A £38,000 contract caused a seven-figure loss with £9,500 of recovery. Risk doesn't scale with contract value, but review effort usually does.
A company signs with a data processing vendor. The agreement is the vendor's standard form, twelve pages, reviewed in an afternoon because the annual value is only £38,000 and it did not clear the threshold for legal review. Liability is capped at three months of fees. There is no security incident notification obligation. Data deletion on termination is described as "in accordance with the Provider's standard practices".
Two years later the vendor suffers a breach exposing customer records the company is the controller for. The regulator's interest is in the company, not the vendor. The remediation, notification, and reputational cost run to seven figures. The contractual recovery is capped at £9,500.
The agreement was not badly negotiated. It was barely negotiated at all, because the spend was small. That is the recurring pattern in vendor contracting: risk does not scale with contract value, but review effort almost always does.
A vendor agreement is a contract between a business and a third party supplying it with goods or services. It defines what is being supplied, at what price, to what standard, who bears which risks, and how the relationship ends.
The term is broad by design. It covers software subscriptions, professional services, facilities management, logistics, staffing, marketing agencies, and equipment supply. What unites them is the structure: an ongoing commercial relationship with performance obligations running in both directions over time.
These three terms overlap and get used loosely.
The MSA-plus-SOW structure is worth adopting for any relationship expected to involve more than one engagement. It means the hard legal negotiation happens once, and subsequent work starts with a short commercial document rather than a fresh contract cycle.
The most disputed part of most vendor relationships, and the least legally technical. Vague scope produces disagreement about what was included, which becomes a change order argument, which becomes a relationship problem.
Good scope drafting specifies deliverables, defines what is expressly excluded, states dependencies on the customer, and — critically for services — sets acceptance criteria. Without acceptance criteria, there is no defined moment at which work is done, which makes both payment and warranty periods ambiguous.
The headline rate matters less than the mechanism. Watch for:
An SLA without a remedy is a statement of intent. The questions that matter: what is measured, how is it measured and by whom, what is the target, what happens when it is missed, and does persistent failure give a termination right?
Service credits are the usual remedy, and they are usually modest — often a small percentage of monthly fees, frequently capped, and almost always expressed as the sole remedy for performance failure. That last phrase is worth noticing, because it converts what looks like a protection into a limitation.
Where the real money sits. The cap is the headline, commonly expressed as a multiple of fees paid in the preceding twelve months. But the carve-outs determine actual exposure: which liabilities sit outside the cap entirely, and which are excluded altogether.
Consequential and indirect loss exclusions are near-universal and worth reading carefully, because the label covers a wider range than most commercial readers expect — including, in many formulations, lost profits and lost data. Indemnities for IP infringement and for data breach are the two most commonly negotiated additions.
Where the vendor processes personal data, a data processing agreement is generally a legal requirement rather than a commercial preference, and it carries mandatory content: processing purposes, security measures, subprocessor controls, breach notification, deletion or return on termination, and audit rights.
Beyond the mandatory terms, the commercially significant points are notification timeframes, whether subprocessor changes require consent or merely notice, and what "deletion" actually means in the vendor's architecture.
Who owns what the vendor creates, and what rights each party has to the other's pre-existing material. The common failure is assuming that paying for work means owning it — in many jurisdictions, absent an express assignment, the creator retains copyright. Where the vendor is building something bespoke, express assignment language matters. Where they are providing a product, a licence with clear scope is what you need instead.
Not usually at negotiation. At administration.
The agreement gets signed, becomes a PDF, and goes into a folder. The renewal notice window — calculated from an effective date that may differ from the signature date — exists as a clause nobody has calendared. Reporting obligations, insurance certificate renewals, security attestations, and audit rights sit scattered through the document and its exhibits. Amendments are filed separately, so anyone reading the base agreement is reading superseded terms.
Then the renewal passes automatically, or an SLA breach goes unclaimed because nobody was measuring, or a security questionnaire that was contractually due annually was never requested. None of these are drafting failures. They are tracking failures, and they are why disciplined contract obligation tracking from the point of signature is worth more than another round of redlines.
Reviewing every vendor agreement with the same rigour is not achievable, and thresholds based purely on contract value miss the point — as the opening example shows. A more useful triage asks:
Where these point to low risk, standard terms and a fast path are appropriate. Where any points to high risk, the value threshold should not be what decides it. Fitting this into the wider sequence is covered in the procurement process.
A master services agreement is a specific type of vendor agreement: the umbrella contract holding the legal terms that govern an ongoing relationship, with individual engagements documented separately in statements of work. "Vendor agreement" is the broader category and may describe an MSA, a standalone one-off contract, or a supplier's standard terms. Practically, if you expect more than one engagement with a supplier, the MSA-plus-SOW structure saves substantial time, because the difficult terms are negotiated once rather than each time.
At minimum: correctly identified parties, defined scope and deliverables, acceptance criteria, fees and how they may change, payment terms, service levels with remedies attached, confidentiality, data protection provisions where personal data is involved, intellectual property ownership and licences, warranties, liability caps and indemnities, insurance requirements, term and renewal mechanics with notice periods, termination rights, exit and transition assistance, and governing law. The relative importance varies by what is being bought — data terms dominate for software, scope and acceptance dominate for services.
Test the claim, because it is often only partly true. Large vendors with standardised products genuinely may not amend core terms at low contract values, but they frequently have pre-approved alternative positions on liability, data protection, and notice periods that are not offered unless asked for. Where terms truly cannot move, the remaining levers are commercial: shorter initial term, capped price escalation, a longer notice window, or exit assistance commitments. If none are available and the risk is material, that is information about whether to proceed.
There is no universal figure. Twelve months of fees is a common starting point in services and software, but the right answer depends on the loss the vendor's failure could cause relative to what they are paid. A vendor paid £40,000 a year who could cause a seven-figure data breach is the clearest case where fee-based caps are mismatched to risk, which is why data breach and IP infringement are frequently carved out of the cap or given separate, higher limits. The carve-outs usually matter more than the headline number.
Because the notice obligation lives in a clause inside a PDF rather than in any system that generates a reminder, and because the window is typically calculated from an effective date that may not match the signature date. The person who negotiated the agreement often knows the date and equally often has changed roles. The structural fix is extracting renewal and notice dates at the point of signature and calendaring them with enough lead time for a real decision, rather than relying on anyone remembering to reread the contract.
Legally, usually not — most contracts do not require writing. Practically, yes for anything involving recurring payment, access to systems or data, meaningful dependency, or intellectual property. For genuinely trivial one-off purchases, standard terms of sale are adequate. The threshold question is not really value but consequence: if you cannot easily answer what happens when this vendor fails, you need something written down.
HERO keeps vendor agreements structured after signature, so renewal windows, liability caps, service levels, and data obligations stay addressable through every amendment rather than flattening into a PDF. The question "what are we actually committed to with this supplier" becomes a lookup. Book a demo.