Cloud migration is often treated as an IT project, but many of the most significant risks are created long before implementation begins. A well-negotiated cloud agreement can determine how your organisation manages data security, business continuity, liability, service levels and future flexibility long after the technology has been deployed.
14 July 2026
AI & Technology
Organisations invest enormous effort selecting the right cloud platform.
They compare functionality, pricing, security certifications, scalability and user experience. Technical teams conduct demonstrations, proof of concepts and security assessments. Procurement negotiates pricing.
Yet many of the risks that ultimately affect the success of a cloud implementation have very little to do with technology itself.
They are embedded in the contract.
The cloud provider's standard agreement often determines how risk is allocated long after the software has been implemented. Issues such as service availability, liability, data ownership, exit rights and business continuity are rarely revisited until something goes wrong. By then, the organisation has little negotiating leverage.
Technology may enable the business.
The contract determines how the business responds when technology fails.
Standard terms rarely mean balanced terms
Most Software as a Service (SaaS) providers operate highly standardised business models. Their commercial success depends on delivering the same platform to thousands of customers under largely consistent contractual terms. As a result, customers should expect that some aspects of the agreement may be difficult to negotiate, particularly in public cloud environments.
That does not mean the contract should simply be accepted without scrutiny.
The real objective is not to negotiate every clause. It is to identify which risks matter most to your organisation and focus negotiations where they will have the greatest commercial impact.
Service levels tell only part of the story
Many organisations focus on the headline availability commitment.
A commitment of 99.95% uptime appears reassuring.
However, that number rarely tells the whole story.
Questions worth asking include:
How is availability actually measured?
Are scheduled maintenance periods excluded?
At what point in the network is uptime measured?
Does the service level reflect the customer's actual user experience?
What happens if the provider repeatedly fails to meet the agreed standard?
These questions often have greater commercial significance than the percentage itself. The way service levels are defined, measured and remedied can substantially affect business operations.
Data ownership is usually straightforward. Data control is not.
Most cloud agreements confirm that customers retain ownership of their data.
That is important.
But ownership alone does not answer practical questions such as:
How may the provider use the data?
Can customer information be analysed for service improvement?
What happens to backups after termination?
How quickly can data be retrieved if the relationship ends?
In what format will it be returned?
An organisation that cannot efficiently recover its data may discover that changing providers is far more difficult than expected.
Cloud strategies should always include an exit strategy before implementation begins.
Service credits rarely compensate for business disruption
Many cloud agreements offer service credits if service levels are missed.
While service credits provide a contractual remedy, they often represent only a small reduction in future subscription fees.
For a business whose operations depend on continuous system availability, that may offer little practical protection.
Where critical business functions rely on cloud services, organisations should also consider:
termination rights;
performance improvement obligations;
escalation mechanisms;
business continuity commitments; and
disaster recovery responsibilities.
Commercial resilience is rarely achieved through service credits alone.
Liability deserves careful attention
Cloud providers commonly seek to:
exclude indirect losses;
cap liability, often at 12 months' subscription fees;
limit warranties;
restrict intellectual property indemnities.
These positions reflect the economics of cloud services rather than bad faith.
However, customers should consider whether those limitations appropriately reflect the value of the systems being entrusted to the provider.
For many organisations, the commercial consequences of system failure bear little relationship to the annual subscription fee.
Understanding where liability sits is ultimately a business decision rather than simply a legal one.
Technology projects are increasingly governance projects
Cloud implementations no longer involve only IT departments.
Legal, procurement, cyber security, privacy, finance and operational teams all have legitimate interests in the outcome.
Successful implementations occur when these functions work together from the beginning rather than reviewing documents sequentially.
Legal's role is not to delay procurement.
It is to ensure that commercial expectations align with contractual reality.
The Bottom Line
The most successful cloud projects are not those with the most sophisticated technology.
They are the ones where technology, commercial objectives and contractual risk remain aligned throughout the lifecycle of the relationship.
The cloud agreement is not simply a procurement document.
It is the operating manual for one of the organisation's most important business relationships.
Need Strategic Advice Before Signing a Cloud Agreement?
Cloud agreements are no longer just technology contracts. They define how organisations manage risk, protect data, allocate responsibility and maintain business continuity throughout the lifecycle of a critical technology relationship.
Whether you're procuring a SaaS platform, negotiating enterprise software, reviewing AI vendor agreements or planning a large-scale digital transformation, legal advice should help the business move forward with confidence, not simply identify risk.
Technology decisions are increasingly business decisions. Whether you're implementing AI, procuring enterprise software or negotiating cloud services, our Technology & AI Advisory practice helps organisations align legal risk with commercial objectives.
You may also find these related insights useful:
