Why Agentic AI makes human judgment more important

For years, legal and procurement teams have reviewed software-as-a-service agreements against familiar issues: data protection, liability caps, indemnification, termination rights, and security obligations. We have technology capable of identifying those provisions and flagging deviations from an organisation’s preferred positions. Yet, agentic AI presents a challenge to the way we review technology contracts; thus, in the age of agentic AI, human judgment is becoming more important to contract review.

Agentic AI can plan, invoke tools, interact with systems, and take multi-step actions with limited human intervention. Those capabilities can change what a SaaS product does, what information it accesses, and the consequences when something goes wrong. A provision that was reasonable when the agreement was negotiated may carry a very different risk profile six months later. The contractual language has not necessarily changed. The technology underneath it has.

While AI can identify a clause, compare language against a playbook, and flag a limitation of liability set at one year’s fees instead of two, what it cannot do in isolation is answer questions about the deal’s risk profile. That requires context, judgment, and increasingly, technical fluency.

“Improving the Services” Now Includes AI Development

Consider a familiar provision: the vendor may use customer data to “provide, maintain, support, and improve the services.” Historically, “improve” might have meant diagnostics, troubleshooting, or aggregated product analytics. In an AI-enabled product, it may include training, fine-tuning, evaluating, or otherwise developing machine-learning models. That distinction matters.

A customer may be comfortable allowing operational telemetry to improve product performance while strongly objecting to confidential business information, employee data, intellectual property, or privileged material being incorporated into model development. Yet broad contractual language may not distinguish between those activities; counsel needs to understand what the product actually does with the data.

Termination presents another complication. Traditional contractual thinking assumes that data can eventually be returned or destroyed, but model training disrupts that assumption. Once data has influenced a model, deleting the underlying dataset does not necessarily remove what the model has learned, and machine-unlearning techniques remain technically challenging and difficult to verify. Deletion language alone cannot resolve these issues. Commercial counsel must be involved at the deal-strategy stage, when understanding the architecture, use case, and data flows can still shape the deal and bring the right technical and business stakeholders to the negotiating table.

Upgrade Clauses Can Affect AI Governance

The same problem appears in product-modification provisions where broad vendor rights to update services make commercial sense. Yet, when an AI agent can draft, classify, move, transmit, or otherwise act on information, logging is no longer merely administrative; it may become the organisation’s primary and perhaps only evidence of what the agent did, what information it accessed, and where human intervention occurred.

Alongside a standard modification clause, a vendor may shorten its log-retention period, move detailed audit functionality to a more expensive subscription tier, change which actions are recorded, or introduce agentic capabilities without providing corresponding governance controls. Where logging, security, or auditability is material to the customer’s governance or regulatory obligations, the contract should reflect that reality through commitments against material degradation, notice of significant changes, or termination rights where critical functionality is removed.

Recognising that risk requires understanding the relationship between the contractual right to modify the service and the organisation’s dependence on specific technical functionality. That is a judgment exercise.

New AI Features Can Create New Data Flows

Agentic AI also complicates subprocessor provisions. Many AI capabilities are supported by third-party model providers, so turning on a feature may introduce a new subprocessor, transfer customer information to another provider, change where information is processed, or create a new international data flow. AI allows a product’s data-processing architecture to change at the feature level, even where the contract permits new subprocessors through a standard notice-and-objection process.

Under the UK and EU GDPR, organisations must accurately describe processing activities, satisfy transparency obligations, and establish appropriate mechanisms for international transfers. The EU AI Act imposes additional transparency and human-oversight obligations for certain AI systems and use cases. Those obligations become considerably harder to manage when the organisation does not know that a new AI provider has entered its technology stack.

Reviewing the subprocessor clause alone is insufficient. Counsel should understand whether AI features introduce additional model providers or data flows, whether they are enabled by default, and whether the customer controls activation. Depending on the use case, feature-specific disclosure and affirmative notice may matter far more than a generic update to a subprocessor list. The issue is not simply what the clause says. It is what the technology allows the clause to permit.

The Negotiated Contract May Not Govern AI Changes

AI functionality is increasingly governed through supplemental product terms, AI addenda, online policies, or terms presented when an administrator activates a feature. Those documents may contain separate data-use rights, additional disclaimers, model-provider flow-down terms, or conflicting order-of-precedence provisions stating that the supplemental terms control in the event of a conflict.

The result can be striking: Legal spends weeks negotiating protections in the master agreement, while an administrator later activates an AI feature subject to terms that Legal never reviewed.

The solution is partly contractual. The master agreement should establish a clear order of precedence and supplemental terms should not be able to expand data-use rights or materially reduce negotiated protections without agreement. URL-based terms should either be fixed as of a particular date or subject to meaningful change controls. Counsel must understand and review the complete document stack, how new features are activated, who within the organisation has authority to accept additional terms, and whether the technical controls actually align with the contractual ones.

A contract-review tool can identify conflicting language once it has the documents. Human judgment is what asks at the outset whether there are other documents.

Counsel Must Account for How the Technology Works

Counsel must understand what the product does today, what is on the roadmap, and what happens to data when an AI feature is enabled: which models receive it, which third parties become involved, what actions the system can take without human intervention, and what evidence the organisation will retain. Counsel must also identify which protections depend on technical configurations or subscription tiers and how post-signature product changes may affect them.

This analysis requires lawyers to connect contractual language to technical reality and requires commercial counsel to be involved earlier in the deal cycle. Earlier engagement allows counsel to determine whether an AI feature should be enabled, whether another tier provides necessary audit functionality, whether the architecture creates an unacceptable data flow, and which protections matter for the intended deployment. Legal becomes part of shaping the deal rather than papering decisions already made.

Human Judgment Is the Control Layer

There is understandable enthusiasm around using AI to make contract review faster, and much of that enthusiasm is warranted. Yet speed is not the same as judgment. The emerging challenge is recognising when familiar language has acquired an unfamiliar consequence because the technology underneath it has changed.

A limitation of liability is only meaningful when we understand the exposure being limited. A data-use clause is only meaningful when we understand where the data goes. An audit provision is only meaningful when we understand what the system records. A subprocessor clause is only meaningful when we understand who is actually processing the information, and an indemnity is only meaningful when we understand what the technology can create and what the organisation intends to do with it.

In the age of agentic AI, human judgment is the control layer, but it depends on knowing how the technology works. That technical fluency activates the context and judgment required to understand the deal, not merely read the contract.