Draft for Tamir's review. Not published.
Commit only to what you can show
Measure uptime and accuracy on real traffic, even roughly, before you sign commitments with penalties. Define commitments you control apart from those that depend on model providers. Ask for a ramp period, a defined way to measure accuracy and penalties capped at a share of the fee.
Exclusivity needs limits: a short term, a narrow definition of the industry and the product, and minimum revenue that keeps it alive. Carve out existing customers. Without those terms, you sell your market for one contract.
Find the requirement behind the demand
Ask the customer's security team what their policy actually requires. A deployment demand is often met by a private endpoint. A region restriction may cover only some data, and their own audit can sometimes stand in for a missing certification for now.
You can usually give deployment in their environment and ownership of their data and outputs. Your base model, prompts and pipeline stay yours. Offer that improvements trained only on their data are theirs, while general improvements stay yours. Ask your counsel to check the terms against your investor agreements.
Depending on your seat
If you're on the board, ask for a plain statement of the worst-case exposure under each commitment and what insurance covers. Approve with limits management must obtain, and record the exposure you accepted. If deals keep failing at security review, require a plan built on the questions they failed on.
If you run technology, write down what you actually do: models and sources, data in and out, testing, monitoring and what happens on failure. Ask sales how many pipeline deals share a requirement, to decide between an exception and a product change.
What to check before you decide
- Measure current uptime and accuracy on real traffic before committing to either.
- Separate commitments you control from those that depend on model providers.
- Ask for a ramp period before penalties apply and a cap on total penalties.
- Define the industry, product scope, term and minimum revenue for any exclusivity.
- List every component a customer-hosted deployment would expose, and mark which contain your core IP.
- Get the customer's written policy on data location and certification, and the data classes it covers.
- Check your provider licenses and investor agreements against the terms you are asked to accept.
Questions people ask
Board must approve our largest enterprise contract with liabilities that could exceed our resources, what should we require?
Require a plain statement of the worst-case exposure under each commitment, the product's measured ability to meet the commitments, caps on liability and penalties, and insurance where available. Approve with limits management must obtain. It depends on which commitments the product can meet today and on what the customer's procurement will accept.
Our startup keeps losing enterprise deals at security review, what should the board require in management's plan?
Require a plan that starts from the questions deals actually fail on, closes the gaps that recur, and gets the documentation and a certification path with a named owner outside the core engineering team. Prioritize what moves the pipeline rather than the whole standard. It depends on which requirements recur across lost deals and on what the target customers accept as evidence.
Our first enterprise contract has uptime and accuracy commitments with penalties we've never measured, should I sign?
Measure before signing, even roughly, and commit only to what you can show plus a margin. Ask for commitments on what you control, a ramp period and penalties capped at a share of the fee. Enterprise buyers accept honest numbers more often than startups expect. It depends on how much of your uptime and accuracy depends on model providers you do not control.
A big customer offers a major contract in exchange for industry exclusivity, should we accept?
Accept only with limits: a short term, a narrow definition of the industry and the product, minimum revenue the customer must deliver to keep exclusivity, and carve-outs for existing customers. Exclusivity without those terms is a sale of the company's market for one contract. It depends on how much of your target market the customer's industry represents and on whether the contract alone funds the company.
Enterprise customer wants our AI product in their cloud and ownership of model improvements, what can we agree to?
Separate what you can give, such as deployment in their environment and ownership of their data and outputs, from what you cannot, such as rights to your base model, prompts and pipeline. Offer that improvements trained only on their data stay theirs, while general improvements stay yours. It depends on how your product is architected and on what the customer's security team actually needs.
Enterprise prospect asks for AI governance documentation we don't have, what do we actually need to write?
Write what you do, in plain documents: what the models are and where they come from, what data goes in and out, how you test, how you monitor, and what happens when it fails. Buyers accept short and true over long and aspirational. It depends on your buyers' sector and on which rules apply to their use of your product.
Enterprise deal stuck in security review over data region and a missing certification, what are our realistic options?
Ask the customer's security team what their policy actually requires, because a region restriction often applies only to certain data and a certification can sometimes be replaced by their own audit. Then price each option against the deal and the next deals like it. It depends on which data the product must process and on how many of your target customers share the requirement.
How I can help with this decision
- Ask or talk (Free)
- I give my view on which of the customer's terms are negotiable in practice and which ones carry the exposure. I tell you how to present numbers you can actually show.
- Review (Pay if it was worth it)
- I write an independent review of the contract's commitments against your product's measured performance, architecture and resources, for management or the board. I recommend what to sign, change or refuse.
- Retain (When it makes sense)
- I stay close as deals progress to review questionnaire responses, a regional move or a certification path against the commitments you made.