SaaS negotiations: the five terms that actually move risk

Most of the time spent negotiating a SaaS agreement goes to the general liability cap. The money moves elsewhere: at renewal, at exit, in what the vendor may change unilaterally, in what happens to your data, and in whether a failing service can actually be terminated. The European Union has now legislated the exit; a customer that does not use those rights is leaving statutory leverage on the table. Here are the five terms ranked by expected loss, with a fair landing zone for each — because a vendor that cannot sign is not a negotiation, it is a delay.

Why the usual suspects underdeliver

The evidence that negotiators concentrate on the wrong terms is old and consistent. World Commerce & Contracting's 2024 survey of 937 organisations found that only 16% of negotiators believed they were prioritising the right terms.¹ In the publicly available US public-sector edition, based on more than 600 contracting professionals, the terms government buyers negotiated most were amendments and changes (60%), price and price changes (58%), delivery (56%), scope (55%), term (54%), communications and reporting (53%) and cybersecurity and data privacy (52%) — and the gap between the two sides of the table showed in indemnification, ranked fourth by suppliers and fourteenth by buyers.²

The spending data explain why the traditional priorities are misaligned with the risk. Zylo's 2026 SaaS Management Index, drawn from more than 40 million licences and $75 billion of spend, puts median SaaS spend at $9,455 per employee, finds that organisations leave an average of 36% of their licences unused, and reports that 78% of IT leaders saw "unexpected charges tied to consumption-based or AI pricing models" and that 61% "were forced to cut projects due to unplanned SaaS cost increases". Business units control 81% of that spend; IT manages 15%.³ Tropic's 2025 buying data show renewal asks of 20–37% for AI-driven products against a typical 3–9% annual uplift, negotiation reducing those asks by roughly 55% on average, and 74.5% of contracts now running 13–24 months.⁴ Gartner forecast worldwide SaaS spending at $299 billion in 2025, up 19.2%.⁵

A liability cap of twelve months' fees is rarely triggered in a subscription relationship, because the losses that actually occur are operational — an outage, a migration, a price shock, a policy change — rather than damages claims. The five terms below are the ones where expected loss, not drafting tradition, is concentrated. Each section states the vendor's legitimate interest and a landing zone both sides can sign.

Term 1: renewal price mechanics — including the metric

The uplift cap is the term everyone negotiates and most people get half right. A cap on the annual percentage increase — a fixed percentage, or an inflation index plus a margin — protects the rate. It does nothing about the metric or the packaging, which is where the large increases have come from. Oracle's move to an employee-based metric for Java SE, at a published "$15/employee per month" tiering down to $5.25, counts every employee — and the staff of contractors and outsourcers supporting the business — whether or not they use Java.⁶ Broadcom's changes to VMware licensing after its 2023 acquisition have prompted a March 2026 competition complaint from the European cloud-provider association CISPE alleging cost increases of "more than 1,000 percent" and the termination of the programme through which European providers accessed the software — allegations, not findings, but a description of what a change of packaging can do to a budget that a rate cap cannot prevent.⁷

Consumption and AI pricing add a second exposure: Zylo's 78% "unexpected charges" figure is the result.³ A customer that has signed a two-year term without a metric freeze has, over the 13–24-month term Tropic finds most common, agreed to a renegotiation it cannot see.

Vendor's interest: cost inflation, and a return on new AI functionality. Landing zone: a capped uplift; the pricing metric, unit definitions and product packaging frozen for the term and one renewal; AI features opt-in and separately priced; consumption caps with alerts and a right to disable overage; no re-tiering on the vendor's reorganisation of its product line.

Term 2: exit, transition and portability

The exit term is the real liability term, because the migration cost when a relationship fails is almost always larger than twelve months' fees. Since 12 September 2025 it is also, for any provider of "data processing services" to EU customers, a matter of statute. Chapter VI of the EU Data Act requires that the contract allow the customer to switch on a maximum notice period "which shall not exceed two months", with a "mandatory maximum transitional period of 30 calendar days" — extendable to a period that "shall not exceed seven months" where the provider demonstrates that 30 days is technically unfeasible, and extendable once more at the customer's option — plus "a minimum period for data retrieval of at least 30 calendar days" and an obligation on the provider to "provide reasonable assistance to the customer and third parties authorised by the customer in the switching process".⁸ From 12 January 2027 providers may not impose any switching charges; until then charges are limited to costs "directly linked to the switching process", and standard fees and early-termination penalties must be disclosed before contract.⁹

Practitioners have already identified where the negotiation moves. Bird & Bird's Danish team observes that "fixed-term commitments risk being reduced to de facto month-to-month arrangements", that the two-month notice "is not a general termination right" but functions like one once switching completes, and that early-termination penalties "should be limited to the provider's actual net losses" — with refunds for unused prepaid periods likely to follow under national law.¹⁰ Garrigues notes that providers must "progressively adapt their contracts and internal procedures", and recommends exit plans with data inventories and, for high-risk AI, that customers "identify logs subject to storage and safekeeping needs before exporting or deleting".¹¹ The Digital Omnibus compromise reported in July 2026 would exempt certain "adapted standard services" and SME and small mid-cap providers from parts of the switching regime for contracts concluded before 12 September 2025, and would expressly permit "proportionate early termination penalties in fixed-term contracts" — while leaving the January 2027 charge ban untouched. The Council carried these provisions into its negotiating mandate of 21 October 2026; the text is not final, but it tells you what to draft now: define "proportionate" (net loss, not remaining contract value; refund of prepaid unused periods) before the courts do.¹²

For regulated customers the exit is already a compliance item. DORA requires exit strategies for ICT services supporting critical or important functions, with contractual "exit strategies, in particular the establishment of a mandatory adequate transition period", and the right to terminate for significant breach, evidenced weaknesses in the provider's risk management, or where "the competent authority can no longer effectively supervise".¹³ The UK PRA's outsourcing supervisory statement expects "business continuity and exit plans" including a "stressed exit".¹⁴

Vendor's interest: recovery of onboarding investment and predictability of revenue. Landing zone: an exportable data schema and format specified in a schedule; assistance at pre-agreed rates; the statutory transition periods as a floor; a deletion certificate; early-termination fees tied to demonstrable net loss with prepaid periods refunded.

Term 3: unilateral change rights

The third term is the one customers rarely see because it is not in the signed document. SaaS agreements incorporate acceptable-use policies, service descriptions, security terms and privacy notices by hyperlink, and reserve the vendor's right to modify or discontinue the service, change sub-processors, and suspend access. Hunton's August 2026 guidance describes the exposure plainly: "the vendor may later argue that an online update changed the parties' negotiated agreement even though the customer never approved of that change". The mitigations are mechanical — attach the hyperlinked terms as exhibits "and prevent the vendor from unilaterally modifying the attached version", put hyperlinked terms "last in the agreement's order of precedence", and "require prior written notice of any change and give the customer the right to reject the change or terminate the affected services".¹⁵

The 2023–24 controversies over AI training arrived exactly this way. Zoom's terms of service, changed in March 2023 and noticed in August 2023, appeared to permit training on customer content with no opt-out until public reaction forced a rewrite;¹⁶ Slack's privacy principles in May 2024 allowed customer data to train "global models" unless a customer emailed to opt out;¹⁷ Adobe's June 2024 terms granted a licence to "use, reproduce, publicly display, distribute, modify, create derivative works based on" user content, later revised after a backlash.¹⁸ None of those changes was an amendment the customer signed.

The statutory anchors help. Under the GDPR a processor may not engage a sub-processor without the controller's authorisation, and under a general authorisation must give the controller "the opportunity to object to such changes".¹⁹ DORA requires notice periods and notification of "any development that might have a material impact" on the provider's ability to perform.¹³

Vendor's interest: one codebase and one policy across thousands of customers. Landing zone: advance written notice of material changes; no material degradation of functionality or security during the term; a right to object to sub-processor changes and to terminate with a pro-rata refund if the objection cannot be resolved; suspension only for security threats or non-payment, with notice and a cure period.

Term 4: data use, AI training and return

The fourth term has been rewritten by AI. Polsinelli's 2025 review of SaaS negotiations records that "vendors are seeking broad rights to use customer data to improve and develop future software products, including products that include AI components", while customers "are wary of allowing the broad use of their data for purposes unrelated to their business".²⁰ The definition of customer data is where the argument is won: it should include derived and usage data, prompts and outputs, and any data the vendor's models see, and the vendor's rights should be limited to providing the service, with product improvement permitted only on aggregated, anonymised data that cannot be re-identified.

Return and deletion are statutory for personal data — the processor must delete or return "all the personal data to the controller after the end of the provision of services"¹⁹ — and DORA extends the concept to all data, requiring provisions on "access, recovery and return in an easily accessible format of personal and non-personal data" on the provider's insolvency or the contract's termination.¹³ The AI Act adds a new dependency: a deployer of a high-risk AI system must keep the logs it generates for at least six months, which a customer of an AI-enabled SaaS product cannot do without a contractual right to export them.²¹ Breach notification is the last piece: the processor's statutory duty to notify the controller "without undue delay" should be replaced by a clock the customer can meet under its own 72-hour obligation.

Vendor's interest: improving the product with what it learns from usage. Landing zone: customer data broadly defined; no training on customer data without opt-in; aggregated and anonymised improvement rights defined and limited; log access and export; return in a specified format and certified deletion within a fixed period; contractual breach-notification hours, not days.

Term 5: remedies that bite — super-caps, credits and chronic-failure termination

Only now do we reach liability, and the point is to spend the negotiating capital where the exposure is. Keep the general cap at a multiple of annual fees; it is fair, insurable and market. Spend the effort on three things. First, a super-cap for data, security and confidentiality breaches: in-house counsel interviewed by Legal Dive report that "super caps are more common today, especially around privacy, security or confidentiality", and that they have moved from a multiple of fees to fixed sums, with some customers demanding up to $1 million.²² Polsinelli confirms the market shape — vendors cap at "annualized fees under the agreement or the vendor's insurance coverage", customers push for liability "in excess of the annualized fees for privacy and data breaches".²⁰ Second, service credits that are not the sole remedy. Vendors routinely provide that the credit is "the customer's 'sole and exclusive remedy'"; credits are typically a small percentage of the monthly fee and sit comfortably inside the vendor's margin, and a customer that accepts the clause has, in the words of one practitioner, "voluntarily give[n] away" the most powerful tool it has — "the threat of contract termination".²³ Third, a termination right for chronic failure, with a defined number of missed service levels in a defined period, and incident assistance priced in advance — DORA's formulation, assistance "at no additional cost, or at a cost that is determined ex-ante", is a sensible benchmark for any customer.¹³ The indemnification gap between buyers and suppliers² is best closed by picking the two indemnities that matter — third-party intellectual property claims and data breaches caused by the vendor — and conceding the rest.

Vendor's interest: an insurable, predictable exposure. Landing zone: a general cap at twelve to twenty-four months' fees; a separate, fixed super-cap for data and security incidents; credits as a first remedy, not the only one; termination for chronic failure with a pro-rata refund; incident cooperation at pre-agreed rates.

What to trade away

A negotiation that concedes nothing does not close. The following are worth giving to get the five terms above: a mutual cap for ordinary breach; exclusion of indirect and consequential loss on both sides; the standard warranty disclaimers; the vendor's right to suspend for credible security threats and for non-payment after notice; the use of anonymised, aggregated data for product improvement; and, for contracts below the threshold at which negotiation stops being worth either side's time — one interviewee put it at contracts of $50,000 or less²² — acceptance of standard terms with a short rider covering price, exit and data.

A five-line term sheet, and the calendar

The five terms fit on a page: price mechanics with a frozen metric; exit on the Data Act's timetable with proportionate penalties defined; change rights with notice and a right to leave; data use limited to the service, with logs and deletion; remedies that include termination. The calendar that surrounds them: Data Act switching rules applying since 12 September 2025, switching charges prohibited from 12 January 2027;⁸⁹ DORA in application since 17 January 2025; the AI Act's high-risk obligations, after the 2026 Omnibus, from 2 December 2027 for stand-alone systems and 2 August 2028 for product-embedded ones;²¹ the UK Data (Use and Access) Act 2025, enacted on 19 June 2025 and being brought into force in stages;²⁴ and, for consumer-facing subscriptions in the United States, the FTC's click-to-cancel rule, vacated by the Eighth Circuit in July 2025 and the subject of a fresh FTC rulemaking opened in March 2026, while ROSCA and state auto-renewal laws continue to apply.²⁵

The governance point is the last one. If business units control 81% of SaaS spend, the five terms will only be applied if they are a mandatory checklist in procurement rather than a skill in the legal department. That is a board decision — and, as Part 3 of this series argues, the board of a company whose critical services run on someone else's software is already accountable for the answer.

Disclaimer

This article is general commentary for professional readers. It is not legal advice, does not address the circumstances of any particular contract, and does not create an advisor–client relationship with Cabo Advisory SL. Legislative provisions are summarised, not reproduced; application dates and pending amendments (including the Digital Omnibus) are stated as at the date of writing and change. Verify the current text on EUR-Lex and take advice before relying on any provision.

Notes and sources

Procurement and Supply Australasia, "WorldCC releases Most Negotiated Terms 2024 Report" (summarising World Commerce & Contracting, Most Negotiated Terms 2024, 21 October 2024; the full report is available to WorldCC members), 28 October 2024. https://procurementandsupply.com/worldcc-releases-most-negotiated-terms-2024-report/ ↩
Commerce and Contract Management Institute (co-founded by World Commerce & Contracting and NCMA), Most Negotiated Terms 2024: A focus on US government procurement and contracting, 2025 (survey of more than 600 contracting professionals). https://ncmahq.org/common/Uploaded%20files/CMI/MNT_2024_US_Public_Sector.pdf ↩ ↩²
Zylo, "Announcing Zylo's 2026 SaaS Management Index", 29 January 2026. https://zylo.com/news/2026-saas-management-index ↩ ↩²
Tropic, 2026 Software and AI Pricing Trends (SaaS and AI Buying Trends Report, based on 2025 data). https://www.tropicapp.io/reports/software-spending-trends-2025 ↩
Gartner, "Gartner Forecasts Worldwide Public Cloud End-User Spending to Total $723 Billion in 2025" (press release), 19 November 2024. https://www.gartner.com/en/newsroom/press-releases/2024-11-19-gartner-forecasts-worldwide-public-cloud-end-user-spending-to-total-723-billion-dollars-in-2025 ↩
Oracle, "Java SE Universal Subscription FAQ", https://www.oracle.com/java/technologies/java-se-subscription-faq.html ; Oracle, Java SE Universal Subscription Global Price List (definition of "Employee" and tiered pricing), https://www.oracle.com/a/ocom/docs/corporate/pricing/java-se-subscription-pricelist-5028356.pdf ↩
CISPE, "CISPE Files Competition Complaint Against Broadcom, Urges Immediate EU Action", 19 March 2026. https://www.cispe.cloud/cispe-files-competition-complaint-against-broadcom ↩
Regulation (EU) 2023/2854 (Data Act), art. 25 (contractual terms concerning switching) and art. 50 (application from 12 September 2025). https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng ; article text as reproduced at https://www.eu-data-act.com/Data_Act_Article_25.html and https://www.eu-data-act.com/Data_Act_Article_50.html ↩ ↩²
Regulation (EU) 2023/2854 (Data Act), art. 29 (gradual withdrawal of switching charges). https://www.eu-data-act.com/Data_Act_Article_29.html ↩ ↩²
Jesper Langemark and Anna Hjortlund, "The Data Act – what mandatory switching rights mean for fixed-term SaaS models", Bird & Bird, 2025. https://www.twobirds.com/da/insights/2025/the-data-act-what-mandatory-switching-rights-mean-for-fixed-term-saas-models ↩
Begoña González Otero, "The Data Act and cloud switching: keys to the new rules on changing cloud service providers", Garrigues, 17 October 2025. https://www.garrigues.com/en_GB/garrigues-digital/data-act-and-cloud-switching-keys-new-rules-changing-cloud-service-providers ↩
Greenberg Traurig, "EU Digital Omnibus Package Proposes Amendments to Data Act" (Council compromise text; not final), 15 July 2026. https://www.gtlaw.com/en/insights/2026/7/eu-digital-omnibus-package-proposes-amendments-to-data-act ↩
Regulation (EU) 2022/2554 (DORA), art. 28(7)–(8) and art. 30(2)–(3). https://www.springlex.eu/en/packages/dora/dora-regulation/article-30/ ; https://www.springlex.eu/en/packages/dora/dora-regulation/article-28/ ↩ ↩² ↩³ ↩⁴
Prudential Regulation Authority, Supervisory Statement SS2/21 "Outsourcing and third party risk management", March 2021 (effective 31 March 2022; as subsequently updated). https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/outsourcing-and-third-party-risk-management-ss ↩
Hunton, "Part II: Mitigating the Risks of Hyperlinked Terms in Your Agreement", 5 August 2026. https://www.hunton.com/insights/legal/part-ii-mitigating-the-risks-of-hyperlinked-terms-in-your-agreement ↩
Natasha Lomas, "Zoom knots itself a legal tangle over use of customer data for training AI models", TechCrunch, 8 August 2023 (the clause was added to Zoom's terms in March 2023 and amended after it came to public attention in August 2023). https://techcrunch.com/2023/08/08/zoom-data-mining-for-ai-terms-gdpr-eprivacy/ ↩
TechCrunch, "Slack under attack over sneaky AI training policy", 17 May 2024. https://techcrunch.com/2024/05/17/slack-under-attack-over-sneaky-ai-training-policy/ ↩
Pieter Arntz, "Adobe clarifies Terms of Service change, says it doesn't train AI on customer content", Malwarebytes, 12 June 2024. https://www.malwarebytes.com/blog/news/2024/06/no-ai-training-in-newly-distrusted-terms-of-service-adobe-says ↩
Regulation (EU) 2016/679 (GDPR), art. 28(2), 28(3)(g)–(h) and 28(4). https://gdpr-info.eu/art-28-gdpr/ ↩ ↩²
Cohen, Tobin, Bailey and Garcia (Polsinelli), "Trends in Negotiating With Software-as-a-Service Providers", National Law Review, 25 April 2025. https://natlawreview.com/article/trends-negotiating-software-service-providers ↩ ↩²
Regulation (EU) 2024/1689 (AI Act), art. 26 (obligations of deployers of high-risk AI systems), as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI): https://artificialintelligenceact.eu/article/26/ ; on the amended application dates, White & Case, "EU AI Omnibus enters into force, amending the AI Act", https://www.whitecase.com/insight-alert/eu-ai-omnibus-enters-force-amending-ai-act ↩ ↩²
Robert Freedman, "Negotiating limitations of liability when you have little leverage", Legal Dive, 26 April 2024. https://www.legaldive.com/news/negotiating-limitations-of-liability-when-you-have-little-leverage-alnajafi-nguyen-lexion/714477/ ↩ ↩²
Marc D. Lawlor, "Three things you should know about service level agreements in SaaS/cloud contracts", Conn Kavanaugh, 22 January 2025. https://www.connkavanaugh.com/articles-and-resources/three-things-you-should-know-about-service-level-agreements-in-saas-cloud-contracts/ ↩
Morgan Lewis, "The Data (Use and Access) Act 2025: A Strategic Update to UK Data Privacy Regulations", 8 August 2025 (enactment date; the Act is being commenced by regulations in stages). https://www.morganlewis.com/blogs/sourcingatmorganlewis/2025/08/the-data-use-and-access-act-2025-a-strategic-update-to-uk-data-privacy-regulations ↩
Latham & Watkins, "Eighth Circuit Vacates FTC's Click-to-Cancel Rule Days Before Compliance Deadline", 11 July 2025. https://www.lw.com/en/insights/eighth-circuit-vacates-ftc-click-to-cancel-rule-days-before-compliance-deadline ; Covington, "FTC Launches New Rulemaking on the Negative Option Rule", March 2026, https://www.cov.com/en/news-and-insights/insights/2026/03/ftc-launches-new-rulemaking-on-the-negative-option-rule ↩