Review a SaaS Master Service Agreement for Traps — Auto-Renewal, Price Escalation, Data Portability

Download the practice files: case-file.txt — contains the full TerraSync MSA excerpts and Order Form. Paste into any AI tool to follow along.

---

It's 3:47 on a Wednesday. Your VP forwarded a 26-page PDF with a two-line note: "Vendor says terms are substantially the same as last year. Can you confirm and let's get this signed before we lose the renewal window?"

You paste the contract into your AI tool and type: "Review this contract and let me know if there are any concerns." Ninety seconds later, you have nine flagged risks, organized by severity, with clause references. Accurate. Well-organized. You forward the whole thing to your VP.

Her reply, twenty minutes later: "Ok — so are we good to sign, or not?"

That reply is the lesson.

You had a thorough risk analysis. You did not have an answer to the question she asked. She does not want nine risks. She wants to know what to do about them, in a sentence she can say to her own boss. Legal does not want a wall of text. They want to know which three clauses need their eyes, with the section numbers already pulled. The vendor does not respond to a risk list. They respond to a specific ask.

AI found the risks. It did exactly what you asked. Nobody asked it to turn those risks into something someone else could act on.

That conversion is the skill this lesson teaches.

---

The contract

Start with the Order Form.

$171/user/year for a full-suite spend-analytics platform. One line to follow: "Per MSA Section 11.2." The Order Form does not contain the renewal terms. It points somewhere else.

---

Layer 1: The renewal trap

Paste the MSA into your AI tool and ask a specific question. Not "review the contract." Something narrower.

Copilot · ChatGPT · Claude · Gemini — use this prompt:

I'm reviewing a SaaS MSA for a procurement platform (200 users, $34,200/year). Read Section 11 (Term and Termination). I need three specific facts: (1) How long is each renewal period? (2) How many days' notice is required to cancel, and what is the required delivery method — email, certified mail, or other? (3) Our internal renewal review process starts 60 days before term end. Will we have enough time to cancel if needed?

What AI finds

Section 11.2: 12-month auto-renewal periods. 90 days' written notice required. Delivery method: certified mail or nationally recognized overnight courier only. Not email.

Connect that to how your team works. If your renewal review starts at day 60, and the cancellation window requires 90 days' notice, you are already 30 days too late. The contract auto-renewed before you opened the file. And certified mail means even a team that catches the deadline at day 89 cannot just fire off an email. They need to physically send a letter via courier or USPS certified mail, which adds its own delivery lead time on top of the deadline.

That is finding number one.

One habit to build into every contract review from here on: run the same prompt on two AI platforms, not one. Not because either one is untrustworthy. Because they miss different things, and the gap between their answers is where the real risks hide. We tested this contract on four platforms. All four caught the obvious risks individually: the price floor, the certified-mail requirement, the data-export cost, the liability cap. Where they diverged was on a subtler finding — one that the rest of this lesson builds toward. The detailed comparison is in the Reference section at the end of this lesson.

Try it yourself

Paste the TerraSync MSA into your approved AI tool and run the Layer 1 prompt. If your team allows more than one tool, run it on both and compare the outputs. The goal is not to crown a winner. The goal is to confirm the method produces the required facts: renewal length, notice window, delivery method, and the mismatch with your 60-day review cycle. If the outputs differ on anything material, check the source clause before deciding which version is right.

---

Layer 2: The price floor

Stay in the same AI conversation.

Copilot · ChatGPT · Claude · Gemini:

Now read Section 5.3 (Annual Adjustment). This clause defines how subscription fees change at renewal. I need you to: (1) Identify the exact escalation mechanism — is it a fixed cap, CPI-linked, "market rate," or hybrid? (2) Calculate our annual subscription cost for Years 1, 2, and 3, assuming CPI runs at 3%. Show each year's calculation step by step. (3) Here is the critical question: does this clause cap the increase, or does it set a floor? Watch for "greater of" language carefully.

What AI finds

Section 5.3: "Subscription fees shall be adjusted annually by the greater of (a) CPI-U for the preceding twelve months, plus three percentage points, or (b) five percent per annum."

Most people stop here. They see "CPI" and feel protected. Inflation-linked pricing sounds fair.

Run the math.

• CPI = 3%: increase = greater of (3% + 3%) or 5% = greater of 6% or 5% = 6%
• CPI = 2%: increase = greater of (2% + 3%) or 5% = greater of 5% or 5% = 5%
• CPI = 0%: increase = greater of (0% + 3%) or 5% = greater of 3% or 5% = 5%

The 5% is not a cap. It is a floor. The CPI reference only activates when inflation exceeds 2%, and then it makes the increase worse, not better. In every scenario, the buyer pays at least 5%.

3-year cost projection at CPI = 3% (6% annual increase):

A true CPI cap at 3% would cost $105,709 over three years. The "CPI-linked" clause costs an extra $3,170. By Year 3, the annual fee is $4,227 higher than at signing. The buyer thought they were protected by the CPI reference.

Platform formatting varies. ChatGPT shows a table, Claude writes the calculation in prose, Gemini labels the floor explicitly, Copilot breaks the math into small steps. The method is the same: do not ask whether the clause is "reasonable." Ask which number wins under the "greater of" formula, then calculate the dollar result.

That is finding number two. It connects to finding number one.

---

Layer 3: The blind zone

Send this follow-up in the same conversation:

Copilot · ChatGPT · Claude · Gemini:

Read Section 5.3 and Section 11.2 together. Section 5.3 says the vendor notifies us of the fee adjustment "no later than sixty (60) days prior to the Renewal Term." Section 11.2 says we must give non-renewal notice "at least ninety (90) days prior." What is the gap between those two dates? What does this mean for our ability to make an informed renewal decision?

What AI finds

Ask two sections to be read together, and the AI connects them.

• Section 5.3: vendor notifies you of the new price at day 60 before renewal.
• Section 11.2: your deadline to cancel is day 90 before renewal.
• The gap: you must decide whether to stay or leave 30 days before you know how much staying will cost.

Day 90 deadline        Day 60 notification        Renewal
     |                        |                      |
     |--- 30-day blind zone --|                      |
     |                        |                      |
     Must decide              Vendor tells you       Term
     by here                  the new price          renews

This is not a drafting oversight. It is a design choice. You have two options: cancel blind before day 90 without knowing the renewal price, or wait for the price at day 60 and discover you are already locked in for another year.

Combined with the price floor from Layer 2, the auto-renewal is not an administrative annoyance. It is a mechanism that prevents informed decision-making.

This is what AI does well in contract review: it holds the entire document at once. You can tell it to compare two sections, and it checks one timeline against the other without losing the thread. In our four-platform test (2026-07-01), only ChatGPT caught this interaction on a generic "review the contract" prompt — its first-pass review named "the interaction between Sections 5.3 and 11.2" as the most critical issue. Claude flagged the 90-day notice clause and the certified-mail trap but did not connect it to the 60-day price disclosure; Gemini and Copilot listed the two clauses as separate line items. Three of four needed the directed question you just ran. That is exactly why this lesson teaches the specific cross-section question instead of relying on a single broad pass.

(Full first-pass exports, all four platforms: evidence/chatgpt-naive-2026-07-01-iab.txt, claude-naive-2026-07-01-iab.txt, gemini-naive-2026-07-01-iab.txt, copilot-naive-2026-07-01-iab.txt. Layer-by-layer exports: evidence/chatgpt-layer*-2026-07-01-iab.txt, claude-layer*-2026-07-01-iab.txt. Screenshots below are representative frames; the exports carry the full prompt and output.)

The same Layer 3 prompt also ran on Claude, Gemini, and Copilot. The wording differed, but the procurement conclusion held on all four: price notice at day 60, cancellation deadline at day 90, buyer decides 30 days before guaranteed price disclosure.

Try it yourself

Run the Layer 3 prompt on your own AI tool now. Did it find the 30-day blind zone? If your tool's first-pass "review this contract" already mentioned this gap, that platform is strong at cross-referencing. If it did not, that is exactly why this lesson teaches the specific two-section question.

---

Layer 4: The data cage

Now investigate what happens if you do cancel. This requires tracing a chain of definitions across multiple sections.

Copilot · ChatGPT · Claude · Gemini:

Read the data-related sections together — Sections 1 (definitions), 4 (ownership), and 8 (termination and data retrieval). I need a complete picture of what happens to our data if we leave: (1) What exactly can we export? Check the definition of "Customer Data" and identify what's excluded. (2) What format will the export be in — a named standard like CSV or JSON, or something the vendor defines? (3) How long do we have to retrieve our data after the contract ends? (4) Does the vendor keep any rights to our data after we leave?

What AI finds

You would expect "export your data" to mean all of it. It does not.

The contract splits your data into three categories, each with different rules. "Customer Data" (Section 1.2) is what your users uploaded or typed in. That part you can export. But two other categories are carved out.

"Analytics Data" (Section 1.3) covers the spend patterns, supplier scores, cycle times, and benchmarks generated from your usage. That stays with the vendor.

"Workflow Configurations" (Section 1.5) covers the dashboards, approval chains, spending rules, and scorecards your team built over the past year. Section 4.5 says these are "not independently portable." Section 8.2 confirms both exclusions from export.

What can you actually export? Raw transaction data. Purchase orders, invoices, supplier records. Everything your team built on top of that data stays with the vendor.

A category manager who asks "can we export our data?" gets a technically correct yes from the AI, because Section 8.1 does allow exporting "Customer Data." But nobody asked the AI to check what "Customer Data" actually includes. The dashboards and approval workflows the team spent a year building are not in that definition.

The format. Section 8.1: data is available in "Provider's then-current standard machine-readable format." That is not CSV. That is not JSON. That is whatever the vendor decides. Section 8.3: converting to a standard format costs $250/hour, estimated 30-60 hours. That is $7,500 to $15,000 in exit costs that appear nowhere in the pricing table.

The window. Post-termination retrieval: 30 calendar days (Section 8.3). Before you accept that number, put it next to what a migration for 200 users actually involves: mapping supplier hierarchies, recreating approval flows, validating historical spend data. Ask your implementation team how long that takes on your stack — timelines vary by platform and data volume. If their answer is longer than 30 days, the retrieval window closes before the migration finishes. After 30 days, your data is deleted from production systems (Section 8.4). No deletion certification. No confirmation.

The liability cap. One more number to check: Section 9.1 caps the vendor's total liability at fees paid in the preceding six months. On a $34,200/year contract, that is roughly $17,100. If this platform fails during a critical sourcing cycle, that cap is the ceiling on what the vendor owes you. A 12-month cap (~$34,200) is a reasonable negotiation target. Section 9.2 also excludes "procurement disruption" from consequential damages — worth flagging for legal.

What the vendor keeps after you leave. The spending patterns, supplier scores, and cycle times your team generated become the vendor's property. Section 4.3 gives the vendor permanent ownership of all Analytics Data. Section 8.5 says those rights survive termination. The vendor can use it for benchmarking, product development, and publishing anonymized reports. Your data feeds their product after you cancel.

---

The pivot: from analysis to instruction

You now have four problems, each with clause numbers and dollar figures:

The clock. 90 days to give certified-mail notice. Your review cycle starts at 60. By the time you open the file, the window is already closed.

The ratchet. At least 5% annual increase, compounding. You find out the new price at day 60, 30 days after you needed to decide. By Year 3, the fee has grown by $4,227 from signing.

The cage. Even if you cancel in time, switching costs $7,500-$15,000 in format conversion. Your configurations do not transfer. If your team's migration takes longer than the contract's 30-day retrieval window — ask them before you sign — your data is gone before the move finishes. And the vendor keeps your anonymized procurement patterns indefinitely.

The cap. If the platform fails during a critical sourcing cycle, the vendor's maximum liability is roughly $17,100. Six months of fees on a $34,200 contract.

That analysis is worth nothing to anyone except you.

Recall the opening: nine risks, forwarded as-is, and a VP reply that amounted to "so what do I do with this?" The analysis was right. It was not yet a work product anyone could use. Your VP cannot approve or reject based on it. Legal cannot act on it. The vendor will not respond to it.

AI will not convert analysis into instruction unless you tell it to, for a specific audience. A risk list is information. Legal needs a question list. Your VP needs a decision. The vendor needs a counter-offer. Three audiences, three deliverables, none of which look like the risk table you started with.

What makes each deliverable work

Legal question list. Not "please review this contract." Legal gets that request fifty times a week and it goes to the bottom of the pile. Instead: "The vendor sets the price-notification deadline 30 days after our cancellation window closes. Does that timing create a problem we can raise in negotiation?" A question scoped that narrowly gets answered same-day, because it is clear what expertise is being asked for.

VP briefing. Your VP does not want to read nine risks and rank them herself. She wants: "If we sign as-is, we're locked into a 6% minimum annual increase and a $7,500-$15,000 exit cost if we ever want to leave. If we get the price clause capped at 4% and the notice-timing gap fixed, we save roughly $3,170 over three years and keep our ability to walk away." That is a decision she can approve in two minutes.

Negotiation position. Not every finding gets equal weight. The price floor and the timing gap have hard dollar evidence behind them. Lead with those. The liability cap is a smaller ask with a clean counter (raise it from 6 to 12 months), useful for trading away if the vendor pushes back elsewhere.

Try it yourself — Legal question list

Using the three risks I've identified in this MSA — the timing gap between Section 5.3 (60-day price notice) and Section 11.2 (90-day cancellation deadline), the price floor in Section 5.3, and the data-portability exclusions in Sections 8.1-8.5 — draft an email to our internal legal team. For each risk, phrase a specific, scoped question referencing the exact section number, not a general "please review" request. The goal is a question legal can answer same-day because it's narrow enough to act on immediately.

Run this yourself. Could the output go straight to your legal team without you rewriting it? If the questions still read like "is this OK?" instead of something scoped and specific, add "make each question answerable in one sentence" and run it again.

Try it yourself — VP briefing

Using the 3-year cost projection from the Section 5.3 analysis ($34,200 → $36,252 → $38,427, a $3,170 premium over a true CPI cap) and the three risks identified in this MSA, draft a one-page briefing for my VP. Use "if we sign as-is, then X; if we negotiate Y, then Z" framing for each major risk. Every "if...then" statement needs a dollar figure or a specific consequence attached — no vague language like "this could be costly." End with a one-sentence recommendation.

Run this yourself. Could your VP approve or reject in two minutes, without asking you to translate? That is the bar.

---

The deliverable: counter-proposal, fully worked

One more prompt. This is the proof that the pivot works.

Copilot · ChatGPT · Claude · Gemini:

Using the three risks you've identified — auto-renewal terms (Section 11.2), price escalation (Section 5.3), and data portability (Sections 8.1-8.5) — draft a counter-proposal email I can send to Grant Harada, the vendor's account manager. For each risk, propose specific amendment language with section references. Use the dollar figures from the cost projection as supporting evidence. Include the 6-month liability cap (Section 9.1, $17,100) as a fourth point, and propose raising it to a 12-month cap ($34,200). Keep the tone professional but firm.

What AI produces

A ready-to-send email. It references specific clause numbers. It cites the 3-year cost projection. It proposes concrete alternative language:

• Reduce notice period from 90 to 30 days; accept email with read receipt (Section 11.2)
• Replace "greater of CPI+3% or 5%" with a flat 4% annual cap; move price notification from day 60 to day 120 so the buyer knows the price before the cancellation deadline (Section 5.3)
• Specify CSV or JSON export format; extend post-termination retrieval from 30 to 90 days; include Workflow Configurations in export scope; remove or cap the $250/hour conversion fee (Sections 8.1-8.5)
• Increase liability cap from 6 months to 12 months of fees ($17,100 to $34,200); remove "procurement disruption" from the consequential damages exclusion (Section 9.1-9.2)

The risk analysis fed directly into the negotiation brief. Same conversation. Same context. AI used the clause numbers, dollar amounts, and severity it found in Layers 1 through 4 to build the counter-proposal. You did not re-explain the findings or re-paste the contract.

On the left: a general "review this contract" prompt produced a clean, accurate risk table. On the right: the layered investigation produced a decision-ready package with a timeline, dollar figures, and a counter-proposal. Both came from the same AI reading the same clauses. The gap between the two columns is not information. It is whether the output is something a colleague can act on without you translating it first.

---

Running this on your own contract

The investigation protocol works on any SaaS MSA.

Step 0 — Verify. Run your first read on two AI platforms, not one. Where they agree, that is your highest-priority list. Where only one flags something, check the clause yourself. Where neither flags something that still feels wrong, trust that instinct and dig.

Step 1 — The clock. Check Term and Termination: renewal period, notice window, notice method. Compare the notice window to your team's actual review cycle. If the window is longer than your review cycle, you will miss it.

Step 2 — The ratchet. Check Fees and Payment: escalation mechanism. Run the 3-year cost projection. If you see "greater of," one of those numbers is a floor. Ask: in what scenario does this clause reduce my cost increase? If the answer is "never," it is a floor disguised as a cap.

Step 3 — The blind zone. Read the price notification timeline alongside the cancellation deadline. If the vendor tells you the price after your cancellation window closes, the renewal decision is blind.

Step 4 — The cage. Trace the data definitions: what is "Customer Data," what is excluded, what format is the export, how long is the retrieval window? Calculate the exit cost. If the export excludes configurations and the format is undefined, switching is more expensive than it appears.

Step 5 — Convert. This is the step most reviewers skip. Turn your findings into three deliverables for three audiences: a scoped question list for legal, an if/then briefing with dollar figures for your VP, and a prioritized counter-proposal for the vendor. Ask AI to draft each one using the context from the same conversation. You should not need to re-paste the contract or re-explain the findings.

---

Check

Verification points

Before you consider this exercise complete, confirm your AI output includes all of the following:

• Ran the Layer 1 prompt on at least two AI platforms and compared outputs for disagreement
• Section 11.2 identified: 12-month auto-renewal, 90-day notice by certified mail or overnight courier only
• The 90-day window flagged against the buyer's 60-day review cycle as a timing mismatch
• Section 5.3 flagged as a price floor (minimum 5%), not a cap — with math showing: at CPI = 3%, increase = 6%, not 3%
• 3-year cost projection calculated: $34,200 (Year 1) / $36,252 (Year 2) / $38,427 (Year 3) at CPI = 3%
• Timing asymmetry between Sections 5.3 and 11.2 identified: price notification at day 60, cancellation deadline at day 90 — buyer decides 30 days before knowing the price
• Section 8.2 exclusion of Workflow Configurations from export flagged — dashboards, approval chains, scorecards not exportable
• "Provider's standard machine-readable format" (Section 8.1) flagged as undefined — not a named standard
• $250/hour format-conversion fee (Section 8.3) identified with total estimate: $7,500-$15,000
• 30-day post-termination retrieval window checked against your own team's migration timeline (your implementation team owns that number — the contract closes the window whether or not the move is done)
• Sections 1.3, 4.3, and 8.5 connected: vendor retains perpetual rights to Analytics Data including spend patterns and supplier scores
• Section 9.1 liability cap at 6 months ($17,100) flagged, with a 12-month cap ($34,200) proposed as a negotiation target
• Drafted a legal question list with specific clause references, scoped so each question is answerable in one sentence
• Drafted a VP briefing using if/then framing with dollar figures pulled from the Layer 2 cost projection
• Counter-proposal email includes specific amendment language with clause references for at least three risk areas

The common mistake

Stopping at the risk list. A single "review this contract" prompt will very likely get most of these findings. The failure mode is not missing risks. It is forwarding that list, as-is, to a VP who needs a decision, to legal who needs a scoped question, or to a vendor who needs a specific ask. A complete risk list and a decision-ready instruction are two different work products. Only one moves the deal forward.

Deliverable

A flagged-risk summary table with clause references, severity ratings, dollar impact, and recommended redline positions, organized by risk category (auto-renewal, price escalation, data portability, liability). A legal question list scoped to be answerable same-day. A one-page VP briefing in if/then format with dollar figures. A counter-proposal email with specific amendment language. The five-step protocol works on any SaaS MSA: paste in the new contract, adjust the context (user count, annual fee, review timeline), and run the same sequence.

Homework

Pick a real SaaS agreement your team has on file, or use a publicly available SaaS template from the vendor's website. Run the five-step investigation protocol. Your deliverable has three parts:

1. Risk interaction map. Identify at least two clauses that interact to create a risk neither clause creates alone. Draw the connection: which section references which, what timing or definition creates the interaction, what the combined impact is. This lesson found the 30-day blind zone by reading Sections 5.3 and 11.2 together. Your contract will have its own version: a data retention clause that interacts with an indemnification clause, a termination provision that conflicts with an SLA credit timeline, or a definition in Section 1 that quietly carves out something you assumed was included.

2. The pivot, on your own contract. Using the risks you found, draft all three deliverables: a legal question list with specific clause references (scoped so each question is answerable same-day), a one-page VP briefing in if/then format with at least one dollar figure, and a counter-proposal email with specific amendment language. All three should be ready to send to their actual recipient without you rewriting them first.

3. Screenshot your cross-platform check. Run your first-pass prompt on two AI platforms and screenshot both outputs. Annotate: where did they agree, where did they diverge, and which finding (if any) did you have to verify by hand because only one platform caught it? Redact any confidential terms or vendor names, then post your annotated screenshots and risk interaction map to the group — that submission is the completion criterion for this lesson.

Monday morning, you tell your boss: "AI found three interacting traps in the TerraSync MSA — a 5% minimum annual price floor disguised as CPI protection, a 90-day certified-mail notice window that closes before we even start reviewing, and data export restrictions that would cost $7,500-$15,000 to switch vendors. I've already turned that into a legal question list, a one-page briefing for you with the dollar impact of signing as-is versus negotiating, and a clause-by-clause counter-proposal ready to send to the vendor."

---

Reference

Platform notes

Copilot note: the free tier may truncate long inputs. If the output does not mention the certified-mail requirement or the CPI+3% formula, paste only Sections 5 and 11 and re-ask specifically.

Troubleshooting

When your AI output misses something, these are the most common gaps and the fix prompts that close them.

Decision modes

This exercise trains three of the four decision modes:

Discover — "What's in here I haven't seen?" The MSA contains risks that do not look like risks on a casual read. The "CPI + 3%" clause looks protective but sets a floor. The "standard machine-readable format" sounds adequate but is undefined. The "Customer Data" definition quietly excludes two categories of data the team created on the platform. And the timing gap between Sections 5.3 and 11.2 is invisible unless you read both sections together. Discovery here means tracing definitions across sections, checking timing clauses against each other, and running the math.

Validate — "Does the data support or challenge my view?" The VP's assumption is "terms are substantially the same — let's sign." The risk analysis either supports that view or challenges it with evidence: a 3-year cost projection showing $3,170 in avoidable escalation, a notice window that does not match the internal review cycle, and a data-portability clause that creates $7,500-$15,000 in switching costs. Validation also means using a second AI platform as a cross-check.

Synthesize — "Turn this into one clear output for someone else." The pivot section is this mode in practice: taking a risk list that lives in your head and your chat window, and converting it into three deliverables for three audiences. A legal team that needs a scoped question, a VP who needs a two-minute decision, and a vendor who needs a specific counter-offer. The analysis alone does not move the deal forward. The synthesis does.