ConceptAdvancedAI Opportunity & Model Strategy / Evaluating AI vendors as a buyer / #4
What contractual terms matter specifically for AI vendors and not for other software?
GUARD the clause that was missing from every contract Farrukh had ever signed
Colderidge Mechanical Services runs HVAC maintenance for a portfolio of small commercial buildings, including a daycare and a handful of clinics. Farrukh Ismailov is the facilities procurement director. Thermion sells an AI that reads live sensor data from rooftop units and predicts failures before they happen.
The direct answer
Write in a right to the vendor's incident logs and confidence history, on request, at no extra cost. Ordinary software never needs this, because it doesn't make a live judgment call about a piece of physical equipment that can fail silently. Without that clause, you cannot even tell whether the AI quietly missed something, and the people most exposed to that silence are never the ones with a pen at the negotiating table.
Do this, in order
Get a right to the vendor's incident logs and confidence scores, on request.Why: without it, you cannot reconstruct what the AI actually said when something goes wrong.
Require a defined fallback: a human gets dispatched below a stated confidence level, automatically.Why: this is the clause that actually protects whoever has no lever of their own.
Cover AI-caused property or safety harm in liability, separately from data breaches.Why: a standard software liability clause was never written with a missed refrigerant leak in mind.
Ask which underlying model the vendor's own tool is built on, and what happens if that provider changes terms.Why: your vendor's risk becomes your risk the moment their own dependency shifts.
Limit retraining on your operational data without separate consent.Why: your buildings' sensor patterns are a real asset, and giving them away by default helps your vendor's other customers, not you.
How to answer this, stage by stage
Nobody is scoring whether you can name a long list of legal terms. They're scoring whether you can say who has no voice in the room where this contract gets signed.
Stage 1
Scope it to one real contract
Say it like this
"I'll answer this for a facilities-services company negotiating a contract with an AI vendor that predicts HVAC failures across a portfolio of client buildings."
Why this works
Keeps a broad legal question from turning into a generic list of software-contract boilerplate.
Stage 2
Say the structure out loud
Say it like this
"I'll use GUARD. Groups, who's affected. Unequal, where the harm lands hardest. Ability to contest, who has no voice at all. Reduce, the actual clause. Detect, how you'd know before someone outside tells you."
Why this works
Shows a repeatable way to reason about risk, not just a memorized checklist of legal terms.
Stage 3
Name who never gets a vote
Say it like this
"The people signing this contract are Colderidge and Thermion. The people who actually live with a missed diagnosis are the daycare's children and staff, and they never get to read a single clause in it."
Why this works
This is where a strong answer separates from a generic list of contract terms.
Stage 4
Give the one decision
Say it like this
"Get a right to Thermion's incident logs and confidence history on request, and require a person to be dispatched automatically any time confidence drops below a stated line."
Why this works
This is the direct answer, concrete enough for a panel to ask exactly how the confidence threshold would be set.
Stage 5
Prove it with someone else's failure
Say it like this
"A peer at a sister facilities company told Farrukh about a data-center cooling unit that failed under a false all-clear. When they went looking for what the AI had actually said, there was no log clause in the contract to check. They ate the liability with no way to even prove what happened."
Why this works
Turns "contracts need different terms" from an abstract legal point into a specific, costly afternoon for a real company.
Stage 6
Close on the one line
Say it like this
"Ordinary software contracts protect uptime and data. An AI vendor's contract has to protect the person who never gets to read it, and that starts with a right to see what the model actually said."
Why this works
Restates the direct answer in one breath, ready for a live follow-up.
Let's learn
Here is what happens when a facilities contract is written for software that never makes a live judgment call, then handed to a vendor whose whole product is exactly that.
Before Thermion, Colderidge's technicians did quarterly rooftop-unit inspections by hand, about twenty-five minutes a stop, catching most developing failures before they became emergencies but missing the slow ones between visits. Thermion reads live sensor data continuously and flags a failure risk the moment a pattern starts drifting, in theory catching problems weeks before a quarterly visit ever would.
This is the gap in the old contract. Nothing in it required a record of what the AI actually said.
Here's the turn: catching problems faster was never the risk. The risk was that Colderidge's standard mechanical-services contract, the same template used for scheduling software and invoicing tools for years, never had a clause requiring incident logs to be kept or shared. Nobody had ever needed to reconstruct "what did the system say and when," because static software never made a judgment call worth reconstructing.
False all-clear incidents that caused real damage, by whether the site had backup systems
Thermion's underlying miss rate was roughly the same at every site. Which sites actually got hurt depended entirely on who had no backup to catch it, exactly the sites with the least leverage in any contract.
At its worst, this doesn't just risk an uncomfortable afternoon. It risks a small daycare's rooftop unit failing quietly through a heat wave, with children in the building and nobody able to prove, after the fact, what the AI had actually reported along the way.
The choice I would take back
Colderidge's standard contract template kept no clause requiring incident-log retention or disclosure, because in decades of buying dispatch software and invoicing tools, there was never a reason to reconstruct a system's past judgment calls. That made sense for software that never changed its mind. It stopped making sense the moment the tool started making a live diagnostic call on physical equipment that people's safety depended on.
What I would leave alone: Thermion's basic sensor-reading dashboard, the live temperature and pressure graphs technicians already check by hand, doesn't need a new contract clause. That's a display of raw numbers, not a judgment call anyone needs to contest.
The lesson: a contract written for software that never decides anything will always leave out the one clause that matters most for software that does. The fix isn't a longer contract. It's asking, for every clause, who has no way to check whether it was needed.
Now here is the same thing as a story
The short version above is what you'd say defending the Thermion contract to Colderidge's leadership. Read this one for how a peer's bad afternoon became Farrukh's own rewrite.
Farrukh Ismailov had negotiated Colderidge's vendor contracts for twelve years, sharp enough to catch a hidden auto-renewal clause on the first read. When Thermion came up for renewal, the standard template sailed through legal review the same way every software contract before it had, uptime guarantee, data security, standard indemnification, nothing unusual.
The contract only ever spoke to the left side of this picture. The right side never got a vote.
Knowledge spark: why would an AI model give a false all-clear?
A predictive model learns from past failure patterns. A new kind of failure, one it hasn't seen enough of, can look like normal operation right up until it isn't, especially if the sensor data drifts slowly instead of spiking. The model isn't lying. It just hasn't been shown that particular slow failure before.
Two months after renewal, Farrukh got a call from a procurement director at a sister facilities company, a friend from an industry group, who had just spent a brutal week arguing with a different AI HVAC vendor. A data-center cooling unit had failed under a false all-clear, real equipment damage resulted, and when the friend went looking for what the AI had actually reported in the days before, the contract had no clause requiring the vendor to have kept, let alone share, any of it. They ate the cost themselves, unable to even prove what the system had said.
Farrukh hung up and pulled Colderidge's own Thermion contract that same afternoon. It had the identical gap.
Nobody at Colderidge had done anything wrong. The contract had simply never been asked to answer a question that only makes sense once a system starts making judgment calls instead of just running them.
Three weeks later, a technician on an unrelated call at the daycare noticed ice buildup on a rooftop unit Thermion had marked clean for over a month, a slow refrigerant leak the model had never been shown a pattern for. It was caught in time, days before a forecast heat wave. But Farrukh, reviewing the incident, still couldn't tell whether Thermion's confidence had ever dipped and been ignored, because the contract gave Colderidge no right to ask.
This is what the amendment added, the same week as the near miss.
The near miss wasn't Colderidge's own failure. It was a friend's story, arriving just in time.
GUARD, in one screenNot a longer contract. GUARD is what tells you which clause protects the person who has no lever at all.
G
Groups. Who's affected.
Colderidge and Thermion sign the contract. A daycare's children and staff live with whatever the model decides about their building's air.
Naming both, not just the two parties at the table, is the whole point of this framework.
U
Unequal. Where the harm actually lands.
The same false all-clear rate hits every site, but only the sites with no backup system turn a false all-clear into real damage.
This is why a single overall accuracy number hides exactly the risk that matters most.
A
Ability to contest. Who never gets a lever.
The daycare has no way to see Thermion's confidence score, no way to ask for a second opinion, and no seat at the contract negotiation that decided all of this.
This is the hardest step, and it's the one most answers skip entirely.
R
Reduce. The actual clause.
A right to Thermion's incident logs and confidence history on request, plus a mandatory human dispatch below a stated confidence line.
A real design decision in the contract itself, not a review board or a training session.
D
Detect. How you'd know before someone outside tells you.
A required monthly drift report from Thermion, instead of waiting for a technician to notice ice buildup by accident.
Farrukh's near miss was luck. Detect is what replaces luck with a schedule.
None of these appear in a standard software contract, because none of them made sense before a model could quietly change its own mind.
The recap, one line per letter: groups is naming Colderidge alongside the daycare that never signed anything, unequal is the same failure rate landing far harder on sites with no backup, ability to contest is the daycare having no lever at all, reduce is the incident-log and fallback clauses actually added, and detect is a monthly drift report replacing luck with a schedule.
The clauses that matter most are exactly the ones most contracts leave out.
And if you want to be sure it really works, try it somewhere elseSame five letters, a public library network's AI cataloguing vendor instead of an HVAC contractor. A data-sharing default breaks the second story, not a missing log clause.
Ashwolde Public Library Network contracted Catalogex, an AI tool that reads circulation data to generate catalog metadata and reading recommendations across its branches. Mapped onto GUARD: groups is the library and Catalogex signing the contract, while every patron whose checkout history feeds the model never sees a line of it, unequal is the harm landing hardest on small rural branches, where an "aggregate" group of a dozen patrons is functionally identifiable, ability to contest is patrons having no way to know what inferences the model draws about their reading, or to opt out of it, and reduce is a clause requiring true anonymization thresholds before any aggregate report leaves the branch, not just a label claiming the data was aggregated.
The old decision here isn't a missing log clause, it's a default one: the library's original data-sharing agreement with Catalogex was copied from an earlier agreement with an unrelated software vendor, and it defaulted to allowing "aggregate insights" reports with no minimum group size specified. That made sense at the network's largest urban branch, where an aggregate of thousands truly hides any one patron. It stopped making sense at a rural branch with forty active patrons, where an "aggregate of twelve" is close enough to a name.
Ashwolde's contract used one word, aggregate, to mean two very different levels of protection.
Contracts with an incident-log or audit clause, across Colderidge's client base, by quarter
Adoption barely moved for two quarters. A peer's bad afternoon, not a rule change, is what finally moved it.
Swap the trigger and it still runs.
Speed: an interviewer caps you at a minute. Say "incident-log rights and a confidence-based fallback, before anything else," and stop.
Cost: legal review has no time to redline a long new clause list. Say so honestly, and secure the two highest-leverage clauses, incident logs and the fallback trigger, even if the rest waits for the next renewal.
The vendor gets better, for real: if Thermion's next model version genuinely improves detection, that's still worth a version-notice clause, because a better model is still a different model, and the fallback design should keep working either way.
Where people run it wrong.
They reuse a standard software contract template and assume the usual clauses cover a system that makes live judgment calls.
They track a single overall accuracy number and miss that the real harm concentrates on whichever site has no backup.
They wait for an external failure to reveal the gap instead of asking, for every clause, who has no way to check it.
How to use it live. If an interviewer asks for the whole list, lead with the two that protect people with no voice at all: incident-log rights and a confidence-based human fallback. Everything else is a refinement on those two.
Flashcards (tap any card to flip it)
1 · THE FRAMEWORK
What framework fits a risk, safety, or contractual-protection question?
Tap to flip
ANSWER
GUARD: groups, unequal, ability to contest, reduce, detect. It names who has no lever, not just what could go wrong.
2 · THE PERSON
Who is this answer about?
Tap to flip
ANSWER
Farrukh Ismailov, Colderidge Mechanical Services' facilities procurement director for twelve years, who rewrote the Thermion contract after a friend's bad week.
3 · ABILITY TO CONTEST
Who has no lever at all in this story?
Tap to flip
ANSWER
The daycare's children and staff, whose building's rooftop unit Thermion monitors, with no visibility into its confidence and no seat at the negotiation.
4 · THE CLAUSE
What's the single most load-bearing clause this answer names?
Tap to flip
ANSWER
A right to the vendor's incident logs and confidence history on request, paired with a mandatory human fallback below a stated confidence line.
5 · THE OLD DECISION
What decision would you take back?
Tap to flip
ANSWER
Using a standard software contract template with no clause requiring Thermion to retain or share incident logs and confidence history.
6 · THE NUMBER
Fill in the blank: at sites without backup systems, ___ percent of false all-clears caused real damage, against 2.5 percent at sites with backup.
Tap to flip
ANSWER
22.5 percent, nearly nine times higher, from the same underlying model behavior.
7 · THE REPLAY
Same slow refrigerant leak, same daycare unit, but the fallback clause already exists. What changes?
Tap to flip
ANSWER
Thermion's dipping confidence triggers an automatic technician dispatch weeks earlier, and Farrukh can pull the exact confidence history to confirm it, instead of relying on an unrelated technician noticing ice by chance.
8 · CROSS PRODUCT TRANSFER
Section 4 answers this same question again for a different product. Which product, and what old decision gets taken back?
Tap to flip
ANSWER
Ashwolde Public Library Network's Catalogex contract. The reversal is a copied default: an "aggregate insights" clause with no minimum group size, safe at a large branch and identifying at a small one.
Check yourself Score: 0 / 0
Short answer, name the clause
1. What is the single clause this answer says matters most, and what does it actually let you do?
Show hint
Look at the direct answer and the R step.
Show answer
Model answer: A right to the vendor's incident logs and confidence history on request. It lets you reconstruct what the AI actually said when something goes wrong.
Multiple choice
2. According to the unequal step, why did the same false all-clear rate cause such different amounts of real damage across sites?
A. Thermion's model performed worse at certain sites.
B. Sites without backup systems had nothing to catch a false all-clear before it caused real harm.
C. Some sites paid for a better version of Thermion.
D. Technicians visited some sites less often.
Show hint
Look at the bar chart and the U step.
Show answer
B. The model's behavior was the same everywhere. Only sites with no backup turned a false all-clear into real damage.
True or false
3. True or false: the daycare's near miss happened because Colderidge's technicians failed to do their job.
True
False
Show hint
Look at "the lesson" and who eventually caught the leak.
Show answer
False. A technician on an unrelated call caught it by chance. The contract simply gave nobody a required way to check the AI's confidence before that.
Fill in the blank
4. Fill in the blank: contracts with an incident-log clause across Colderidge's client base rose from 10 percent to ___ percent after the near miss.
Show hint
Look at the line chart in Section 4.
Show answer
95 percent. A peer's bad afternoon moved the whole client base faster than two quarters of normal renewal cycles had.
Short answer, apply it yourself
5. Think of a software tool your own workplace has a contract with. If it started making live judgment calls instead of just running fixed rules, what clause would you add first?
Show hint
Ask what you'd need to reconstruct if the tool's judgment turned out to be wrong months later.
Show answer
Model answer: Most people land on a version of an incident-log or audit-rights clause, since almost no ordinary software contract has one, and almost every AI one needs it.
Short answer, where it wouldn't matter
6. Name a part of the Thermion relationship where these extra AI-specific clauses genuinely don't apply.
Show hint
Look at "what I would leave alone."
Show answer
Model answer: The basic live sensor dashboard, showing raw temperature and pressure numbers technicians already read by hand. It's a display, not a judgment call.
Before you close the answer
Why this works
Tests whether you understand that a contract is where risk actually gets assigned, and whether you'll name the person who has no vote in that assignment.
Follow-up traps
"Won't a vendor just refuse to give up incident logs?" Response: a vendor unwilling to share what its own model said is telling you exactly how much you'd actually control after signing; that refusal is itself a decision point.
"Isn't this just normal software liability with extra steps?" Response: no, ordinary liability covers who pays after a failure; this is about being able to prove what happened at all, which ordinary software with fixed rules never required.
If pressed
Colderidge's amended contract defined the fallback trigger using Thermion's own published confidence metric, requiring dispatch below a stated percentage, rather than leaving "low confidence" as an undefined term either side could argue about later.
From U2xAI Academy
From answering questions to owning outcomes.
A live workshop where you ship a working AI agent, defend a launch decision, and walk away with a portfolio recruiters can't wave off, not just more questions to study.
