# AI automation contract topic checklist

This is implementation guidance for scoping and legal review, not legal advice.

## Outcome and scope
- Business outcome, baseline and measures
- Workflow trigger, inputs, outputs, systems and users
- Permitted actions, approvals and prohibited actions
- Supplier and customer responsibilities
- Volumes, environments, languages, locations and exclusions

## Data and privacy
- Parties' roles and processing purposes
- Data categories, people affected and locations
- Model-training use, subprocessors and change notice
- Retention, backup, export and verified deletion
- Rights assistance, impact assessments and incident notice

## Evaluation and acceptance
- Representative and critical test cases
- Success, policy, tool-use, grounding, escalation, latency and cost measures
- Acceptance thresholds and evidence format
- Repair, retest, scope-reduction and termination remedies
- Regression obligations after material change

## Security and authority
- Distinct identity and least-privilege permissions
- Secret management and environment separation
- Approval gates, logs and emergency suspension
- Vulnerability handling and security testing

## Operations and commercial terms
- Monitoring, severity, support, containment and recovery
- Change classification for model, prompt, tool and provider updates
- Included volumes, overages, third-party costs and budget controls
- Ownership and licences for workflow logic, prompts, connectors and tests

## Exit
- Export formats and transition assistance
- Continuity during migration
- Credential and integration revocation
- Deletion evidence across active systems, subprocessors and backups