Legal AI Procurement Checklist: Contract Terms to Get Right

We run a directory of AI legal software and we don't sell any of it, so nothing here is shaped by a vendor's interest in a quick close. This is a buyer's software checklist, not legal advice. It tells you which terms to look for and why they matter. Your lawyer, your general counsel or your bar's ethics counsel should decide how those terms are drafted for your situation.

How is procurement different from evaluation?

Evaluation happens before you want the product. You run demos, test accuracy on your own documents, check workflow fit and compare features. Our guide on how to evaluate legal AI covers that stage, and the security questionnaire covers the written due diligence that sits inside it.

Procurement happens once you do want it. The leverage changes at that point. Before you commit, the vendor is courting you. After you sign, you are a renewal line in someone's forecast. Everything that matters about the relationship over the next three years either made it into the paper or it did not, and the paper is what a dispute gets argued from.

Two things make legal AI contracts different from ordinary software terms:

• Your data is the product's input. A calendar app does not receive client confidences. A drafting or review tool does. The terms on use, retention and access carry professional consequences, not just commercial ones.
• The market is moving. Products are being bought, renamed and folded into larger platforms at a steady rate, and the pricing model for AI features is still being invented. A contract signed on today's assumptions can be wrong in eighteen months.

Professional guidance points the same way. North Carolina's 2024 Formal Ethics Opinion 1 says a lawyer may use AI if it is used competently, securely to protect client confidentiality, and with proper supervision. Securing client information is hard to do through a contract you have not read. Your own jurisdiction's rules govern, so read them directly.

A court-conference resource published in May 2026, the AI Product Evaluation Checklist from a US District Court panel for law firms and judicial offices, makes the same point from the procurement side: marketing claims should be matched by enforceable contract terms covering data use, confidentiality, security, retention, audit rights and termination. That is the working principle for every item below.

The 20-item contract checklist at a glance

Every item gets one of three ratings. Use them as a negotiating order: spend your energy on the "walk away" items first, then the "insist" items, then trade on the "ask" items.

#	Area	Contract term	Rating
1	Data	Written no-training clause covering your inputs and outputs	Walk away
2	Data	Defined retention periods for prompts, outputs, logs and files	Insist
3	Data	Deletion on request and at termination, with written confirmation	Insist
4	Data	Named sub-processors and advance notice of changes	Insist
5	Data	Vendor staff access limited and logged	Ask
6	Data	Breach notification window and cooperation duties	Insist
7	Money	Cap on renewal price increases	Insist
8	Money	Seat or usage definitions written out	Ask
9	Money	AI features priced and bundled in the order form	Insist
10	Money	No auto-renewal without notice, and a reminder window	Ask
11	Money	Fee protection if the vendor changes its pricing model	Ask
12	Exit	Right to export all your data in a usable format	Walk away
13	Exit	Export window and transition help after termination	Insist
14	Exit	Termination for convenience or for material change	Ask
15	Exit	Refund of prepaid fees when the vendor ends the deal	Ask
16	Exit	Service continuity if the product is discontinued	Insist
17	Ownership	Change-of-control notice	Insist
18	Ownership	Your right to terminate after an acquisition	Insist
19	Ownership	Terms bind successors and assigns, data terms survive	Walk away
20	Ownership	Ownership of your outputs and work product	Walk away

The sections below explain each group. The ratings are our judgment as a buyer's guide, and a vendor offering a strong equivalent in different words is not a failure. Read the substance, not the label.

Which data terms belong in the contract?

This is the group where a gap does the most damage, because the harm is hard to reverse. Items 1 to 6.

1. No-training clause (walk away). The contract, not the website, must say the vendor will not use your inputs or outputs to train or improve models. A line in a help center article can be rewritten without notice. A clause in the signed terms cannot. If the vendor routes work to a model from a large lab, ask whether the same restriction applies to that provider. Our guide to legal AI data security explains how those layers of terms stack.

2. Defined retention (insist). "We delete data periodically" is not a term. Ask for the retention period for each kind of data: uploaded files, prompts, generated outputs, logs and metadata. The court checklist above lists the same set, and notes that retention settings should be adjustable or disableable where appropriate.

3. Deletion on request and at termination (insist). You want a deletion right you can exercise mid-contract, and a deletion duty with a deadline when the contract ends, plus written confirmation that it happened. Ask what happens to backups and how long they persist.

4. Named sub-processors and change notice (insist). The product likely relies on cloud hosts, model providers and support tools. The contract should list them, or point to a list that the vendor commits to keeping current, and should promise notice before a material sub-processor is added or replaced. Without notice, your data can move to a new party between renewals and you learn about it afterward.

5. Staff access (ask). Who at the vendor can read your content, under what circumstances, and is the access logged? Most vendors offer "only for support, with permission." Get that written down. Tighter terms are standard in enterprise deals and worth asking for in smaller ones.

6. Breach notification (insist). A window measured in hours or days, a defined contact, and a duty to cooperate with your own notification obligations. Many clients' outside counsel guidelines set their own notice deadlines. Your vendor's promise cannot be slower than the promise you made to your client.

Do small firms need a data processing addendum (DPA) at all? The FAQ covers it. Short version: the principle applies at every size, and the form can be lighter.

How do you protect against price increases?

AI pricing is unsettled. Vendors are testing seat fees, usage credits, add-on modules and bundles, and the product you buy as one line item can arrive at renewal as three. Our legal AI pricing guide shows how few vendors publish a price at all, which means the order form is often the only pricing document you will ever see. Items 7 to 11.

7. Cap on renewal increases (insist). Ask for a fixed percentage cap or a fixed schedule over the full term. Without one, the first renewal is the vendor's first chance to reprice a tool that now holds your workflows. Can you negotiate legal AI pricing? Yes, and the renewal cap is often easier to win than the opening discount, because it costs the vendor nothing in year one.

8. Written definitions of seats and usage (ask). What counts as a seat, a user, a matter or a page? Is a reviewer who opens one document once a month a full seat? Ambiguity here becomes an invoice dispute.

9. AI features named in the order form (insist). If the demo showed an AI assistant, the order form should list it and state whether it is included, metered or a separate module. "Platform access" with the AI features sold later is a common pattern in this market. Our pricing tracker shows which published prices we have verified, which is the baseline to hold a quote against.

10. Auto-renewal with notice (ask). Many contracts roll over for another full term unless you cancel inside a window. Ask for a reminder from the vendor a set number of days before that window, or for month-to-month renewal after the first term. Then put the date in your calendar yourself.

11. Protection against a pricing-model change (ask). If the vendor moves from seats to usage mid-term, you want the old model to continue until renewal. This is the clause that vendors resist most and buyers think of least.

What happens to your data if the vendor is acquired?

This is the group that makes legal AI different from other software categories, and it is where our acquisitions and rebrands tracker earns its place. Consolidation is a documented pattern in this market, not a worry. Casetext went to Thomson Reuters. Gavel went to Relativity in June 2026. Wexler went to Legora in July 2026. Some products continued under their old names. Some rebranded. In every case a customer's contract counterparty changed behind the product they thought they had bought.

When ownership changes, your data sits with the new owner, under whatever terms the contract preserves. Items 17 to 20.

17. Change-of-control notice (insist). The vendor should tell you within a set period when it is acquired, merges or sells the product line. Without this you find out from a press release.

18. Your right to terminate after an acquisition (insist). A window, often 60 to 90 days after notice, in which you may leave without penalty and receive a refund of prepaid fees for the unused period. The acquirer may have different security practices, different sub-processors and different views on training data. You should not be locked into the new owner's choices.

19. Successors and assigns, with data terms that survive (walk away). The contract must bind whoever takes over, and the no-training, retention, deletion and confidentiality terms must survive any assignment. If the vendor will not commit that its obligations travel with the business, the protections in items 1 to 6 are only good until the next deal.

20. Ownership of outputs and work product (walk away). You, or your client, own what the tool produces from your inputs. The vendor gets only a limited license to run the service. Look for any grant that lets the vendor reuse outputs, and for any language that treats your work product as vendor-owned data.

Because ownership terms matter, check who currently owns any tool on your shortlist. Every tool in our directory shows its current listing, and the tracker records changes we have verified.

How do you exit cleanly?

Exit rights are the cheapest thing to negotiate before signing and the most expensive thing to lack afterward. The court checklist names avoiding technical or contractual lock-in as a critical procurement objective, and specifies that the contract should state what happens to data at termination, how quickly it is deleted or returned, and whether transition help is provided. Items 12 to 16.

12. Data export (walk away). You must be able to get your documents, prompts, outputs and usage history out, in a format another system can read, at any time and not only after you have paid a fee. Ask what the export looks like before you sign, and request a sample. A tool that holds your work in a format only it can open is a lock-in.

13. Export window and transition help (insist). After termination you need a defined period, such as 30 to 90 days, with access to retrieve data before it is deleted. Ask whether transition assistance is included or priced.

14. Termination for convenience or material change (ask). Annual terms are normal. A right to exit mid-term when the vendor materially changes the product, the security posture or the pricing is the safeguard that matters most in a fast-moving category.

15. Refund of prepaid fees (ask). If the vendor ends the agreement, discontinues the product or breaches the contract, unused prepaid fees come back. Without this, the vendor's failure becomes your prepayment.

16. Continuity if the product is discontinued (insist). Notice period, continued access during wind-down, and a guaranteed export window. Acquired products are sometimes retired after integration, and a quiet sunset is the contract risk that the first group of items does not cover.

What does a sensible negotiating order look like?

You will not win every item. Smaller firms in particular should know which ones to hold and which to trade.

1. Start with the walk-away list: items 1, 12, 19 and 20. A vendor that cannot give you these has told you what the relationship will look like.
2. Then the insist list. Most are cheap for a vendor to grant. Their cost is paperwork, not money.
3. Trade the ask items. Offer a longer term or a reference in return for the renewal cap, the pricing-model protection or a refund right. Those are real concessions, and they have value to the vendor.

A few mechanics help:

• Get the documents early. Request the master terms, the DPA, the security documentation and the order form before the final call, not during it. Read them against this list.
• Put the commitments in the contract. The sales deck, the security page and the email from the account executive can all say something different from the signed paper. Contracts commonly contain an entire-agreement clause, so assume only the signed documents count.
• Ask who can bind the vendor. A salesperson's promise carries little weight. Look for a signature from someone with authority and ask to have commitments made in an addendum.
• Match the AI risk language to a framework. The NIST AI Risk Management Framework is a voluntary, widely referenced structure for describing AI risk. If your clients or insurers use it, vendors can often map their answers to it, which saves a round of questions.

If your firm has an in-house counsel or outside counsel handling tech contracts, give them this list as a starting scope and let them draft the language. If it does not, a single review by a lawyer experienced in software agreements is cheap compared with the cost of discovering a missing term during a dispute.

Where should you begin?

Start with vendors that are verified active. A tool with an unclear owner or a stale listing makes items 17 to 20 impossible to negotiate, because you cannot tell who will be on the other side. Our directory of AI legal tools lists tools we have verified, listing is free and featured placement is labeled and never affects ranking. If you build a shortlist there and then run each vendor through this list, you will have compared like with like. Vendors who want to be considered can submit a tool, and those who want more visibility can look at featured placement, which is a clearly labeled paid option.

FAQ

What should a legal AI vendor contract include?

At a minimum: a written no-training clause, defined retention and deletion terms, named sub-processors with change notice, a breach notification window, a cap on renewal increases, a full data export right, a change-of-control provision and ownership of your outputs. The 20-item table above puts these in order of priority.

Can you negotiate legal AI pricing?

Yes. Many legal AI vendors do not publish prices, which signals that quotes are negotiated by deal. The strongest levers are term length, number of seats, a reference or case study, and timing. The renewal increase cap is usually the term with the best return, because it costs the vendor nothing in the first year.

What happens to data when a legal AI company is acquired?

Your data stays with the vendor entity, which is now owned by someone else. The no-training, retention and confidentiality terms stay in force only if the contract binds successors and assigns. A change-of-control notice and a right to terminate without penalty after an acquisition give you the choice to leave. Without those, you have only whatever the new owner decides.

Do small firms need a DPA with AI vendors?

The obligation to protect client information does not shrink with firm size, so the terms a DPA covers should be in writing at every size. Many vendors publish a standard DPA that you can accept online. For a small firm, the practical step is to read it against items 1 to 6, ask the vendor to fix any gaps, and keep a copy in your vendor file. This is general software guidance and not legal advice.