Software Contract Red Flags Every CIO Should Know

Clauses that permit price increases "at the vendor's discretion" or by CPI + a fixed percentage with no ceiling. Oracle's standard support terms historically included 3–4% annual escalation with no cap — meaning a $1M support contract becomes $1.48M in ten years before any additional product purchases.

Contracts that tie renewal pricing to "then-current list price" rather than the originally agreed price or a defined escalation formula. Since vendors routinely increase list prices by 5–20% annually, this clause eliminates any price protection value from your initial discount.

SaaS contracts that automatically renew bundled products — including modules you do not actively use — unless affirmatively cancelled within a narrow notice window (sometimes 30–60 days before renewal date). Salesforce and Microsoft CSP agreements are frequent offenders.

Cloud and SaaS agreements where "minimum spend" floors increase each year — often by 10–20% — regardless of actual consumption or usage growth. AWS EDP and Google Cloud Commit agreements can include automatic ratchet provisions that compound your financial exposure annually.

Clauses permitting the vendor to reclassify or reprice products following acquisitions, rebranding, or product restructuring. Broadcom's VMware acquisition — where perpetual licences were converted to subscription pricing — demonstrated how this risk can materialise catastrophically for unprepared customers.

Contracts with no restriction on how frequently a vendor can conduct licence audits. Without a limit — typically "no more than once per 12-month period" — vendors can initiate multiple audits in a single year, each creating disruption, remediation liability, and negotiating leverage for the vendor.

SAP's historic indirect access provisions — and similar language in Oracle's contracts — permit vendors to charge licence fees for third-party systems that interact with their platform, even via APIs. The potential liability surface is enormous and very few IT leaders understand it at the time of signing.

Audit clauses that permit the vendor to appoint a named third-party auditor paid on a percentage of findings rather than a flat fee. BSA (Business Software Alliance) and some "Big 4" audit firms engaged by Oracle and SAP operate under contingency arrangements that create systematic incentive to find and expand compliance gaps.

Audit rights that permit the vendor to assess compliance going back 2–3 years prior to the current agreement, including periods covered by previous contracts. Combined with changes in vendor licensing policy, this can create backdated liability for usage that was compliant under the rules at the time.

Clauses requiring you to proactively disclose over-deployment or compliance gaps without providing a corresponding grace period or penalty limitation. Voluntarily declaring a compliance shortfall can trigger invoices at full list price rather than the discounted remediation pricing available in a negotiated resolution.

Multi-year SaaS and cloud contracts with no termination for convenience clause — meaning you cannot exit the agreement early regardless of changed business circumstances, budget constraints, or product dissatisfaction. This is standard in vendor-drafted agreements and must be actively negotiated. See our dedicated guide on termination for convenience clauses.

Contracts where "termination for convenience" is technically available but requires payment of all remaining licence fees or a percentage thereof — effectively eliminating the value of the right. A clause requiring payment of 80% of remaining contract value is not meaningfully different from no termination right at all.

SaaS agreements that prohibit reducing user count, module scope, or spend below the initial contracted level during the term. In an environment of workforce changes, M&A activity, or product rationalisation, the inability to flex down creates stranded-cost risk — particularly in Salesforce and Workday agreements.

Contracts — particularly in SaaS platforms — where custom configurations, workflows, APIs, and integrations developed by your teams are classified as "derived works" or the intellectual property of the vendor. This creates dependencies that dramatically increase real switching costs beyond the headline platform cost.

Some vendor agreements — most aggressively in Oracle's terms — include provisions restricting your right to engage competitive benchmarking, participate in third-party support programmes, or even disclose pricing to certain parties. These clauses attempt to contractually eliminate your BATNA-building activity.

An increasingly common provision in SaaS agreements permitting the vendor to use your business data, usage patterns, and interactions to train AI models — sometimes with minimal opt-out provisions. Salesforce Einstein, Microsoft 365 Copilot, and ServiceNow AI contracts have all attracted scrutiny on this point.

SaaS agreements that guarantee data export rights but only in the vendor's proprietary format — making the data practically unusable with alternative systems. True data portability requires export in open, documented formats (CSV, JSON, XML) with complete schema documentation.

Contracts specifying that the vendor will retain your data for only 30–60 days after contract termination before permanent deletion. For complex SaaS migrations — which typically take 6–18 months to complete — this window is entirely insufficient and creates risk of catastrophic data loss.

Clauses granting the vendor the right to aggregate, anonymise, and commercially exploit data derived from your usage — including benchmarking data that reveals your business performance, competitive positioning, or spending patterns. Particularly sensitive in financial services and healthcare.

Standard vendor agreements typically limit total liability to the fees paid in the prior 12 months — meaning your maximum recovery from a catastrophic failure is capped at a single year's licence fee, regardless of your actual business losses which may be multiples higher.

Universal exclusion of consequential, indirect, or special damages — eliminating any recovery for lost revenue, lost profits, or business disruption resulting from vendor failure. In a system-of-record SaaS deployment, the exclusion of consequential damages can reduce real-world liability exposure by 95%+ relative to actual impact.

SLA provisions that explicitly state service credits are the "sole and exclusive remedy" for any and all service failures — including catastrophic data loss or multi-day outages. This provision, combined with an exclusion of consequential damages, means your maximum recovery from a major outage could be a nominal service credit.

SLA provisions where uptime is measured and reported exclusively by the vendor's own monitoring infrastructure, with no independent verification mechanism. Vendor-controlled measurement systematically under-reports downtime experienced by customers due to network path issues, CDN failures, and partial degradation events.

Force majeure clauses drafted so broadly that they excuse vendor non-performance for "system failures," "cyber events," or "technical disruptions" — in other words, exactly the operational risks you are paying a premium SaaS provider to manage. Force majeure should be limited to genuinely unforeseeable external events.

SaaS agreements — and some cloud platform agreements — that grant the vendor the right to modify terms, pricing, or service definitions with 30 days' notice and deem your continued use as acceptance. This clause can unilaterally eliminate any protection you negotiated at contract execution.