Most ERP negotiations still run on paper written for a different technology. The template assumes a system that sits waiting for a user to click. An AI-native ERP does not wait. It reads invoices, proposes journal entries, dispatches payment runs, and closes sub-ledgers overnight. The contract that governs it has to describe what the software is allowed to do on its own, what proof it must leave behind, and what happens when the model underneath changes without warning.
The clauses that matter are not the ones the vendor is used to negotiating. Price, term length, and a generic uptime SLA are table stakes. The risk sits in the paragraphs about model changes, training data, agent authority, and exit. Those paragraphs are often boilerplate copied from a SaaS template written in 2019. Rewrite them before signature. After signature, leverage is gone.
What follows is a checklist for the signature stage, aimed at controllers and finance-systems leaders who have finished their shortlist and are now marking up paper.
The SLA Has to Measure Reconciliation, Not Just Uptime
A 99.9% availability commitment tells your close nothing. That number translates to roughly 43 minutes of monthly downtime, which is meaningless if the system was up but the sub-ledger did not tie. The SLA in an agentic ERP contract needs a second metric alongside uptime: reconciliation completeness by a stated time each morning.
Write it into the paper. Sub-ledger to general ledger tie-out by 07:00 local, with a defined tolerance in dollars or basis points. Bank reconciliation posted before the controller starts the day. Exceptions routed with a named owner and an aging clock. If the vendor will not commit to these numbers, the product is not ready for a close you can sign. Closing faster is, in practice, a reconciliation problem more than a workflow problem, and the SLA is where you make that concrete.
Then negotiate the remedy. Service credits without a chronic-failure exit are theatre. Bloomberg Law found service credits on 500 SEC-filed cloud contracts averaged a 30% monthly cap, with outliers from 10% to unlimited. Push for a tiered structure, a cross-quarter aggregation, and a termination-for-chronic-failure right if a defined threshold is breached in any rolling six-month window.
Agent Authority Belongs in the Contract, Not the Config File
Every agentic ERP vendor will tell you the customer sets the guardrails. That is true operationally and useless legally. If the ceiling on what an agent can post, pay, or approve lives only in a settings pane the vendor can edit, the contract has told you nothing about liability when an agent acts outside expectation.
Fix the authority ceilings on paper. Maximum single payment an AP agent can release without human approval. Maximum aggregate daily payment volume. Categories of journal entry the controller agent may post autonomously versus those it must queue. Vendor-master changes that require dual control regardless of who or what proposes them. These are not features. They are contractual limits on autonomous action, and they should read like SOX segregation-of-duties language, not marketing copy.
The other half of this clause is the honest floor: there are things an agent structurally cannot do inside a ledger without human sign-off, and the paper should say so. If the vendor resists naming those limits, that resistance is itself the finding.
Audit Trail Retention Has to Outlast the Contract
An AI ERP produces two audit trails: the financial one your auditor already expects, and a decision trail that shows why an agent did what it did. Both need retention terms written into the contract, and both need to survive termination.
Ask for seven-year retention on posted transactions and the associated approval chain, matched to the retention your auditor already applies under SOX. Ask separately for retention of prompt logs, model version stamps, tool calls, and the input documents an agent consumed to reach a decision. If the vendor deletes the decision trail 90 days after termination, you cannot answer an auditor question about a journal entry posted in year one of the contract. The retention clause is where that gap closes.
Model-change notice sits next to retention. Standard contracts give vendors broad rights to change the underlying model with minimal notice, and buyers should negotiate for 30 days minimum and 60 preferred, with a right to remain on the prior version for a defined window. For a finance system, the prior-version window matters more than the notice period. A close in progress cannot absorb a silent behaviour change in a controller agent halfway through week four.
Exit and Data Extraction Are Where Vendors Bury the Cost
The exit clause in a standard SaaS template covers your data. In an agentic ERP, "your data" is a bigger surface. Exit provisions for AI systems should explicitly cover model fine-tuning artifacts, conversation history, custom agent configurations, and retrieval index contents, on top of the standard 30-90 day deletion and export in usable formats. If your controller agent has been trained on three years of your journal narratives, that fine-tuning is a work product you paid for. Name it in the exit clause.
Extraction format matters as much as extraction rights. Insist on chart of accounts, open items, historical transactions, attachments, and approval history in a documented schema, not a proprietary dump. Insist on assisted extraction, with vendor engineers on the hook, not a self-service export button. Migration back off a system is where bad data is discovered, and the discovery cost is yours whether the contract acknowledges it or not.
Add a training-data prohibition while the paper is open. A negotiated AI contract should carry an explicit, affirmative prohibition on using your inputs, outputs, and submitted data to train, retrain, or fine-tune any commercial or publicly available model without prior express written consent. For a finance system, that includes vendor-master data, contract terms, and any narrative attached to a journal entry.
Price the Work, Not the Adoption
AI ERP pricing is still finding its shape. Some vendors price per user, some per agent, some per transaction, some on a consumption model tied to model calls. The unit you sign for will drive behaviour for the whole term. Per-user pricing punishes you for giving the controller team read-only access. Per-agent pricing punishes you for specialising work. Per-transaction pricing punishes growth. Per-model-call pricing turns every prompt improvement into a line item.
Negotiate three things regardless of the unit. A price cap on annual escalation, ideally tied to a published index rather than vendor discretion. A firm shelf life on quoted prices for expansion modules, so a mid-term addition does not reset the whole commercial. And a written policy on what happens when the vendor swaps a cheaper model in behind the scenes: the savings should flow to the customer, not disappear into vendor margin. For structured side-by-side reading, published ERP software comparisons are a better starting point than a rate card in a sales deck.
Regulatory Allocation Has to Name Who Does What
If your operations touch the EU, the AI Act reaches your finance stack whether the vendor volunteers that or not. Deployers of high-risk AI systems carry their own compliance obligations even when using a third-party tool, including registration, quality management, monitoring, record-keeping, and incident reporting. Some AI ERP use cases will not be high-risk. Some will. The contract has to allocate the work.
Two clauses handle most of it. First, a disclosure requirement on the vendor to state whether its system constitutes a high-risk system under applicable law, and to update the customer if that classification changes. Second, a cooperation clause that names which party produces the technical documentation, monitoring evidence, and incident notifications required of a deployer. The penalty regime makes the allocation worth fighting for: the AI Act contemplates fines up to €40 million or 7% of turnover for violations of prohibitions on banned AI uses, and while ERP use cases are unlikely to hit that ceiling, the enforcement architecture is not one to inherit by silence.
What to Cut From the Draft the Vendor Sent
Not everything in the standard AI vendor MSA is worth defending. "Best efforts" language on performance is vendor theatre and should be replaced with measurable commitments. Broad indemnity carve-outs for model output belong in the same category: if the vendor will not stand behind the agent it sold, the agent is not sold. Auto-renewal windows longer than 30 days are a leverage transfer, not a scheduling convenience. Vague references to "industry-standard security" are worth exactly what they cost to write.
Two clauses in particular deserve the red pen. Any clause that lets the vendor change the definition of a pricing unit mid-term. Any clause that lets the vendor use your data to improve a shared model without written consent. Both are easy to sign and expensive to unwind.
Sign the Paper You Can Audit
The test for an AI ERP contract is not whether it protects the finance team from a catastrophe. Catastrophes are rare and the courts are slow. The test is whether the paper describes, in specifics your auditor could read back to you, how the system behaves on an ordinary Tuesday: what the agents may do, what they must log, what happens when the model changes, and what leaves with you at the end. A contract that answers those four questions is a contract worth signing. Everything else is calendar management.
Teams working through this negotiation stage often find it useful to run the shortlist against a written scorecard before the redlines start. A structured free assessment or a live product demo against the specific clauses above tends to surface the boilerplate faster than another vendor deck will.