# Essential Vendor Agreement Review Checklist > A vendor agreement review checklist: scope, price, SLAs, data and security, liability, exit, IP and disputes, with US and GDPR legal points. ## Vendor agreement review checklist Read the full agreement before you sign it. Also read every document that it refers to. Examples are the standard terms of the vendor, a service level agreement, an acceptable use policy and a data processing addendum. If the agreement refers to these documents, they can become part of your contract. ![Vendor agreement steps: receive, review terms, identify issues, negotiate, sign](/assets/blog/vendor-agreement-review-checklist/diagram_receive-contract-review.webp) ### Scope and acceptance - [ ] The deliverables are specific, with quantities, specifications and measurable results. "IT support" is too vague. "Response within 2 hours for priority 1 issues" is specific. - [ ] The acceptance criteria say how you test the work, by when, and what happens if the work fails. They also say how many attempts the vendor gets to correct it. - [ ] The agreement lists your own duties, such as access, data and approvals. It also says what happens if you are late with them. ### Price and payment - [ ] All fees are listed: setup, training, customization, support, shipping, and fees for more users or more volume. - [ ] The pricing model is clear: a fixed price, or a price based on usage, users or transactions. For a variable price, the formula and the caps are stated. - [ ] Price increases have a cap, a date and a notice period. Small increases add up. With 3% each year, you pay about 12.6% more in year 5 than in year 1. - [ ] Volume discounts apply without a separate request when you reach a threshold. - [ ] The payment terms state due dates, late fees, and your right to hold back payment for an amount in dispute. ### Performance - [ ] The SLA (service level agreement, a measurable service promise) states thresholds for uptime, response time and resolution time for each priority. - [ ] The agreement says how the vendor measures each threshold and what it excludes, such as planned maintenance. - [ ] A missed threshold gives you service credits (fee reductions). The credits increase with the size of the failure. - [ ] Repeated failures give you the right to end the agreement. - [ ] The vendor sends performance reports, for example every month. ### Data and security - [ ] You own the data that you give to the vendor, and the data that the vendor creates for you. - [ ] The vendor can use your data only to provide the service. - [ ] The security measures are specific: encryption, access controls and independent evidence. Examples of evidence are a SOC 2 Type II report and an ISO/IEC 27001 certificate. - [ ] The vendor must tell you about a data breach within a stated time. - [ ] At the end, the vendor returns your data in a usable format, such as CSV or an API export. Then it deletes the data within a stated time. - [ ] The vendor lists the subcontractors that handle your data. It tells you before it adds a new one. If the vendor processes personal data for you and the GDPR applies, the contract must contain specific terms. Article 28(3) requires, for example, that the vendor processes the data only on your documented instructions. At the end of the service, the vendor must delete or return all personal data, as you choose. The vendor must also give you the information to show compliance, and allow audits. Under Article 33(2), the vendor must tell you about a personal data breach without undue delay ([GDPR, EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng)). ### Liability, indemnity and insurance - [ ] The liability cap fits the possible harm. For example, a cap of 12 months of fees on a $5,000 yearly contract limits your recovery to $5,000. The failure can cost you much more. - [ ] Some harms are outside the cap, such as data breaches, breach of confidentiality, gross negligence and IP infringement. - [ ] The vendor indemnifies you (pays your losses and legal costs) for claims that come from its negligence, its breach, or IP infringement by its product. - [ ] The vendor has general liability, professional liability (errors and omissions) and cyber liability insurance. The agreement states minimum amounts and asks for proof every year. - [ ] If the vendor works at your site, it has workers' compensation insurance. ### Term, exit and transition - [ ] The agreement states the term, the automatic renewal, and the last day to cancel. - [ ] You can end the agreement without a reason (termination for convenience) with a stated notice period. - [ ] For termination for cause, the agreement defines a material breach and a cure period (time to correct a breach). Fraud or a data breach allows immediate termination. - [ ] Early termination fees decrease over time and stay below the remaining contract value. - [ ] At the end, the vendor helps with the transition. It continues the service for a period, transfers your data and works with the new provider. ### Intellectual property - [ ] The agreement transfers the ownership of custom work to you. - [ ] The license terms allow the use that you need: changes, use by other business units, sharing with contractors, a move to another host. - [ ] The vendor states that third-party and open source parts of the deliverable have proper licenses. Under US copyright law, the person who creates a work is ordinarily its author and owner. A work that you order from a vendor is a "work made for hire" only in nine categories. It also needs a written agreement that both parties sign ([U.S. Copyright Office, Circular 30](https://www.copyright.gov/circs/circ30.pdf)). For other work, you need a written transfer that the owner signs ([17 U.S.C. 204(a)](https://www.law.cornell.edu/uscode/text/17/204)). ### Disputes - [ ] The agreement has escalation steps: project managers first, then executives, then mediation (a neutral person helps both sides agree). - [ ] The agreement says if disputes go to arbitration (a private, binding decision) or to court. - [ ] Governing law and venue are your home state, or a neutral place. A US court can cancel an arbitration award only on narrow grounds. Examples are fraud, partiality of the arbitrators, or arbitrators who went beyond their powers ([9 U.S.C. 10](https://www.law.cornell.edu/uscode/text/9/10)). ![Dispute steps: project managers, executives, mediation, arbitration or court](/assets/blog/vendor-agreement-review-checklist/diagram_issue-arises-project.webp) ## Mistakes to avoid Avoid these three mistakes: - Do not compare price only. A low price with weak liability, SLA and exit terms can cost more over the full term. - Do not plan to fix problems later through the relationship. In a dispute, the contract terms decide. A change after signing needs the agreement of the vendor. - Do not give every vendor the same review. Give more time to the vendors that your business depends on most. ## Use this checklist with Claude or ChatGPT You can paste this checklist and the vendor agreement into Claude or ChatGPT. Ask the AI to compare the agreement with each item. The AI can find the clause for each topic in a long agreement, show which items are missing, and explain legal wording in plain language. ```text Below are a vendor agreement review checklist and a vendor agreement. For each checklist item, say "covered", "unclear" or "missing", quote the clause number and wording that covers it, and explain what it means for us as the buyer. Then list the terms we should try to change, in order of risk, with suggested wording. CHECKLIST: [paste the checklist] AGREEMENT: [paste the agreement and the documents it refers to] ``` Compare each quote from the AI with the agreement before you rely on it. The AI can misread a clause, miss a clause, or quote wording that is not in the agreement. Read your NDA with the vendor before you upload its contract. The NDA can forbid sharing with third parties. Also read the data settings of your workspace. An AI summary is not legal advice. For a large or long agreement, a lawyer has the final word. A docs portal with Ask AI and support tickets Connect a repository, or describe your product to start. Each docs site has search, Ask AI, an API console, an MCP server and support tickets. Publishes from GitHub on every push Works with Mintlify repositories API console from your OpenAPI file MCP server and llms.txt for AI agents Ask AI and support tickets Analytics for people and AI agents Start Free → Questions? Ask AI in our docs No card required. ## Frequently Asked Questions ### Who in the company needs to review a vendor agreement? Split the review by topic. The person who owns the service reviews the scope and the SLA. Finance reviews the price and the payment terms. IT or security reviews the data and security terms. For a large agreement, a lawyer reviews the liability, IP and dispute terms. --- [View the canonical page](https://revdoku.com/blog/vendor-agreement-review-checklist/) · [Browse llms.txt](https://revdoku.com/llms.txt)