{"id":3870,"date":"2026-09-08T08:26:47","date_gmt":"2026-09-08T08:26:47","guid":{"rendered":"https:\/\/sawaryn.com\/?p=3870"},"modified":"2026-10-23T11:34:26","modified_gmt":"2026-10-23T11:34:26","slug":"negotiating-it-implementation-contracts","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/negotiating-it-implementation-contracts\/","title":{"rendered":"IT Contracts That Keep Projects on Track: Negotiate Without Chaos or Disputes"},"content":{"rendered":"<p>Your ERP vendor has sent over a draft agreement. Forty-eight pages. The project manager says to sign because the project is running late. The CFO asks about penalties. The CTO says nobody reads it anyway. You know that in six months this agreement will determine who is responsible for a delayed go-live.<\/p>\n<p>Sound familiar? If so, this article is for you.<\/p>\n<p>An <strong>IT contract<\/strong> is not a formality to file away. It is a project-management tool that organizes cooperation, allocates risk and gives both parties predictability. A poorly negotiated <strong>implementation agreement<\/strong> creates direct costs, such as contractual penalties, renegotiations and disputes; operational costs, such as delays, downtime and duplicated maintenance costs; and strategic costs, such as vendor lock-in, loss of code rights and blocked product development.<\/p>\n<p>Studies indicate that about 25% of IT projects in Poland fail, and the figure reaches 20% for ERP implementations. With contract values measured in millions of z\u0142oty, losses can be substantial.<\/p>\n<p>This article explains how to negotiate an <strong>IT contract<\/strong> that organizes work with a vendor instead of generating disputes. It covers five areas to settle before signing, how the AI Act changes agreements for AI tools and practical steps for both customers and vendors.<\/p>\n<h2>Key terms before we begin<\/h2>\n<p>Before getting into the details, it helps to clarify a few terms used throughout the article.<\/p>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">Term<\/th>\n<th style=\"text-align: left;\">Meaning<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Contract for a specific work<\/strong> (Article 627 of the Polish Civil Code)<\/td>\n<td>An obligation to deliver a defined result, such as a working system. The customer has statutory warranty rights for defects. Claims become time-barred 2 years after delivery of the work.<\/td>\n<\/tr>\n<tr>\n<td><strong>Service agreement<\/strong> (Article 750 of the Polish Civil Code)<\/td>\n<td>An obligation to perform services with due care, not to deliver a specific result. There is no statutory warranty for defects. The limitation period is 3 years.<\/td>\n<\/tr>\n<tr>\n<td><strong>Change request<\/strong><\/td>\n<td>A formal process for submitting and approving changes to project scope while work is underway.<\/td>\n<\/tr>\n<tr>\n<td><a href=\"https:\/\/sawaryn.com\/en\/publikacje\/sla-agreement-key-terms-and-service-levels\/\"><strong>SLA (service-level agreement)<\/strong><\/a><\/td>\n<td>A document setting measurable service-quality parameters, such as availability, response time and repair time.<\/td>\n<\/tr>\n<tr>\n<td><strong>Vendor lock-in<\/strong><\/td>\n<td>Dependence on one technology provider, where switching is costly or technically difficult because data migration and termination rules are unclear.<\/td>\n<\/tr>\n<tr>\n<td><strong>Provider\/deployer<\/strong> (under the AI Act)<\/td>\n<td>A provider creates and places an AI system on the market. A deployer uses an AI system under its authority.<\/td>\n<\/tr>\n<tr>\n<td><strong>Exit plan<\/strong><\/td>\n<td>A plan for ending cooperation with a vendor, including data migration, documentation handover, source-code access and service continuity.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Why an IT contract is not just a legal document, but a project-management tool<\/h2>\n<p>Negotiating IT agreements requires legal, business and technology skills. If only a lawyer is at the negotiating table, the agreement may be formally correct but fail to reflect the project\u2019s realities. If only a project manager is there, the arrangements may be operational but unenforceable.<\/p>\n<h3>The problem with arrangements made \u201cover email and calls\u201d<\/h3>\n<p>A typical scenario looks like this: business, IT, procurement and the vendor agree on working arrangements in meetings and correspondence. Each party speaks a different language. The agreements are scattered across emails, Slack messages and meeting notes. Then the project enters a difficult phase and nobody knows exactly what was agreed or who is responsible for what.<\/p>\n<p><strong>The contract should bring these perspectives together in one predictable model of cooperation.<\/strong> The point is not to make an 80-page document. It is to answer the questions that will arise in 3, 6 or 12 months, when the project is delayed, the scope changes and the relationship is no longer as comfortable as it was at the beginning.<\/p>\n<h3>Why the legal classification of an agreement matters<\/h3>\n<p>Polish law has no statutory definition of an \u201cIT implementation agreement.\u201d Courts classify these contracts as unnamed agreements combining elements of a contract for specific work, a service agreement and a license. This is not an academic detail. Classification affects:<\/p>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">Element<\/th>\n<th style=\"text-align: left;\">Contract for specific work<\/th>\n<th style=\"text-align: left;\">Service agreement<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Nature of the obligation<\/td>\n<td>A result, such as a working system<\/td>\n<td>Due care, such as support or maintenance<\/td>\n<\/tr>\n<tr>\n<td>Ending the agreement<\/td>\n<td>Withdrawal, with retroactive effect<\/td>\n<td>Termination, with effect going forward<\/td>\n<\/tr>\n<tr>\n<td>Liability for defects<\/td>\n<td>Statutory warranty (Article 638 of the Polish Civil Code)<\/td>\n<td>General liability (Article 471 of the Polish Civil Code)<\/td>\n<\/tr>\n<tr>\n<td>Limitation period for claims<\/td>\n<td>2 years from delivery of the work<\/td>\n<td>3 years<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The Gda\u0144sk Court of Appeal (case I ACa 1054\/14) classified an agreement to implement a computer system as a contract for specific work because its purpose was to achieve a defined result: a functioning system meeting the customer\u2019s requirements. In case XIII GC 1603\/17, the court divided the contract into implementation work and service work.<\/p>\n<p><strong>What this means for your business:<\/strong> If your agreement does not specify which elements are \u201cwork\u201d (configuration, integration and acceptance) and which are \u201cservices\u201d (maintenance, support and SLA), a court may decide how to classify them in a dispute. That classification affects warranty rights, limitation periods and whether you can withdraw with retroactive effect.<\/p>\n<h2>Five areas to regulate in an IT contract<\/h2>\n<h3>1. Scope of work and change management<\/h3>\n<p>The most common cause of implementation disputes is an imprecise functional scope. The vendor understands it differently from the customer, the project manager differently from the CTO, and the CFO differently from everyone else.<\/p>\n<p><strong>The agreement should include:<\/strong><\/p>\n<ol>\n<li>A detailed scope, not merely \u201cERP implementation,\u201d but specific modules, functions, integrations and exclusions.<\/li>\n<li>A schedule with milestones linked to payments and acceptance procedures.<\/li>\n<li>A change-request process specifying who submits, estimates and approves a change, and its effect on schedule and budget.<\/li>\n<li>A definition of \u201cdone\u201d describing when a stage is complete and what acceptance criteria each deliverable must meet.<\/li>\n<li>A roles-and-responsibilities matrix identifying who makes each decision for the customer and vendor.<\/li>\n<\/ol>\n<p>No clear change-request procedure is a time bomb. Scope always changes. If the contract does not say how to handle changes, the vendor may impose delay penalties for changes caused by the customer, while the customer may argue that they were within scope.<\/p>\n<h3>2. Acceptance and testing procedure<\/h3>\n<p>Acceptance is when the customer confirms that the vendor has delivered what it agreed to deliver. It may also determine when VAT becomes payable and when a limitation period begins.<\/p>\n<p><strong>The agreement should include:<\/strong><\/p>\n<ol>\n<li>Measurable, verifiable acceptance criteria agreed before work starts.<\/li>\n<li>A testing procedure: who tests, in which environment, using which scenarios, and what error threshold is acceptable.<\/li>\n<li>An acceptance protocol specifying the form, time for comments and consequences of no response, including deemed acceptance.<\/li>\n<li>A distinction between critical, major and minor defects and how each affects acceptance.<\/li>\n<li>A conditional-acceptance procedure for a functioning system with non-blocking defects.<\/li>\n<\/ol>\n<h3>3. Intellectual property rights and code access<\/h3>\n<p>Polish <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/copyright-law-it-industry-poland\/\">copyright law<\/a> narrowly defines statutory grounds for using computer programs in B2B relationships. Apart from limited exceptions, the agreement is the only basis for lawful software use.<\/p>\n<p><strong>Regulate:<\/strong><\/p>\n<ol>\n<li>Whether economic copyright is transferred or a license is granted, and for which fields of exploitation.<\/li>\n<li>Source-code access: whether you receive the code, it is held in escrow, or the vendor retains it.<\/li>\n<li>Rights to project documentation, specifications and materials created during the project.<\/li>\n<li>Modification rights, including whether you may hire another vendor to develop the software without the original contractor\u2019s consent.<\/li>\n<li>The legal status of open-source components and third-party libraries used in the project.<\/li>\n<\/ol>\n<p><strong>For projects involving AI:<\/strong> AI-generated outputs, such as images, text or code, may not qualify for copyright protection if there is no human author. For work created with AI assistance, assess whether the human contribution is creative and the result individual. The agreement should address the status of these outputs.<\/p>\n<aside class=\"blog-article__inline-newsletter blog-article__inline-form flow\" aria-label=\"Article form\">\r\n                    <div class=\"blog-article__inline-newsletter-head flow\">\r\n                                    <h2>Ask us to audit your existing IT contracts<\/h2>\r\n                                                    <p>Write to us and we will get back to you.<\/p>\r\n                            <\/div>\r\n                <div class=\"form form--cf7 blog-article__newsletter-form blog-article__inline-form-form\">\r\n            \n<div class=\"wpcf7 no-js\" id=\"wpcf7-f2368-o1\" lang=\"pl-PL\" dir=\"ltr\" data-wpcf7-id=\"2368\">\n<div class=\"screen-reader-response\"><p role=\"status\" aria-live=\"polite\" aria-atomic=\"true\"><\/p> <ul><\/ul><\/div>\n<form action=\"\/en\/wp-json\/wp\/v2\/posts\/3870#wpcf7-f2368-o1\" method=\"post\" class=\"wpcf7-form init\" aria-label=\"Contact form\" novalidate=\"novalidate\" data-status=\"init\">\n<fieldset class=\"hidden-fields-container\"><input type=\"hidden\" name=\"_wpcf7\" value=\"2368\" \/><input type=\"hidden\" name=\"_wpcf7_version\" value=\"6.1.7\" \/><input type=\"hidden\" name=\"_wpcf7_locale\" value=\"pl_PL\" \/><input type=\"hidden\" name=\"_wpcf7_unit_tag\" value=\"wpcf7-f2368-o1\" \/><input type=\"hidden\" name=\"_wpcf7_container_post\" value=\"0\" \/><input type=\"hidden\" name=\"_wpcf7_posted_data_hash\" value=\"\" \/>\n<\/fieldset>\n<div class=\"blog-article__inline-form-fields\">\n\t<p><label class=\"blog-article__inline-form-field\"><br \/>\n<span class=\"blog-article__inline-form-label\">First and last name<\/span><br \/>\n<span class=\"wpcf7-form-control-wrap\" data-name=\"article-form-name\"><input size=\"40\" maxlength=\"400\" class=\"wpcf7-form-control wpcf7-text wpcf7-validates-as-required blog-article__inline-form-input\" autocomplete=\"name\" aria-required=\"true\" aria-invalid=\"false\" placeholder=\"Jan Kowalski\" value=\"\" type=\"text\" name=\"article-form-name\" \/><\/span><br \/>\n<\/label>\n\t<\/p>\n\t<p><label class=\"blog-article__inline-form-field\"><br \/>\n<span class=\"blog-article__inline-form-label\">E-mail<\/span><br \/>\n<span class=\"wpcf7-form-control-wrap\" data-name=\"article-form-email\"><input size=\"40\" maxlength=\"400\" class=\"wpcf7-form-control wpcf7-email wpcf7-validates-as-required wpcf7-text wpcf7-validates-as-email blog-article__inline-form-input\" autocomplete=\"email\" aria-required=\"true\" aria-invalid=\"false\" placeholder=\"jankowalski@xyz.com\" value=\"\" type=\"email\" name=\"article-form-email\" \/><\/span><br \/>\n<\/label>\n\t<\/p>\n<\/div>\n<p><label class=\"blog-article__inline-form-field\"><br \/>\n<span class=\"blog-article__inline-form-label\">Message<\/span><br \/>\n<span class=\"wpcf7-form-control-wrap\" data-name=\"article-form-message\"><textarea cols=\"40\" rows=\"10\" maxlength=\"2000\" class=\"wpcf7-form-control wpcf7-textarea blog-article__inline-form-textarea\" aria-invalid=\"false\" placeholder=\"Tell us briefly what you need...\" name=\"article-form-message\"><\/textarea><\/span><br \/>\n<\/label>\n<\/p>\n<div class=\"blog-article__newsletter-consent form__legal-notice\">\n\t<p>By submitting this form, you acknowledge that the personal data you provide will be processed by Kancelaria Prawna Sawaryn i Partnerzy sp.k. to handle your enquiry and contact you about it. Details are available in our <a href=\"https:\/\/sawaryn.com\/app\/uploads\/2026\/05\/SawaryniPartnerzySpK-PolitykaPrywatnosci_n.pdf\" target=\"_blank\" rel=\"noopener noreferrer\">Privacy Policy<\/a>. The rules governing the use of this website are set out in the <a href=\"https:\/\/sawaryn.com\/app\/uploads\/2026\/05\/regulamin-serwisu-S-P.pdf\" target=\"_blank\" rel=\"noopener noreferrer\">Terms and Conditions<\/a>.\n\t<\/p>\n<\/div>\n<p class=\"blog-article__newsletter-submit-row\"><button type=\"submit\" class=\"button blog-article__newsletter-submit\">\r\n    <span class=\"button__label\">Submit<\/span>\r\n            <span class=\"button__icon\" aria-hidden=\"true\">\r\n                <span class=\"icon\" data-icon-size=\"sm\">\n        <img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/sawaryn.com\/app\/uploads\/2026\/05\/arrow-01.svg\" alt=\"\" class=\"icon__image\" aria-hidden=\"true\" width=\"11\" height=\"13\">\n    <\/span>\n            <\/span>\r\n    <\/button>\n<\/p><div hidden aria-hidden=\"true\"><label>Leave this field blank<input type=\"text\" name=\"asl_website\" value=\"\" tabindex=\"-1\" autocomplete=\"off\"><\/label><\/div><input type=\"hidden\" name=\"asl_started_at\" value=\"1792928887.b2e281cd365dc00fc9d5a3c8fec8e8502f570b097f8d0f9f7affb5c000856bf4\"><div id=\"sawaryn-turnstile-1\" class=\"cf-turnstile\" data-sitekey=\"0x4AAAAAAD2_7crf8smCDxe1\" data-theme=\"light\" data-action=\"contact\"><\/div><div class=\"wpcf7-response-output\" aria-hidden=\"true\"><\/div>\n<\/form>\n<\/div>\n        <\/div>\r\n    <\/aside>\n<h3>4. Liability caps and contractual penalties<\/h3>\n<p>There are no publicly available Polish market benchmarks for typical SLA terms, <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/protecting-liability-b2b-contracts\/\">liability caps<\/a> or contractual penalties in IT contracts. Each negotiation therefore starts from one party\u2019s proposed terms. Without knowing market standards, it is easy to accept unfavorable conditions.<\/p>\n<p><strong>Legal framework to know:<\/strong><\/p>\n<ol>\n<li>Article 473 \u00a7 2 of the Polish Civil Code: liability for damage caused intentionally cannot be excluded in advance.<\/li>\n<li>Article 483: a contractual penalty may be reserved only for failure to perform a <strong>non-monetary<\/strong> obligation, not for late payment.<\/li>\n<li>Article 484 \u00a7 2: a court may reduce a penalty if it is <strong>grossly excessive<\/strong> or the obligation has been substantially performed. The parties cannot exclude this rule by contract.<\/li>\n<\/ol>\n<p><strong>Before signing, check:<\/strong><\/p>\n<ol>\n<li>Whether liability caps are symmetrical and impose comparable limits on both parties.<\/li>\n<li>Whether penalties have an aggregate cap proportionate to the contract value.<\/li>\n<li>Whether the contract excludes certain matters from the liability cap, such as confidentiality breaches, IP infringement or intentional conduct.<\/li>\n<li>Whether delay penalties account for change requests, since a customer\u2019s scope change should not automatically create a penalty for the vendor.<\/li>\n<\/ol>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">Indicative SLA availability<\/th>\n<th style=\"text-align: left;\">Maximum monthly downtime<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>99%<\/td>\n<td>About 7 hours<\/td>\n<\/tr>\n<tr>\n<td>99.5%<\/td>\n<td>About 3.5 hours<\/td>\n<\/tr>\n<tr>\n<td>99.95%<\/td>\n<td>About 22 minutes<\/td>\n<\/tr>\n<tr>\n<td>99.99%<\/td>\n<td>A few minutes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Availability above 99.9% requires multi-level redundancy and geographic distribution, which means higher costs. When negotiating an SLA, make sure the required level matches actual business needs.<\/p>\n<h3>5. Exit plan and protection against vendor lock-in<\/h3>\n<p>Vendor lock-in is one of the most underestimated risks in IT contracts, especially for cloud and AI projects. If the agreement does not set out how cooperation ends, changing vendors may be technically and financially impractical.<\/p>\n<p><strong>An exit plan should cover:<\/strong><\/p>\n<ol>\n<li>Data migration: format, timing and who pays.<\/li>\n<li>A transition period during which the vendor continues providing services to maintain continuity.<\/li>\n<li>Access to documentation and configuration, including what the vendor hands over and what remains its property.<\/li>\n<li>Cooperation with a replacement vendor, including the scope and terms of handover support.<\/li>\n<li>Deletion of data from the vendor\u2019s infrastructure in accordance with the GDPR and security policies.<\/li>\n<\/ol>\n<p><a href=\"https:\/\/sawaryn.com\/en\/contact\/\">Contact us<\/a> to review your IT agreement and identify provisions that may need to change.<\/p>\n<h2>How the AI Act changes agreements for AI tools<\/h2>\n<p>Regulation (EU) 2024\/1689, the <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/what-is-an-ai-system-under-the-ai-act\/\"><strong>AI Act<\/strong><\/a>, entered into force on 1 August 2024 and is being phased in. Provisions on prohibited AI practices have applied since 2 February 2025. Rules for general-purpose AI models have applied since 2 August 2025. Full requirements for <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/high-risk-ai-systems-eu-ai-act\/\">high-risk AI systems<\/a> apply from <strong>2 August 2026<\/strong>.<\/p>\n<h3>Why this changes contracts<\/h3>\n<p>The traditional division, \u201cthe provider is responsible for the technology and the customer for its use,\u201d is not enough. The AI Act imposes separate, non-transferable duties on both the <strong>provider<\/strong> and the <strong>deployer<\/strong>. A contract cannot effectively transfer these obligations to the other party.<\/p>\n<p><strong>Article 25 of the AI Act<\/strong> has direct contractual consequences. A deployer becomes a provider, with the associated regulatory burden, if it:<\/p>\n<ol>\n<li>Places its own name or trademark on a high-risk AI system.<\/li>\n<li>Makes a <strong>substantial modification<\/strong> to the system.<\/li>\n<li><strong>Changes the system\u2019s intended purpose<\/strong> so that it becomes a high-risk AI system.<\/li>\n<\/ol>\n<p>If you buy an AI tool and modify it for your needs, you may unknowingly assume provider obligations, including keeping technical documentation for at least 10 years.<\/p>\n<h3>What an AI tool agreement should contain in 2026<\/h3>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">Area<\/th>\n<th style=\"text-align: left;\">What to regulate<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Regulatory roles<\/td>\n<td>Specify who is provider and deployer, and the limits on modifications that could change a party\u2019s role.<\/td>\n<\/tr>\n<tr>\n<td>Documentation<\/td>\n<td>Who keeps technical documentation, in what format, who can access it and for how long.<\/td>\n<\/tr>\n<tr>\n<td>Human oversight<\/td>\n<td>Appoint competent people authorized to intervene, including suspending the system (Article 14 of the AI Act).<\/td>\n<\/tr>\n<tr>\n<td>Training data<\/td>\n<td>Whether the vendor may use customer data to train a model and on what legal basis.<\/td>\n<\/tr>\n<tr>\n<td>Monitoring<\/td>\n<td>The deployer\u2019s duty to monitor the system and identify risk situations.<\/td>\n<\/tr>\n<tr>\n<td>Transparency<\/td>\n<td>Information duties toward individuals and employees (Article 50 of the AI Act).<\/td>\n<\/tr>\n<tr>\n<td>Incidents<\/td>\n<td>Procedures for serious incidents and reporting them to supervisory authorities.<\/td>\n<\/tr>\n<tr>\n<td>Regulatory change<\/td>\n<td>A clause requiring the system to be adapted to new requirements during the contract term.<\/td>\n<\/tr>\n<tr>\n<td>FRIA\/DPIA<\/td>\n<td>Cooperation on a fundamental-rights impact assessment (FRIA) and a data-protection impact assessment (DPIA).<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>Scale of penalties<\/h3>\n<p>AI Act penalties may reach <strong>EUR 35 million or 7% of global turnover<\/strong> for prohibited practices, <strong>EUR 15 million or 3%<\/strong> for high-risk system violations, and <strong>EUR 7.5 million or 1%<\/strong> for providing incorrect information to authorities. For SMEs, the lower threshold applies. GDPR penalties may also reach EUR 20 million or 4% of annual turnover.<\/p>\n<p>The scale of these penalties supports investing in appropriate AI contract clauses before implementation begins.<\/p>\n<h2>Agile does not remove the need for a contract; it makes one more important<\/h2>\n<p>Agile projects can create an unjustified temptation to leave matters such as a high-level plan, project communications and acceptance procedures out of the contract. The argument is: \u201cWe are agile, so we do not need a rigid contract.\u201d<\/p>\n<p>That is a mistake. Polish legislation is not tailored to the legal nature of agile implementation work. The contract must reflect how the parties actually work.<\/p>\n<h3>How an agile contract differs from waterfall<\/h3>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">Element<\/th>\n<th style=\"text-align: left;\">Waterfall<\/th>\n<th style=\"text-align: left;\">Agile<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Scope<\/td>\n<td>Defined in detail in advance<\/td>\n<td>High-level and refined iteratively<\/td>\n<\/tr>\n<tr>\n<td>Schedule<\/td>\n<td>Fixed, with milestones<\/td>\n<td>Flexible and sprint-based<\/td>\n<\/tr>\n<tr>\n<td>Acceptance<\/td>\n<td>One final or staged acceptance<\/td>\n<td>Iterative acceptance after each sprint<\/td>\n<\/tr>\n<tr>\n<td>Scope changes<\/td>\n<td>Change-request process<\/td>\n<td>Backlog prioritization<\/td>\n<\/tr>\n<tr>\n<td>Payment<\/td>\n<td>Lump sum or by stage<\/td>\n<td>Time and materials or by sprint<\/td>\n<\/tr>\n<tr>\n<td>Customer risk<\/td>\n<td>Final acceptance can be \u201call or nothing\u201d<\/td>\n<td>Ongoing control, but harder to define the final scope<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>An agile contract should include:<\/strong><\/p>\n<ol>\n<li>Sprint definition: duration, planning rules and acceptance criteria.<\/li>\n<li>Backlog-prioritization rules: who sets order and how priority conflicts are resolved.<\/li>\n<li>Iterative acceptance: sprint deliverables and acceptance criteria.<\/li>\n<li>Budget controls for time-and-materials work, including how the customer tracks hours and spend.<\/li>\n<li>IP rights to each sprint\u2019s outputs, including when rights transfer and whether sprint acceptance triggers the transfer.<\/li>\n<li>An exit scenario for ending cooperation while work remains in the backlog.<\/li>\n<\/ol>\n<h2>GDPR duties in cloud and AI contracts that cannot be ignored<\/h2>\n<p>Before implementing a cloud or AI tool, your business should answer several questions:<\/p>\n<ol>\n<li>What personal data will the system process?<\/li>\n<li>Will the vendor act as a processor, and does the agreement include the data-processing agreement required by Article 28 of the GDPR?<\/li>\n<li>Will data be transferred outside the European Economic Area, and on what legal basis, such as standard contractual clauses or an adequacy decision?<\/li>\n<li>Will the system learn from customer data, and may the vendor use it to train a model?<\/li>\n<li>Does the deployment require a data-protection impact assessment under Article 35 of the GDPR?<\/li>\n<\/ol>\n<p><strong>GDPR penalties may reach EUR 20 million or 4% of annual turnover.<\/strong> Missing clauses in an IT agreement do not remove liability and may increase risk.<\/p>\n<p>AI systems add another dimension: an AI Act fundamental-rights impact assessment (FRIA) may be combined with a DPIA. The agreement should specify who conducts these assessments and how the parties cooperate.<\/p>\n<h2>Checklist: what to review before signing an IT contract<\/h2>\n<p>Use this practical framework as an internal review document before closing negotiations.<\/p>\n<h3>Customer\u2019s perspective<\/h3>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">No.<\/th>\n<th style=\"text-align: left;\">Area<\/th>\n<th style=\"text-align: left;\">Review question<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>1<\/td>\n<td>Scope<\/td>\n<td>Is the work described precisely enough for both parties to understand it in the same way?<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>Change requests<\/td>\n<td>Does the agreement cover submitting, pricing and approving scope changes?<\/td>\n<\/tr>\n<tr>\n<td>3<\/td>\n<td>Acceptance and testing<\/td>\n<td>Are acceptance criteria measurable and agreed before work begins?<\/td>\n<\/tr>\n<tr>\n<td>4<\/td>\n<td>IP rights<\/td>\n<td>Does the agreement specify who owns code, documentation and work products?<\/td>\n<\/tr>\n<tr>\n<td>5<\/td>\n<td>SLA<\/td>\n<td>Are service levels measurable and tied to consequences for non-compliance?<\/td>\n<\/tr>\n<tr>\n<td>6<\/td>\n<td>Liability caps<\/td>\n<td>Are caps symmetrical and penalties capped?<\/td>\n<\/tr>\n<tr>\n<td>7<\/td>\n<td>GDPR<\/td>\n<td>Does the agreement include a data-processing agreement compliant with Article 28?<\/td>\n<\/tr>\n<tr>\n<td>8<\/td>\n<td>AI Act<\/td>\n<td>If AI is involved, does the agreement define provider\/deployer roles and modification limits?<\/td>\n<\/tr>\n<tr>\n<td>9<\/td>\n<td>Exit plan<\/td>\n<td>Does it address data migration, transition and cooperation with a new vendor?<\/td>\n<\/tr>\n<tr>\n<td>10<\/td>\n<td>Regulatory change<\/td>\n<td>Does it provide a way to adapt to regulatory changes during the contract term?<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>Vendor\u2019s perspective (software house\/integrator)<\/h3>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">No.<\/th>\n<th style=\"text-align: left;\">Area<\/th>\n<th style=\"text-align: left;\">Review question<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>1<\/td>\n<td>Scope of obligations<\/td>\n<td>Can the scope be delivered with the available resources and budget?<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>Financial risk<\/td>\n<td>Do penalties and liability caps shift 100% of the risk to the vendor?<\/td>\n<\/tr>\n<tr>\n<td>3<\/td>\n<td>Schedule<\/td>\n<td>Does the schedule match the team\u2019s actual capacity?<\/td>\n<\/tr>\n<tr>\n<td>4<\/td>\n<td>Customer dependencies<\/td>\n<td>Does the agreement address customer-caused delays, such as missing data or decisions?<\/td>\n<\/tr>\n<tr>\n<td>5<\/td>\n<td>Impact on other projects<\/td>\n<td>Do the obligations conflict with other contracts?<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>The agreement is signed, but cooperation is deteriorating. What now?<\/h2>\n<p>Even the best contract cannot resolve every issue that emerges in day-to-day cooperation. Regulatory, economic, technological or organizational changes may bring the parties back to the negotiating table. Negotiating IT contracts is, in practice, an ongoing process.<\/p>\n<p>If you have signed a maintenance or implementation agreement and cooperation is deteriorating, for example, the parties disagree about ticket priorities, response times or liability, do not wait for a formal dispute.<\/p>\n<p><strong>What to do:<\/strong><\/p>\n<ol>\n<li>Identify specific differences between the contract and how the parties actually work together.<\/li>\n<li>Prepare an amendment that clarifies the working model before the dispute becomes formal.<\/li>\n<li>Decide internally who enforces contract terms for acceptance, SLAs and change requests, and how performance will be monitored after signing.<\/li>\n<li>Train project managers, product owners and IT leads on contract mechanisms so the agreement is a working tool, not an archived document.<\/li>\n<\/ol>\n<h2>We can help<\/h2>\n<p>We provide legal services to technology companies, from startups to scale-ups. We combine contract, IT and AI law with IP protection in a model tailored to how your business actually runs projects.<\/p>\n<p><strong>How we work on IT contracts:<\/strong><\/p>\n<ol>\n<li><strong>Review existing agreements:<\/strong> assess scope and change requests, acceptance and testing, <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/protecting-intellectual-property-it-companies\/\">IP rights<\/a>, liability caps and penalties, and exit plans. Identify gaps between the contract and actual cooperation.<\/li>\n<li><strong>Risk and negotiation-priority map:<\/strong> prepare an internal list of red flags, must-haves and nice-to-haves, approved by business, IT and the board.<\/li>\n<li><strong>Negotiation and documentation:<\/strong> negotiate firmly while helping the parties close the deal, and draft agreements that reflect how the team works.<\/li>\n<li><strong>AI project support:<\/strong> review clauses under the AI Act and GDPR, data and output rights, provider\/deployer roles and regulatory-change scenarios.<\/li>\n<li><strong>Amendments and renegotiations:<\/strong> for agreements already in force that no longer work under project pressure.<\/li>\n<li><strong>Team training:<\/strong> show project managers, product owners and IT leads how to use contract mechanisms in day-to-day work.<\/li>\n<\/ol>\n<p>We do not create documents \u201cjust in case.\u201d We design rules where risk or value actually arises, from development through sales.<\/p>\n<p><a href=\"https:\/\/sawaryn.com\/en\/contact\/\">Contact us<\/a> with your draft IT agreement. Within 48 hours, we will provide a risk map and a recommendation on where to begin negotiations.<\/p>\n<h2>An IT contract that works under pressure: summary and next steps<\/h2>\n<p>The greatest contract risk is not having no agreement. It is having an agreement that looks good on paper but fails under project pressure.<\/p>\n<p>A well-negotiated <strong>IT contract<\/strong> organizes scope, allocates risk, governs changes and gives both parties a way to solve problems before they become disputes. In 2026, as the AI Act imposes new duties on providers and users of AI systems and implementations grow more complex, a sound contract structure is not merely a legal cost; it is a condition for a predictable project.<\/p>\n<p>If you are negotiating an implementation agreement, buying an AI or cloud tool, or finding that your current agreement no longer works, <a href=\"https:\/\/sawaryn.com\/en\/contact\/\">contact us<\/a>. We can help structure a contract that organizes the project instead of generating disputes.<\/p>\n<h2>Frequently asked questions<\/h2>\n<p><strong>A vendor has sent its standard implementation agreement. What should I review first?<\/strong><\/p>\n<p>Start with five areas: (1) whether scope is precise and understood the same way by both parties; (2) whether there is a change-request procedure; (3) whether acceptance criteria are measurable; (4) who owns code and documentation when the project ends; and (5) how cooperation can end under the exit plan. If any area is missing or drafted only for the vendor\u2019s benefit, the agreement may need to be renegotiated.<\/p>\n<p><strong>How should I set up change requests so scope changes do not block the project?<\/strong><\/p>\n<p>Specify who may submit a change and in what form, who estimates it, who approves it, its effect on schedule and budget, and what happens if the parties disagree on its price. Without this process, the vendor may impose penalties for customer-driven delays while the customer argues the changes were in the original scope.<\/p>\n<p><strong>We are buying an AI tool. How can we protect against vendor lock-in and data loss?<\/strong><\/p>\n<p>Regulate data migration, including format, timing and cost; the transition period; access to documentation and configuration; cooperation with a new vendor; and deletion of data from the vendor\u2019s infrastructure. Also check whether the vendor may use your data to train its model and on what legal basis. Under the AI Act, assess whether modifying the system for your needs could change your role from deployer to provider.<\/p>\n<p><strong>I run a software house. How can I negotiate with a large corporate customer without taking on all the risk?<\/strong><\/p>\n<p>Prepare your own framework agreement instead of negotiating only from the customer\u2019s template. Check that penalties and liability caps do not shift 100% of the risk to you. Address customer-caused delays, such as missing data, decisions or resources. Confirm that the scope is deliverable within your resources and budget and that the schedule matches your team\u2019s capacity.<\/p>\n<p><strong>The agreement is signed, but cooperation is breaking down. Can anything still be done?<\/strong><\/p>\n<p>Yes. Do not wait for a formal dispute. Identify differences between the contract and actual practice, then propose an amendment clarifying service priorities, response times, liability and communication. The sooner the working model is clarified, the lower the risk of a lengthy dispute.<\/p>\n<p><strong>Who should be involved in negotiating an IT contract?<\/strong><\/p>\n<p>IT contract negotiations require legal, business and technology perspectives. The table should include a lawyer for contract structure and risk, a business representative for scope, budget and priorities, a CTO or technical lead for feasibility and dependencies, and a project or delivery manager for schedule, resources and acceptance. A lawyer alone is not enough: the agreement may be formally correct but fail to reflect the project.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A practical guide to negotiating IT implementation contracts, covering scope, acceptance, intellectual property, liability, exit planning, the AI Act and GDPR.<\/p>\n","protected":false},"author":9,"featured_media":1892,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","sip_alt_url":"","sip_en_pl_url":"","sip_pair_uuid":"","sip_pair_state":""},"categories":[1577],"tags":[1545,1550,1446,1543,1635],"specialization":[1211],"practice_area":[],"class_list":["post-3870","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-it-ai-ip-law","tag-ai-act-en","tag-contract-law","tag-gdpr","tag-it-ai-and-ip-law","tag-umowa-wdrozeniowa-it","specialization-it-ai-ip-law"],"acf":[],"_links":{"self":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3870","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/comments?post=3870"}],"version-history":[{"count":1,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3870\/revisions"}],"predecessor-version":[{"id":4202,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/3870\/revisions\/4202"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media\/1892"}],"wp:attachment":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media?parent=3870"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/categories?post=3870"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/tags?post=3870"},{"taxonomy":"specialization","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/specialization?post=3870"},{"taxonomy":"practice_area","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/practice_area?post=3870"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}