Every SaaS renewal your organisation processes this year is also an AI governance decision. Most procurement teams do not know this yet.
The tool coming up for renewal is not the tool that was originally signed for. In the time between the original contract and today, it has shipped AI features. The CRM now generates AI-drafted sales emails from customer data. The project management platform now summarises meetings and suggests task prioritisation using behavioural data. The finance tool now applies machine-learning models to flag anomalies in expense submissions. These are not edge cases, they are standard product update notes that most organisations skimmed past without registering what they meant for their data governance, their ai compliance posture, or their obligations under frameworks that did not exist when the contract was first written.
Renewal is the moment that changes. It is the only point in the vendor relationship where the organisation has meaningful negotiating leverage. And for most organisations, it is a moment being used almost entirely to discuss price, while the substantive question of what the vendor is now doing with company data goes unasked.
How Your SaaS Vendors Became AI Vendors Without a Procurement Decision
AI feature rollout in SaaS products follows a pattern that is worth understanding before you sit down at a renewal table.
Most SaaS vendors do not announce AI features as a separate procurement event. They ship them as product updates, framed as improvements to the service the organisation is already paying for. The feature is available. Sometimes it is opt-in. Often it is enabled by an administrator during a routine configuration review without recognising the data processing implications. By the time Finance is preparing the renewal conversation, the AI feature has been running for six months on live customer data, employee communications, or financial records, under a contract that contains no provisions specific to AI processing.
This is AI feature creep: not a deliberate decision to adopt an AI tool, but the gradual expansion of AI capabilities within tools that were adopted for entirely different reasons. It is the mechanism behind a large proportion of what discovery audits find when they examine an organisation's actual AI footprint versus its declared one. The gap between the two is almost never the result of employees going rogue. It is the result of vendors shipping AI into existing relationships, and organisations not having a process to catch it at renewal.
The enterprise risk management implication lands differently depending on the tool. A CRM processing customer data under a contract written in 2021 almost certainly has no clause addressing what the vendor can do with that data when it runs it through an AI model. There is no model training restriction. There is no notification requirement if the AI functionality changes. And there is no audit right specific to the AI processing layer. Those are not exotic protections, they are the provisions that did not exist as a category when most of these contracts were first negotiated, and that nobody went back to add when the AI features shipped. Each one is closeable at renewal, if the organisation knows to ask.
What Renewal Conversations Are Missing
The standard SaaS renewal conversation covers four things: price, licence count, service level agreement compliance, and whether to continue. These are the right questions for a spend management review. They are not sufficient for an AI governance review, and from the moment a SaaS tool started processing data through AI models, every renewal became both.
Here is what is missing from most renewal conversations, and why each gap matters:
What AI features are now active in this tool?
Most procurement teams renew the tool they originally assessed, not the tool that currently exists. The vendor's product has changed, and so has the data processing footprint. Before any renewal negotiation begins, someone needs to establish which AI features are active, what data they process, and whether that processing was covered by the original contract or the original GDPR data processing agreement. In most cases, it was not.
Is company data being used to train models?
This is the question vendors least want to answer clearly, and the one organisations most need to ask explicitly. Many SaaS platforms use aggregated customer data to improve their AI models, sometimes disclosed in terms of service, often in ways that are technically permitted under existing agreements but substantively different from what was understood at signing. At renewal, the organisation has the leverage to require a clear written commitment: company data is not used for model training without explicit consent, and the organisation has the right to opt out.
What happens to data if we terminate?
AI systems trained or fine-tuned on company data create a data residency and portability question that did not exist before AI was in the product. If the organisation terminates the contract, what happens to the data that was processed through the AI model? What happens to any embeddings, summaries, or derived outputs? Standard termination clauses written before AI features existed do not address this. Renewal is the moment to fix it.
Does the vendor's AI usage create EU AI Act obligations for us?
Under EU AI Act Article 26, organisations deploying AI systems, including third-party AI tools used in a business context, carry deployer obligations: human oversight, logging, and use in accordance with the intended purpose. If the AI feature embedded in a renewed SaaS tool falls into a high-risk category under Annex III, those obligations are live from August 2026. The renewal conversation is the right point to assess this, not after the contract is signed for another two years.
The Contract Clause Most Organisations Do Not Have
The gap between what a standard SaaS contract covers and what ai compliance now requires is not a legal technicality. It is a practical exposure sitting inside most organisations' existing vendor relationships, and it compounds at every renewal where the questions above go unasked.
A contract renewed without addressing AI feature creep typically carries these absences forward for another one, two, or three years:
- No AI-specific data processing addendum covering what the AI feature processes, where that processing occurs, and on what legal basis under GDPR
- No model training restriction - no explicit prohibition on the vendor using company data to train or improve AI models without consent
- No material change notification requirement - no obligation for the vendor to inform the organisation when AI capabilities change significantly
- No AI-specific audit right - the contract's general audit provisions rarely extend clearly to the AI processing layer
- No termination data handling clause covering AI-derived data, embeddings, or outputs generated from company data
None of these provisions are unusual to request. Vendors who are serious about enterprise relationships understand that procurement teams are now asking these questions, and the ones who are not yet asking will be within the next renewal cycle. The organisation that raises these points at renewal is not being obstructive, it is doing what every organisation with a mature enterprise risk management process does when a vendor relationship materially changes in nature.
The renewal conversations that I sit in on always follow the same pattern. The procurement lead's focus is on the price. The IT Director wants to confirm about the SLA, and a person from the finance team has a slide that shows the current spend. But nobody has a document that shows what the tool now does with company data versus what it did when the contract was first signed. The moment that changes the room is when someone asks that question out loud. The vendor representative pauses, the procurement lead looks at the contract and it becomes clear quickly that nobody knows what AI features have been enabled, what data they process, or whether the existing DPA covers any of it. The one question I would put at the top of any renewal checklist is: has this tool added AI features since the contract was last reviewed, and if yes, what data do those features process? Most of the teams are not asking it. - Ankur Arora, Co-founder, Montro |
Turning Renewal into a Compliance Automation Checkpoint
The fix for AI feature creep at renewal is not a longer contract or a more adversarial procurement process. It is a checklist, applied consistently at every renewal, before the negotiation conversation starts.
Before any renewal is approved, someone needs to establish whether the vendor has shipped AI features since the contract was last reviewed, and if so, what data those features process. That question is not currently on most renewal checklists. It should be the first item.
The second question is whether the existing data processing agreement is adequate for AI processing, or whether it predates the AI features currently active in the product. In most cases it does predate them, which means the processing is happening under an agreement that was never designed to cover it.
The third is whether the vendor's current AI usage creates EU AI Act deployer obligations, and if so which ones apply from when. The fourth is whether the renewed contract contains explicit provisions on model training restrictions, material change notification, and AI-specific data handling on termination. If the answer to either is uncertain, the contract is not ready to sign.
Building these four questions into the renewal workflow is what compliance automation looks like in practice, not a separate AI governance programme running in parallel, but governance embedded into the process that already exists. The organisation that runs this checklist at every renewal does not need to catch AI feature creep after the fact. The renewal process catches it before the contract locks in another year of exposure.
Gartner estimates that 30% or more of SaaS spend in a typical organisation represents waste from unused licences and duplicate tools. That waste conversation, what are we paying for, is it being used, has always been the starting point for renewal. What has changed is that it now needs a second chapter: what has this tool become, and is the contract still fit for what it does? Most renewal workflows have the first chapter. Very few have built the second.
Renewal Leverage Only Exists at One Moment
The leverage an organisation has to change contract terms peaks at renewal and drops to near-zero the moment the contract is signed. Once a renewed agreement is in place, the organisation is locked into its terms for another contract period, and any AI governance gaps it contains will sit there, compounding, for the full duration.
The renewal queue is therefore the only place where AI feature creep in existing vendor relationships can actually be fixed. Every contract coming up for renewal in the next twelve months is an opportunity to bring the agreement into alignment with what the tool now actually does. Every contract that renews without those conversations extends the exposure by another full contract period, and at that point, fixing it requires either renegotiating mid-term, which vendors have no obligation to agree to, or waiting for the next renewal window.
The tools most worth scrutinising are the ones that have been in the environment longest; the CRM, the finance platform, the HR system, the project management tool. These are the relationships where AI features are most likely to have been added since the original contract, where the data being processed is most sensitive, and where the original contract terms are most likely to be silent on AI. They are also the tools where the organisation has the most negotiating leverage, because the longer the relationship, the less appetite the vendor has to lose it over a contract amendment.
Frequently Asked Questions
What is AI feature creep in SaaS contracts?
AI feature creep is what happens when a SaaS tool adds AI capabilities after the original contract was signed, without the organisation making a deliberate decision to adopt an AI system. The tool was procured for one purpose. The vendor shipped AI features as a product update. The organisation is now using an AI system it never formally evaluated, under a contract that contains no provisions for AI processing. Because it arrived through a vendor update rather than a procurement decision, it bypasses the organisation's ai governance process entirely.
Does our existing SaaS contract cover AI features the vendor has added?
Almost certainly not in full. Standard SaaS contracts written before 2023 were not drafted with AI processing in mind. They contain data processing provisions for the original service, but typically have no restrictions on model training, no requirements for notification when AI capabilities change materially, and no specific provisions for AI-derived data on termination. Whether the existing agreement technically permits the AI processing depends on how the contract is worded - but even if it does, that is different from the organisation having exercised a deliberate choice about that processing.
When is the right time to raise AI governance in a vendor renewal?
Before the negotiation starts, ideally 90 days before the renewal date, when the notice window opens and the organisation still has time to negotiate or seek alternatives. Raising AI governance concerns after the contract is signed achieves very little. The leverage sits in the renewal window, and it disappears at signature. Build the AI feature review into the renewal preparation stage, not as an afterthought once the commercial terms are agreed.
Do SaaS AI features trigger EU AI Act obligations for us as a deployer?
Yes, and this catches many organisations off guard precisely because they did not make a deliberate decision to adopt an AI system. Under Article 26, any organisation using an AI system in a business context carries deployer obligations regardless of how the AI arrived, through a procurement decision or through a vendor update to an existing tool. If the AI feature falls into a high-risk category under Annex III, those obligations include human oversight, logging, and use in accordance with the intended purpose. The August 2026 deadline for high-risk system compliance is not a future consideration for organisations with renewals happening now, it is a clause question for the next contract they sign.
What contract clauses should we add at renewal to address AI?
Five additions cover the main exposures: a model training restriction (the vendor cannot use company data to train or improve AI models without explicit consent); a material change notification requirement (the vendor must inform the organisation when AI capabilities change significantly); an AI-specific data processing addendum covering what the AI processes and on what legal basis; an audit right that extends explicitly to the AI processing layer; and a termination data handling clause covering AI-derived outputs, embeddings, and any data used in model training. None of these is unusual to request, they are becoming standard in enterprise SaaS agreements as ai compliance requirements mature.
