Five AI contracts, read for the morning after. None puts the model's notice period in the contract.

Disclosure: I run Katonic, which sells a sovereign AI platform to regulated buyers, including in the Gulf. Own Your AI, every second Thursday: one thing to copy into a contract, a runbook or a board paper.

Last issue I promised to read five AI contracts side by side, no names, for the morning after: the day the provider leaves, suspends you, retires the model, or you decide to go. I read eight, picked five, and put a government contract next to them as the control.

Six of the documents in this issue changed in the last 60 days. A side-by-side written in August would already rest on six superseded documents. Read yours again this quarter, not next year.

The frame widened while I was reading. On Monday the US federal clause for language-model purchases took effect. On 7 October Singapore's central bank told its banks to consider limiting, suspending or replacing any third-party AI service they cannot keep within risk appetite. On 12 January 2027 the EU Data Act brings cloud switching charges to zero.

Three things to copy this week: the table, the clause, and a thirty-minute read of your own contract. Then one paragraph for the register you keep anyway.

The table: five contracts, seven rows, the morning after

What happened. I opened the current customer terms of two US model labs, two hyperscaler AI services and one European lab, with their data addenda and model-lifecycle pages, and read each on the same seven rows. Contract A to E below, in no particular order.

The government column is the US federal clause, the UK G-Cloud 14 call-off and the EU Data Act.

One caveat before the grid. One of the two hyperscalers publishes its master agreement only behind a sign-in and varies it by country, so Contract C's master terms are read from the sample it publishes, dated 2023. Its data addendum and product terms, where the exit rows actually live, are current.

Contracts anonymised as in the published edition; the references name the documents by title and date. Rows read from the current terms, data addenda and model-lifecycle pages on 19 and 21 October 2026.

Row 3 is the headline. Not one of the five puts the notice period for withdrawing a model in the contract. Four promise one in documentation: six months, sixty days, sixty days inside an eighteen-month lifecycle, and a six-month or forty-five-day window set per model. One promises nothing. Documentation changes on posting.

Row 4 is the one to read twice. Four of the five tell you when your data will be deleted. Three tell you how to get it back first. One European lab says in the contract itself that you "may not be able to export" your data or outputs once the account is terminated.

Row 2 is the cost nobody prices. One of the five addresses fees during a suspension, and that one bills you through it. The other four do not say.

Row 1 is the quiet one. Two of the five give themselves no right to leave for convenience. That sounds protective until you read their suspension clauses, which carry no fixed notice either.

Why it matters to you. The government column wins five rows of seven. The buyer can suspend at any time. The supplier may not suspend. A model swap needs thirty days' notice and access to the successor. Data comes back in open formats with migration tooling. Prepaid money comes back. Exit is certified in writing.

None of that was invented for governments. Each line is one a commercial vendor has already signed somewhere, which is the point of the next section.

Copy this. The seven rows, as the page your vendor file is missing: leave with notice, they leave with notice, suspension and who pays, model withdrawal notice, data back and when, terms changed on you, who else holds a switch. The thirty-minute read below fills it from your own documents, not the sales deck.

The clause: five lines, each with a precedent

What happened. The first pushback on any exit clause is "no vendor will sign this". So every line below is written from the best row in the table, and every number in it already exists somewhere: in a signed commercial contract, in the federal clause, or, for the six months, on a vendor's own page.

One contract already carries the sixty days. One already refunds pro rata when it is the one leaving. One already gives a cure period. The government clause already names the successor model and the certified erasure. The argument moves from "nobody offers this" to "you already offer this, put it in writing".

Copy this. Into the next AI request for proposal, or the next renewal, as mandatory written responses. Score the redline each vendor returns, not the yes.

1. Either party may end this agreement for convenience on [60] days' written notice. If you, the provider, end it, prepaid unused fees come back pro rata and no minimum commitment survives.
2. You may suspend only with written notice and a cure period of not less than [2] business days, except for an exigent security risk. Fees for the suspended service stop for any suspension we did not cause.
3. You give at least [6] months' written notice in this agreement, not on a web page, before withdrawing any model we use, with concurrent access to the successor for [30] days. Where a third party you depend on forces it, you tell us within [5] business days and make best efforts on the successor.
4. On expiry or termination we keep [30] days' access, then [90] days to extract everything in open, machine-readable formats with migration tooling at no extra cost. Then you delete our data, prompts, fine-tuned weights, embeddings, indexes and caches, and certify it in writing.
5. No change to these terms applies during the current term. Material changes need [60] days' notice and signed order forms are protected.

A sixth line, carried over from last issue: who other than you can suspend us, and with what notice. The federal clause adds a line of its own: thirty days' notice of any change made to comply with a non-US law.

What you will hear back. "Our standard terms are standard." They were, until a federal buyer wrote different ones. "Deprecation is covered in the docs." The docs are what you are trying to get out of.

"We have never shortened a notice period." Two of the five reserve the right to, for safety or compliance, in the same sentence as the promise.

The read: thirty minutes with your own contract

What happened. The five contracts hide the same seven answers in the same seven places, and three of the places are not in the contract at all.

Copy this. Book thirty minutes with the signed agreement, the order form and a browser. Seven questions, and where each answer lives.

1. Your right to leave, and theirs. The master terms, termination section. Then the order form, for the commitments that survive it.
2. Suspension, and who pays during it. The master terms, then the acceptable-use policy, which changes on posting.
3. Model withdrawal. Not in the contract. The documentation page. If you buy through a reseller or a marketplace, the reseller's page, whose dates, in one reseller's own words, "may differ from dates published by model providers".
4. Your data back. The data processing addendum, not the master terms. Read whether it says "return" or only "delete".
5. Fine-tunes and reserved capacity. The service-specific terms. One of the five calls provisioned throughput "nontransferable and noncancellable". One lab I read but did not table destroys your custom models on termination.
6. Change of terms. The last section of the master terms. Then whether your signed order form is protected from it.
7. Who else holds a switch. Governing law, the trade-controls clause and the supported-countries list, which one contract says "may be updated from time to time".

The honest result most readers will get: the notice period you hold is on a web page the provider can edit, and your data addendum promises a deletion date more precisely than a return. Write both down. That is the page your renewal negotiation starts from.

The paragraph: for the register you already keep

Copy this. Not for the DORA register of information: that already asks for both parties' notice periods in days, and has no line for a model's. For the third-party risk file next to it, or the board risk paper. Fill the brackets, name the owner.

Our contract with [provider] for [system] lets us leave on [X] days and lets them leave on [Y] days. The notice we hold before a model is withdrawn is [N days / none], and it is held [in the contract / on a web page]. On exit we have [N] days to retrieve our data and [the fine-tuned weights / no weights]. Fees during a suspension we did not cause [stop / continue / are not addressed]. Other than the provider, [a government / a reseller / nobody named] can suspend the service. Last exit rehearsal: [date / never]. Owner: [name]. Next read: [date].

From the room

What I have seen in the last fortnight, names and numbers removed.

A retirement-fund administrator in East Asia, buying a three-year platform subscription through a hardware partner, asked for year four and year five pricing before signing year one, and the five-year cost of one extra non-production environment.

Our renewal line read "then-current rates, agreed at least 90 days before expiry". They read that line as the exit clause it is, and asked for the number.

They were right. A renewal price you do not hold is a notice period of ninety days in a contract you thought ran for three years.

Fair's fair, our own agreement on the same seven rows. We do not have a standard subscription agreement yet. Each deal is written on the customer's paper or ours, which is itself a row worth writing down.

What is fixed is the mechanism: the software runs in the customer's cluster, the data never leaves it, and the licence is a file with a date in it. At that date the platform locks, with no grace period, and stays locked until a new key arrives. It does not keep serving.

Read against my own clause, that is an expiry, not a suspension, but line 2 still applies to us: if you want a cure period before the lock, write it in and we will take it. Row 6 applies to us too. We are incorporated in Australia, and Australian law and sanctions bind us like anyone's.

The difference is mechanical, not legal. Anyone who could compel us reaches a licence file, not your data or your cluster. If you are buying from us, put the ninety days, the key date and the cure period in the order form. We will sign it.

Outside the perimeter

From the fortnight, each with one thing to do.

Monday, the US clause went live. GSA's clause 552.239-7001 for language-model purchases took effect on 19 October, as a second law-firm note of 13 October sets out, with formal rulemaking to follow.

Beyond the suspension right last issue quoted, the final text caps the contractor's decommissioning liability after a for-cause termination at 25 percent of the affected order. Government data stays government-owned; the vendor keeps its base models.

Do this: the 25 percent cap is the number a vendor can live with. Offer it in line 4 of your clause before they ask.

India wrote the exit clause into a tender. C-DAC's request for empanelment of AI service providers for GPU compute, issued 7 October and closing 29 October, requires migration of data, configurations, logs and records to C-DAC or its nominee on completion, expiry or termination, and "complete deletion and certification of removal" of its data.

C-DAC may also terminate within 30 days of a change of control at the supplier.

Do this: change of control is the exit trigger your clause is missing. Add it.

Singapore writes "suspending or replacing" into bank guidance. The Monetary Authority of Singapore finalised its AI risk guidelines on 7 October. Institutions stay accountable for AI "developed, operated or provided by third parties".

Where the risk cannot be brought within appetite they "should consider limiting, suspending or replacing the use of the third-party AI service". The first sections apply from October 2027.

Do this: name one production AI you could actually limit, suspend or replace inside a quarter. If the answer is none, that is the gap now named by a regulator.

Tomorrow, seventeen lines switch off. One lab's deprecation page lists seventeen models and fine-tunes shutting down on 23 October, and on 14 October gave three months on four more. A fine-tune you paid for dies with its base model.

On one marketplace this month, another lab's models reached end of life on different dates by region, with about thirty days between the legacy mark and the end date in those regions.

Do this: inventory every pinned model identifier in production, fine-tunes included, and the page each one's date is on.

One to watch. On Saturday 24 October AWS runs its European Sovereign Cloud disconnected from its global network for several hours, with EU-resident staff. Credit, again, for doing it in public. The open question practitioners are asking is whether identity, DNS and certificates survive the cut. That is next issue.

Your hour results

Nobody posted a result under last issue, and I will not pretend otherwise. So here is the only entry, mine, from the September incident I described: the list of what stopped was empty, because an empty answer from a provider was treated as a fact. That is now a line in our drill.

The ask moves. This issue it is one line in the comments: the notice period in your AI contract, and where you found it. Contract, order form, or web page. No names needed. I will tally them, anonymised, next issue.

Before Friday

1. Put the seven rows on one page for your largest AI contract, from the documents, by Friday.
2. Put the five clause lines into the next AI RFP or renewal as mandatory written responses.
3. Paste the paragraph into the register, with the owner's name and a date for the next read.

I can be argued out of this. If you think a notice period in the contract is worthless because the vendor who matters will shorten it for "compliance" anyway, say so, and tell me what you got instead. And if one of the five rows above is wrong for a contract you hold, I want to see the clause.

Next issue, Thursday 5 November: what Saturday's disconnection exercise reported, read through the same seven rows, plus your notice periods.

About this newsletter

Own Your AI comes out every second Thursday. Subscribe if it is useful, and tell me where you disagree.

The free toolkit, with a 90-day roadmap: ownaistack.com

Own Your AI is also the book I wrote with Vinod Bijlani: amazon.com/dp/B0GS7C6DN4

Prem

References

1. The five contracts, by document title and effective date, no company names. Contract A: a model lab's Services Agreement, effective 1 January 2026, with its Service Terms updated 16 October 2026 and its model deprecations page. Contract B: a model lab's Commercial Terms of Service, effective 17 June 2025, with its Data Processing Addendum of 24 February 2025 and model deprecations page. Contract C: a hyperscaler's Customer Agreement, read from a published March 2023 sample because the live agreement needs a sign-in and varies by country, with its Product Terms for Online Services, its Products and Services Data Protection Addendum of 22 May 2026 and its model retirement policy page. Contract D: a hyperscaler's Customer Agreement, last updated 14 August 2026, with its Service Terms of 13 October 2026 and its model lifecycle pages. Contract E: a European lab's Commercial Terms of Service, effective 25 September 2026, with its Additional Product Terms and Data Processing Addendum of 27 July 2026. Three more were read and not tabled: a Canadian lab's SaaS Agreement of 8 April 2025, a US lab's Enterprise Terms of 14 August 2026 and a second hyperscaler's cloud terms last modified 12 October 2026. All opened 19 October 2026 and re-opened 21 October 2026.
2. US General Services Administration, clause 552.239-7001, "Basic Safeguarding of Data within Large Language Model Artificial Intelligence Systems", GSAR class deviation package RGO-2026-01, effective 19 October 2026: suspension at any time, 30 days' notice before a model is replaced, successor access for 30 or 15 days, 5 business days where an upstream provider forces it, export in open formats with migration tooling, certified erasure including fine-tuned weights, 25 percent decommissioning cap.
3. Wiley, "GSA Releases Final Language of AI Contract Clause", 13 October 2026: class deviation, effective 19 October, formal rulemaking to follow.
4. UK Crown Commercial Service, G-Cloud 14 Call-Off Contract v5.0 (RM1557.14): buyer ends on 30 days, supplier must not suspend, data returned in agreed formats, prepaid sums refunded within 10 working days, exit plan and migration help.
5. EU Data Act, Regulation (EU) 2023/2854, Chapter VI, applying since 12 September 2025: article 25, notice to switch capped at two months, 30-day transition, 30-day retrieval; article 29, no switching charges from 12 January 2027. Whether a hosted model service is a "data processing service" under it is the open question.
6. C-DAC, Request for Empanelment C-DAC/GPU/01/2026, AI service providers for GPU compute, 7 October 2026, closes 29 October: section 4.8 transition, exit and knowledge transfer; certified deletion; termination within 30 days of a change of control.
7. Monetary Authority of Singapore, "MAS sets out supervisory expectations on responsible AI adoption by financial institutions", 7 October 2026: third-party AI accountability, "limiting, suspending or replacing".
8. OpenAI, API deprecations page, read 21 October 2026: the 23 October 2026 shutdowns, the 14 October 2026 notice with 14 January 2027 shutdowns, the deprecation policy (six months for generally available models, shorter for safety or compliance), fine-tunes follow the base model.
9. Amazon Bedrock, model lifecycle (legacy policy) page, read 21 October 2026: end-of-life dates by model and region, "may differ from dates published by model providers", extended access at higher pricing.
10. AWS Security Blog, "AWS European Sovereign Cloud: demonstrating an independent operation", 28 September 2026: the 24 October disconnection exercise.