AI Vendor Lock-In Audit: Score Your Contracts for EU AI Act Portability Risk

The task

In-house counsel reviewing an AI vendor MSA or DPA needs to know, fast, whether the deal quietly traps the business — no exit ramp, no data export, no way to swap providers if the vendor gets classified as high-risk or systemic-risk GPAI. This audit turns a stack of contract text into a scored portability-risk memo you can send to procurement or use as the basis for a redline round.

Before AI

You (or a junior associate) read the MSA, DPA, SOW and any AI addendum end-to-end, cross-referencing against an internal checklist of exit-rights, data portability, model-substitution, indemnity and Article 25 deployer clauses. Two to four hours per contract, longer if the vendor's paper is bespoke. Findings live in a Word doc that never quite gets to a comparable score across the portfolio.

The pressure is real: a June 2026 IBM study found 93% of executives now consider AI sovereignty critical, yet 71% admit they cannot easily switch AI vendors, and enforcement milestones under the EU AI Act — including obligations for general-purpose AI model providers and the August 2026 high-risk deadline — are already reshaping what "acceptable" vendor paper looks like. Industry checklists now flag things like a defined window (commonly 90 to 180 days) to terminate the contract at the original pricing through the original term, with the data-portability and audit-log export obligations intact on change-of-control.

The workflow

The idea: paste contract text into a chat session, run three prompts back-to-back, get a scorecard + redline pack. No SaaS, no upload of client documents to a third-party portal, no leaving privileged workflow.

Step 1 — Extract the clauses that matter

Paste the vendor's contract text (MSA + any AI/DPA addendum) under the prompt below. The model classifies clauses into the portability-risk categories and quotes each verbatim so you're not working from a paraphrase.

You are a senior technology transactions lawyer auditing an AI vendor contract for EU AI Act portability and lock-in risk. Attorney work product — treat as privileged and confidential.

From the contract text that follows, extract and quote VERBATIM every clause that touches any of these categories. If a category has no clause, write "NOT PRESENT" — do not infer.

Categories:
1. Term, renewal and termination-for-convenience
2. Termination for change-of-control or vendor acquisition
3. Data export / portability format on exit (schemas, timelines, fees)
4. Model substitution rights (can the vendor swap the underlying model / GPAI provider without consent?)
5. Fine-tuned weights, embeddings, prompt logs — ownership and export
6. Sub-processor and downstream GPAI provider disclosure
7. EU AI Act Article 25 deployer-obligation allocation
8. High-risk / systemic-risk reclassification triggers
9. Audit and transparency rights (training data summaries, evaluations)
10. Indemnity for IP, output, and regulatory non-compliance
11. Liability caps and carve-outs
12. Transition / reverse-transition assistance on exit

For each clause, output:
- Category number and name
- Section reference in the contract
- Verbatim quote (use ellipses only if a clause runs >100 words)

Do not summarise, redline, or score yet. Extraction only.

CONTRACT TEXT:

MASTER SERVICES AGREEMENT — NORTHWIND ANALYTICS, INC. ("Vendor") and ACME EU HOLDINGS B.V. ("Customer"). Effective 1 March 2026.

3. TERM. Initial term of three (3) years from the Effective Date, auto-renewing for successive one-year terms unless either party gives 90 days' written notice. Customer may terminate for convenience upon 180 days' notice subject to an early-termination fee equal to 40% of remaining committed fees.

4.2 CHANGE OF CONTROL. In the event of a change of control of Vendor, Vendor shall notify Customer within 30 days. Customer shall have no automatic right of termination.

7. MODELS. Vendor's "Northwind Reasoning Platform" is powered by third-party foundation models. Vendor may, at its sole discretion and without notice, substitute the underlying foundation model, model version, or model provider, provided that documented output quality on Vendor's internal benchmark does not degrade by more than 15%. Customer waives any claim arising from such substitution.

9. DATA EXPORT. Upon termination, Vendor shall make Customer Data available for export in Vendor's then-current proprietary JSON format for a period of 30 days, subject to an export fee of EUR 25,000. Fine-tuned model weights, embeddings, and prompt/response logs are Vendor Confidential Information and shall not be exported or retained by Customer.

11. SUB-PROCESSORS. A current list of sub-processors is maintained at vendor.example/subs. Vendor may add or replace sub-processors, including foundation model providers, upon 15 days' notice. Customer's sole remedy for objection is termination under Section 3 (subject to the early-termination fee).

14. EU AI ACT. The parties acknowledge Regulation (EU) 2024/1689. Customer, as deployer, shall be solely responsible for all deployer obligations, including those that arise from any reclassification of the Services as a high-risk AI system. Vendor makes no representation regarding classification of any underlying general-purpose AI model as presenting systemic risk.

16. AUDIT. Customer may audit Vendor's compliance no more than once per 24 months, on 60 days' notice, at Customer's expense, and subject to Vendor's confidentiality and security requirements. Vendor is not obligated to disclose training data, model evaluations, or benchmark results.

18. INDEMNITY. Vendor shall indemnify Customer against third-party claims that the Services, as delivered, infringe registered EU patents or copyrights, capped at fees paid in the preceding 12 months. Vendor shall have no indemnity obligation for (a) outputs, (b) Customer's use of outputs, (c) regulatory fines including under the EU AI Act, or (d) claims arising from Customer's training or fine-tuning data.

19. LIABILITY. Each party's aggregate liability is capped at fees paid in the preceding 12 months. Carve-outs: confidentiality breach (2x cap), Vendor's IP indemnity (cap), and Customer's payment obligations (uncapped).

22. TRANSITION. Upon expiry or termination, Vendor shall provide reasonable transition assistance at Vendor's then-current professional services rates for up to 60 days.

Step 2 — Score each category and total the portability risk

The model now scores what it just extracted. The rubric is opinionated on purpose — a Low score means the clause is roughly market for a portability-friendly deal; High means the clause is the kind of paper you'd expect to see cited when a GC complains they can't get off a vendor.

Using ONLY the clauses you extracted in the previous step, score each of the 12 categories 0-3:

0 = Portability-friendly / customer-protective (or standard market)
1 = Acceptable with minor redline
2 = Material lock-in or EU AI Act exposure — redline required
3 = Deal-breaker as drafted / walk-away issue

For each category output a row:

| # | Category | Score | One-line rationale citing the clause |

Reference standards to apply when scoring:
- Data export: proprietary formats, export fees, or <60-day export windows score ≥2.
- Model substitution without customer consent scores ≥2; without notice scores 3.
- Article 25 deployer obligations dumped entirely on the customer with no vendor cooperation scores 3.
- Indemnity that carves out outputs AND regulatory fines (including EU AI Act penalties) scores 3.
- Change-of-control with no customer termination right scores ≥2.
- Audit rights that exclude training data, evaluations, or GPAI transparency information score ≥2.
- Sub-processor changes (including foundation-model swaps) with <30 days' notice or no objection right score ≥2.

After the table, output:
- TOTAL SCORE (out of 36)
- Portability-Risk Tier: LOW (0-8) / MEDIUM (9-18) / HIGH (19-27) / CRITICAL (28-36)
- The three highest-scoring categories, in priority order, as the redline targets for Step 3.

Step 3 — Generate redline language and a negotiation memo

Now the model turns the top three risks into actual proposed language plus a short memo the deal lead can send to procurement or the vendor.

For each of the three redline targets identified in Step 2, produce:

1. PROPOSED REDLINE — clean replacement language, drafted in the contract's voice, that would bring the score down to 0 or 1. Where the EU AI Act is implicated, reference the specific Article (e.g., Art. 25 deployer obligations, Art. 50 transparency, Art. 55 systemic-risk GPAI). Where market fallback positions exist, include a "fallback" version we can accept.

2. RATIONALE — 2-3 sentences explaining the business and regulatory risk of the current clause, in language a non-lawyer procurement lead can use with the vendor.

3. WALK-AWAY LINE — the minimum acceptable position below which we recommend not signing.

Then produce a NEGOTIATION MEMO (max 300 words) addressed to "Deal Lead" with:
- Overall portability-risk tier and headline finding
- The three redline priorities with one-line asks
- Two questions to put to the vendor before the next round
- A privilege footer: "Prepared by [Legal]. Attorney work product. Do not forward outside the deal team."

Do not invent facts not present in the extracted clauses.

Gotchas

• Verbatim ≠ complete. The model will occasionally miss a clause buried in a schedule or DPA annex. Always paste the full document set, and spot-check Step 1's "NOT PRESENT" answers against your own eyes on the doc.
• Scoring rubric is opinionated. It reflects a customer-side, EU-deployer posture. If you're vendor-side or the deal is US-only, edit the rubric in Step 2 before running.
• This is not legal advice output. The redlines in Step 3 are drafting starting points, not final language — GPAI classification and Article 25 allocation especially need a human read against the current Commission guidelines for GPAI providers.
• Privilege. Only run this in an enterprise-tier AI environment where prompts are not used for training and logs are under your retention control. Do not paste contracts into a consumer chatbot.
• Model substitution clauses are moving targets. Vendors are rewriting these weekly as GPAI enforcement matures — treat any "market" position as a 90-day view.
• Long contracts get truncated. If your MSA + DPA + AI addendum runs past the context window, split by document and score each pass, then reconcile the tables by hand.

Time saved

A first-pass portability audit that used to take a senior associate 2-3 hours (extract, score against checklist, draft redline bullets, write the memo) compresses to roughly 15-25 minutes of prompt-running plus lawyer review. The saving is real but modest: you still read the contract. What you skip is the mechanical translation from "I've read it" to "here is a scored, comparable, redline-ready memo." Across a portfolio of 20-40 AI vendors — the range most large enterprises now sit at — that adds up to a working week per review cycle.

What we got when we ran it

We executed every prompt above, in order, against the sample input (model: claude-sonnet-4-6). Outputs below are real and unedited apart from length truncation.

Step 1 output

# Verbatim Clause Extraction — EU AI Act Portability & Lock-In Audit Matter: ACME EU Holdings B.V. / Northwind Analytics, Inc. — Master Services Agreement (Eff. 1 March 2026) Classification: Attorney Work Product — Privileged & Confidential --- ## 1. Term, Renewal and Termination-for-Convenience Section Reference: Section 3 (TERM) > "Initial term of three (3) years from the Effective Date, auto-renewing for successive one-year terms unless either party gives 90 days' written notice. Customer may terminate for convenience upon 180 days' notice subject to an early-termination fee equal to 40% of remaining committed fees." --- ## 2. Termination for Change-of-Control or Vendor Acquisition Section Reference: Section 4.2 (CHANGE OF CONTROL) > "In the event of a change of control of Vendor, Vendor shall notify Customer within 30 days. Customer shall have no automatic right of termination." --- ## 3. Data Export / Portability Format on Exit (Schemas, Timelines, Fees) Section Reference: Section 9 (DATA EXPORT) > "Upon termination, Vendor shall make Customer Data available for export in Vendor's then-current proprietary JSON format for a period of 30 days, subject to an export fee of EUR 25,000. Fine-tuned model weights, embeddings, and prompt/response logs are Vendor Confidential Information and shall not be exported or retained by Customer." --- ## 4. Model Substitution Rights (Can the Vendor Swap the Underlying Model / GPAI Provider Without Consent?) Section Reference: Section 7 (MODELS) > "Vendor's 'Northwind Reasoning Platform' is powered by third-party foundation models. Vendor may, at its sole discretion and without notice, substitute

…output truncated at 250 words.

Step 2 output

# Scoring Analysis — EU AI Act Portability & Lock-In Audit Matter: ACME EU Holdings B.V. / Northwind Analytics, Inc. Classification: Attorney Work Product — Privileged & Confidential --- ## Scoring Table | # | Category | Score | One-line rationale citing the clause | |---|----------|-------|--------------------------------------| | 1 | Term, renewal and termination-for-convenience | 2 | 180-day notice plus "40% of remaining committed fees" early-termination fee creates a substantial financial penalty that effectively deters legitimate convenience termination. | | 2 | Termination for change-of-control or vendor acquisition | 2 | "Customer shall have no automatic right of termination" on change-of-control leaves Customer bound to a potentially hostile or competitor-controlled successor vendor with no exit. | | 3 | Data export / portability format on exit | 3 | Export is limited to "Vendor's then-current proprietary JSON format" (no open schema), for only "30 days" (below the 60-day minimum standard), subject to a "EUR 25,000" export fee — all three negative indicators present simultaneously. | | 4 | Model substitution rights | 3 | Vendor may substitute "at its sole discretion and without notice" against only an internal benchmark; "Customer waives any claim arising from such substitution" — no-notice substitution with a liability waiver is a walk-away issue. | | 5 | Fine-tuned weights, embeddings, prompt logs — ownership and export | 3 | "Fine-tuned model weights, embeddings, and prompt/response logs are Vendor Confidential Information and shall not be exported or retained by Customer" — Customer receives no rights whatsoever in

…output truncated at 250 words.

Step 3 output

# Redline Package — Priority Categories 4, 10, and 3 Matter: ACME EU Holdings B.V. / Northwind Analytics, Inc. Classification: Attorney Work Product — Privileged & Confidential --- ## REDLINE TARGET 1 — Category 4: Model Substitution Rights ### 1. PROPOSED REDLINE PREFERRED POSITION — Section 7 (MODELS): Replace in full with: > "Vendor's 'Northwind Reasoning Platform' is powered by third-party foundation models. Vendor may substitute the underlying foundation model, model version, or model provider only upon 60 days' prior written notice to Customer, which notice shall identify: (a) the replacement model or provider by name; (b) the provider's EU AI Act classification status, including whether the replacement model has been designated as a general-purpose AI model presenting systemic risk under Regulation (EU) 2024/1689, Article 51; (c) any resulting change to Vendor's obligations under Article 25 of that Regulation as they bear on Customer's deployment; and (d) documented output-quality results on both Vendor's internal benchmark and a mutually agreed external evaluation suite. If Customer reasonably determines that the substitution would materially alter Customer's regulatory compliance posture, Customer may terminate this Agreement for convenience without payment of any early-termination fee within 30 days of receiving such notice. Customer does not waive any claims arising from model substitution." FALLBACK POSITION — Section 7 (MODELS): > "Vendor may substitute the underlying foundation model, model version, or model provider upon 30 days' prior written notice to Customer, identifying the replacement model and provider by name and providing output-quality documentation on Vendor's internal benchmark. If

…output truncated at 250 words.

---

This content is for informational purposes only and is not legal advice. Confirm confidentiality, privilege, and jurisdictional rules before using any AI tool with client matters.