Somewhere in your contract with an AI vendor there is probably a clause about what happens when the software goes down. Is there one about what happens when the software acts? IDC's FutureScape 2027 predictions, released on 27 October 2026, say that by 2028 three quarters of Global 2000 vendor contracts will include liability clauses for agent-initiated actions, and that their absence will be treated as a red flag. Whether or not that number proves right, AI agent liability clauses are about to become a standard question in procurement.
What IDC actually predicted, and how to read it
Three predictions matter here. By 2028, 75 per cent of Global 2000 vendor contracts will include liability clauses for agent-initiated actions. By 2028, 70 per cent of those enterprises will be able to continuously verify decisions made by their AI agents, up from 14 per cent today. And enterprises without kill switches for production agents will face 25 per cent higher liability insurance premiums and twice as many material audit findings.
Treat these carefully. They are forecasts, not outcomes. They concern the largest global companies. IDC sells this research, and its release names only one analyst, so the figures cannot be independently checked. Meredith Whalen of IDC said the winners will be those that verify what each agent does as fast as they deploy it.
What this suggests is not that the percentages are precise. It is that buyers are starting to push agent risk back onto vendors, and that most organisations, on IDC's own figure of 14 per cent, cannot yet verify what their agents decide.
Why the contract is where agent risk lands
Most software contracts were written for software that does what it is told. An agent decides. It chooses a tool, a sequence and an action, and sometimes the action is wrong.
Imagine a vendor's procurement agent that reorders stock automatically. A supplier changes a unit of measure and the agent orders ten times the usual volume. Who pays for the excess stock? The contract says the vendor provides the service as described, you configured the thresholds, and liability is capped at twelve months of fees. Everyone is within their rights and you are still holding the stock.
That is the gap. Existing clauses on service levels and data breaches do not allocate responsibility for a decision.
What should an AI vendor contract include?
There is no single template, and you should get legal advice for your own situation. As a starting list for AI vendor contract terms, these are worth raising:
- Authority limits: what the agent can do, with what permissions and spending limits, and who can change them.
- Change notice: advance notice of model changes, version changes and behaviour changes that affect what the agent does.
- Logging and audit rights: access to records of what the agent did and why, in a form you can use.
- Suspension rights: the ability to stop the agent immediately, plus the vendor's duty to support it.
- Incident notification: a defined timeframe for the vendor to tell you when an agent misbehaves.
- Data handling: what is retained, what is used for training and what happens on exit.
- Liability allocation: who bears the loss for agent-initiated actions, and whether the cap reflects the realistic exposure.
- Subcontractors and concentration: which other models and providers sit underneath, and what happens if one fails.
Notice that several of these only work if you can see what the agent is doing. A clause that gives you audit rights is no use if nobody in your organisation is going to look.
What Australian regulators already expect
You do not have to wait for IDC's timetable. APRA's 30 April 2026 media release said AI risks should be managed under existing prudential standards and flagged entities relying heavily on a single provider for multiple AI use cases, with gaps in contingency planning. MinterEllison's 8 May summary of APRA's letter lists the supplier expectations: stronger contracts covering audit rights, model changes and data handling, and active management of concentration risk under CPS 230.
Those expectations apply to regulated entities. But they are a useful benchmark for any organisation negotiating AI vendor contracts in Australia, because they describe what a prudent buyer is expected to ask for.
What This Means for Your Organisation
What we see across organisations is that AI contracts are signed by procurement and legal using templates built for ordinary software, while the people who will live with the agent are not in the room. The result is a contract that is silent on exactly the questions that matter.
A sensible fix is a short agent addendum that procurement can attach to any AI contract. It does not have to be perfect. It has to exist, and it has to be reviewed by someone who understands what the agent will actually do.
Key Takeaways
- IDC predicts 75 per cent of Global 2000 vendor contracts will carry liability clauses for agent-initiated actions by 2028, but these are analyst forecasts and not observed outcomes.
- Standard software contracts do not allocate responsibility for decisions made by an agent, which is where AI agent liability clauses come in.
- Ask for authority limits, change notice, logging and audit rights, suspension rights, incident notification, data handling terms and clear liability allocation.
- APRA's published expectations on supplier contracts are a useful benchmark even for unregulated organisations.
How Trusenta Can Help
- Risk Management lets you record vendor and agent risks against owners and controls, so contract gaps show up before an incident does.
- Compliance Management maps obligations such as CPS 230 supplier expectations to the clauses and evidence that satisfy them.
- AI Governance Enterprise builds the policies, approval paths and procurement standards that give your contracts something consistent to enforce.
Conclusion
The question buyers will be asked in the next few years is unlikely to be whether the vendor's agent is clever. It will be what happens when the agent is wrong, and who has agreed to carry that. Writing the answer into the contract now, while you still have a bargaining position over a new agent, is a lot cheaper than finding out from an invoice.
