Keeping Your MSP Contracts Current as Clients Adopt AI

If you are a managed service provider, your clients are most likely deploying AI in ways that impact your contracts. This trend, which you shouldn’t expect to go away anytime soon, changes your relationship with those clients. The gap isn’t that your contracts are bad. It’s that your business changed faster than the paper did.

“A client rolling out a new application, or simply letting their team use AI, opens a gap between what the managed service provider (MSP) does in practice and what the contract covers,” says Rob Scott, CEO and Co-founder of Monjur. “Treat it as a normal quarterly event alongside a vendor swap, a new service line, or a privacy law taking effect. Each one widens the gap.”

Scott, an attorney focused on MSP-specific legal strategy and attorney-supervised contract intelligence, has more than 25 years of experience in technology law and has helped 1,100+ MSPs navigate contracts, legal risk, data privacy, software licensing, and vendor compliance. He is also the co-founder of Scott & Scott, LLP, a law firm dedicated to serving MSPs.

The gaps Scott warns of will require most MSPs to update how they keep their contracts current. As they do, it is critical for them to understand the types of risks AI introduces and how contracts need to adjust to address them.

What key risks does AI bring to MSPs?

One of the top risks MSPs face in the age of AI is a client deploying something the contract doesn’t cover, and it is a structural risk rather than a one-off event.

AI arriving inside the tools the MSP resells presents another risk. In this case, the vendor stack can become the MSP’s problem.

“A current agreement carries AI-specific terms clarifying that the client uses AI at their own risk, including AI built into resold tools, and the mechanism is the Schedule of Third-Party Services, which passes the vendors’ own liability limits through to the client,” Scott explains. “But that requires naming the vendors in a schedule the client can see, and structuring it so that any vendors added later stay covered. Without pass-through, the MSP absorbs liability for the entire stack, even though the MSP did not choose to deploy the AI features that their vendors shipped.”

Scott also warns MSPs to be aware of the following risks:

• Regulatory risk: With an evolving legal landscape, in which rules do not move at the same speed as deployment, it is possible to inadvertently help a client implement something that is illegal, or that becomes illegal later.
• Hallucination causing actual injury: If AI produces an output that leads to harm, someone can get sued. When the MSP deployed, recommended, or supports the tool that produced it, the MSP is in that chain.
• Liability allocation when the AI made the choice: Every time an AI-driven tool in a client environment makes a decision with a consequence, the MSP faces the risk of being held accountable.

What does a current MSP contract look like?

Addressing AI-related risks requires incorporating a number of new contract terms. One key update is an AI attachment that sets out how AI is used in the environment and places the client’s AI use, including resold-tool AI, at the client’s own risk.

“Effective risk management also requires modernizing the Criminal Acts and Force Majeure component of the contract,” Scott says. “This is where AI-specific risk now gets addressed. Effective versions will now be built around criminal acts of third parties, ransomware, breach, business email compromise, and phishing rather than the old fires-and-floods list.”

Service attachments for the AI work itself that define scope of services, responsibilities, and deliverables for AI implementation are also important. Strategic plans have to be reflected in the service agreements, including service descriptions, performance metrics, and compliance obligations.

Other key contract elements include:

• A Schedule of Third-Party Services that names the vendors, passes their liability limits through, and is structured so vendors added later stay covered.
• A Data Processing Framework that requires a signed DPA before moving data regulated by HIPAA, GLBA, CCPA, GDPR, CMMC, and newer state privacy laws. Best practice treats this framework as a gate the MSP presents, rather than a document to wait for.
• Security Recommendations with a Declination of Service that provides a written mechanism for recommending a control and shifting risk when the client declines. This is directly usable when a client insists on a tool the MSP flagged.
• Limitation of Liability tied to the greater of insurance proceeds or a stated fee window, with a carrier-denial provision. Customer insurance requiring the client’s coverage to respond first, with a waiver of subrogation, can be added to this.

Managed service providers must take a dynamic approach to keeping contracts current

The biggest mistake MSPs are making as they wrestle with the risks of AI is treating the contract as a one-time artifact instead of a living system. Contracts can’t mitigate AI-related risks if they don’t anticipate and address the way AI, and the regulatory and compliance pressures around it, keeps evolving. The only safe approach is a dynamic one.

“A static MSA is like an unpatched system,” Scott warns. “It runs fine until someone finds the gap, but by then, it can be too late to fix quietly.”