure that they just haven’t downloaded the one from the cloud platform. Because we’ve, we’ve had people say that they have a SoC2, but then they send us the Azure SoC2, right. It’s like, no, you actually don’t have a SoC2. You have to have your own SoC2.
The two other comments is we’ve had our staff lawyers review contracts and then when I started asking them questions, they said that they only read the contractual terms. And so if you’re going to have people review contracts, make sure you give them very defined roles on what aspects of the contracts they’re going to review, like who’s reviewing the business terms, who’s reviewing the legal terms, and just make sure that there’s 100% coverage and that People actually review the entire document, then I couldn’t agree with Wayne. Wayne made the comment that you really need to have the list of software. And if, if, if the review rules are coming and you don’t get ahead of it, that’s on you. Like, so if you don’t know what software is running in your organization, that’s on you. And so it’s like step one and all this stuff is make sure you understand all the software that’s running your organization. When it gets renewed, when it gets renewed, what are the terms? When do you have to send the cancellation in? And so I mean, if, if you don’t have any other better system, you can use an online spreadsheet, but you have to have that stuff, otherwise you have no leverage in any of these situations.
[00:46:41] Speaker A: Thank you, John. Go ahead, Joanne.
[00:46:43] Speaker B: Well, a couple of points that I wanted to make to add on to what Martin was saying about AI and the use of data.
Never forget that anybody who is accessing your data as a provider can not only reverse engineer a business process, but that if they’re going to be using your data, that it is tied to another part of their offering. In other words, if you’re, let’s say, in the cloud and using an MES provider’s services in the cloud, the security around it, that’s your problem, not theirs.
If you’re doing ERP and mes, I’m talking about, you know, back office systems and manufacturing, as one example, the orders that go into your ERP may not agree with what’s in your mes, but that does not prevent your SAS provider from using the, the notion of the disconnect between these two systems as a competitive advantage for themselves.
So be very careful with not just what data goes into a SAS provider, but, but the correlation of that data, which may be anonymized to another SaaS provider. Because all of these systems ultimately get integrated one way or another and that can throw a wrench in your woodwork faster than anything else. That adds up to 40% more cost and people don’t pay attention to that. So no SaaS application is a silo. Think about what it gets connected to. Think about how that data flows from one to the other. And even if it’s in the same cloud environment, you’re going to get dinged on double dipping.
So be careful about those things.
[00:48:33] Speaker A: Thank you, Joanne. I’m just going to keep going around the room. We got 12 minutes left. Hello, Liz.
[00:48:39] Speaker H: I, I was putting some notes in the comment stream about how these processes for making sure that you’re getting ahead of things on vendor management are the perfect thing for a PMO to be running. A lot of people do put their vendor management under the PMO not to have the PMO do negotiations. Although in my case I could not to toot my own horn, but I am.
But you know, PMOs are expert at keeping track of things and making sure that the right processes are followed and nudging the right people at the right, right time. So think about that because centralizing this kind of oversight and governance is a really good way to relieve your inline manager, maybe even the person who owns the relationship with the vendor, to relieve them from the burden of keeping track of all the stuff.
[00:49:38] Speaker A: I completely agree with that, Liz.
I think it’s an ill defined responsibility, often by the CEO about why they’re using a pmo. And I think the trick of this is to get the value of what you need out of vendor management.
Everything. We just been talking about governance without it becoming a bureaucratic speed bump, which, you know, historically that’s how it’s been viewed and it doesn’t have to be that way. Let’s just leave it at that. Hello, Derek.
The reason I asked you about audits is it’s actually something to look for when done correctly. So I’m wondering what you look for in the ability to audit.
[00:50:25] Speaker F: Yeah, so if you’re auditing, as far as when you’re selecting a vendor, are you talking about after the fact when the vendors engage? Because there’s two ways to look at this. When I’m looking to secure a vendor, I’m looking at how well do they do their own internal cyber audit. I’m looking at SoC2 compliance, I’m looking at what kind of frameworks they’re looking at. I’m looking at their vulnerability and assessment they’re doing on their own internal systems. I’m also looking at feedback they’re getting from their existing customers as far as how well they’ve been treated when it comes to a breach, when it comes to the governance side of it, I’m looking at what kind of frameworks are actually working with the human in the loop. Oversight, decision making, accountability. All these things come into play that I’m asking them to be upfront and be transparent. It’s one of those things to say if it’s another thing to show me documentation to prove that this, you’re doing this. I’m also looking at how they’re auditing the retention and how they’re using the data. So if they’re saying they’re not using data, what kind of audits are they going through to make sure data is not being used maliciously or use them for their own training? The intents to make sure that my data that I’m presenting to them in good faith is being protected. I’m also looking at consent management, data utilization practices.
The other things I’m looking at is just the accuracy testing. You know, a lot of these companies use an artificial intelligence. Now we hear about hallucination and data drift. What are they doing to test to make sure their data is still good, their data is still accurate? What are they doing to monitor for hallucinations and other things? When it comes to audibility, there are a lot of different things you can look through. But I’m also looking at when it comes to audits, how they’re dealing with their subcontractors. So it’s one thing to have an agreement between what’s happening between you and me, but also how are they dealing with their subcontractors and vendors when it comes to different services, audits or breaches, how are they handling those incidents?
There’s also one of the last things is the resilience component as resilience is something that’s individual. But as I’m working with my companies to develop their cyber resilience strategy and posture, I’m also looking at how are they doing data recovery, backup, meantime recovery, if they should have a breach, incident response exercises, how long it takes. All these things come into play and they’re a concern. When I’m looking at how well are they going to handle it. If I’m dealing with things that are more industry based like healthcare or you know, with payment systems or government, I’m looking at HIPAA compliance, I’m looking at defense compliance with CMMC, FedRAMP, all these different things to make sure they are doing what they’re supposed to do and I’m not going to be the flow down of something that they missed. These are the some of the things I would look for an initial review of all the vendors that I’m interacting with and how I’m interacting with my customers to make sure they’re getting the biggest bang for the buck. But also they’re making sure they’re protected from a governance point of view.
[00:52:57] Speaker A: Eric, I think I’m going to just accent probably the most important thing I look for there is. I need to know their policies around a breach, right? What their notification periods are, you know, what we can expect. I don’t want to hear there’s a breach in the paper that happened three months ago and my customer data was impacted by that, right?
[00:53:21] Speaker F: Absolutely not.
[00:53:21] Speaker A: So, you know, slightly start there and then work your way up. Hey, Martin.
[00:53:27] Speaker C: So just to add to that, I always put a clause in that says breach notification to the customer within 24 hours of discovery.
I also put one that says 24 hour notification if vendor discovers a defect or vulnerability that could compromise data security.
So if they internally discover a vulnerability or a defect. So that’s an important one to have that as well.
So I was going to throw those two in just as a continuation of what Derek was saying. I wanted to go with one particular piece and that affects everything, but it’s very, very important and that is around SLAs.
So there’s two sides to this and people forget there’s two sides. One is SLA for performance of the system. So you’re looking for like four nines uptime, for example, making sure that that is in the contract with the appropriate targets are specified with tiered penalties.
So a performance commitment is great. An SLA is great, but unless it’s got penalties in there, it means nothing.
So you need penalties which is going to be a percentage of the monthly fee return depending on how bad performance is or number of performance incidents in that period.
So that could be anything from a 10% refund on your monthly fee to 100% refund depending on the level of problem.
And also include within that the vendor is required to deliver a monthly SLA performance report without being prompted. They have to send that to you every month to prove what they are providing.
And then the sla, on the support side of things, it’s great if you’ve got support, but if they don’t respond to you for three days on a level one, then you’ve got a problem. So I want to have defined P1 to P4 severity tiers. I want penalty clauses on there for repeated not satisfying those terms, particularly on priority once.
So if there’s a specific, a persistent SLA failure or there’s a, yeah, they’re not satisfying the priority one breach, not priority one problem area, then I want penalties in there for that as well. Because unless you’ve got that, you’re not holding them accountable and some form of escalation path to senior management within the vendor if they are repeatedly not performing. You need to be able to get to the, yeah, senior vp, the coo, CEO, whatever else, and have direct conversations with them about it.
[00:56:12] Speaker A: All right, I’m running out of space on My whiteboard for your recommendations. There’s a whole bunch of recommendations in the comments stream. I want to thank Keith, I want to thank who else is here, Orhan and Tony and Wayne has been on fire today. Wayne said Anderson, thank you for all your comments. Guys, we have four minutes. Go ahead Joe,
[00:56:36] Speaker G: real quick. Just one thing we have not talked about is understanding your obligations under the contract.
So again going back to, you know, read the fine print. Let’s make sure that you know what obligations you have with respect to training. That’s required testing, that’s required testing periods, reporting vehicles, platforms, whatever it is in that contract that you are supposed to do that’s going to give your vendor an out and take the liability of a failure away from them and put it back on your shoulders. So make sure you know your obligations
[00:57:13] Speaker A: are yet another important role of the PMO is to extract all of those and put it into, you know, either an on ramp plan and off ramp plan, a yearly plan. Really good suggestion Joe. Go ahead Joanne.
[00:57:27] Speaker B: Real quick, quick experience from earlier this week using the AI Frontier models.
All of, all of the data and all of the conversations that I’ve had with a particular firm disappeared and trying to get support was like pulling teeth.
It’s a, we’ll reply, it’ll be done, you know, next in queue, whatever, whatever.
There is no backup to whatever those conversations were and you literally have to go from the beginning, one by one get it to look through all the conversations or chats that you’ve had or you know, if it’s on the CO work or whatever kind of side. And I’m just using that as a word, be very, very careful with this. That everything that you do with an AI, if it’s important and you want to keep it, download it because if you don’t, good luck Charlie Brown. And I will tell you that with Anthropic I am not amused.
There was tons of stuff in there and it just completely disappeared and they have no way to recover it.
[00:58:38] Speaker A: A whole nother topic we should probably coin up about operational resiliency, data backups and retention with your SaaS providers. We’re not going to get to that today. John, go ahead, last call. Yeah, sorry Joanne, we got two minutes.
[00:58:54] Speaker B: No, no, go ahead.
[00:58:56] Speaker D: SaaS has become critical for, for us and like we’ve just, we’ve just outsourced so much of the stuff we used to do in House with SaaS that I mean understanding what the exit look like is really needs to be step one because, because if you, if you can’t understand how you get out of a piece of software. You should probably never get into it. And so you just gotta gotta make sure that you you fully know what it like what it’s gonna be like when you stop using the software, when how you get your data out, how the contract wraps up and how you move on to something else. Because if, if you can’t figure out how to run your company without this piece of software, it’s too critical to ever stick in in the first place. And so that’s, that’s the one thing I would say is always make sure you understand the exit before you sign up because this is going to be like a marriage with these things. And so if it’s not critical, it doesn’t matter. But if it is something super critical, then you really got to put the
[00:59:47] Speaker A: effort in finish up. Joanne
[00:59:51] Speaker B: well, the moral of the story was they recovered part of my data, but not all of it. And so I make a habit of always downloading stuff. But you actually need to then account for the fact that if the frontier models are not keeping or storing what what the AI is doing, you better take on that responsibility and you better budget for it or contract someone to do it for you.
[01:00:16] Speaker A: Folks, thank you for joining this week’s Coffee with Digital Trailblazer. Really good discussion. I’m going to try to capture all these suggestions into a blog post.
I do want to give a shout out to my friends here on the Coffee with Digital Trailblazers who sponsored who wrote into the Heller report on their top reads for the summer and into 2026 just published this week.
Thank you to everybody here, Derek, Martin, Joanne, Liz and Joe for putting comments in on Digital Trailblazer. If you have not read the book, go ahead and give it a good read. A lot of things that we talk about here stem from that book that I published a few years ago and many of you know I am working on a new book. We are taking next Friday off. We will be back on September 11th with the CEO of Calibra, Felix Van der Mar, talking about the hidden cost of confident AI semantics, guardrails and the context layer. Please visit drive.starcio.com the link to sign up that for that event is there as well as our other events in September. You can also use the link to add it to your calendar and I hope to see you all there in two weeks for the hidden cost of Confident AI folks, enjoy the rest of your summer. Good luck to everybody who is starting school and we’ll be back here in a couple weeks for our next episode. Everybody have a great weekend.
Leave a Reply