Federal Analysis
Canadian Organizations Update AI Vendor Agreements
March 17, 2026
Canadian organizations adopting artificial intelligence technologies are advised to revise their vendor agreements to address AI-specific risks such as data usage for model training, ownership of AI-generated outputs, and evolving performance standards. The Canadian Centre for Cyber Security has published an AI primer that provides practical guidance to enhance security and risk management in AI procurement processes. This development highlights the need for procurement professionals to incorporate detailed AI risk considerations into contract negotiations to mitigate liability and ensure measurable performance.
- Contracts should include clear, measurable AI performance standards beyond traditional availability metrics, such as accuracy thresholds and fairness benchmarks.
- Procurement teams must assess the entire AI supply chain, including data storage and processing locations, to understand security postures and potential vulnerabilities.
- Legal and contracting professionals should address liability issues arising from AI systems' variable outputs and model updates, which standard clauses may not cover.
- Organizations can leverage the Canadian Centre for Cyber Security's AI primer as a resource to inform procurement strategies and contract terms related to AI technologies.
Organizations must understand the full AI supply chain and assess the security posture of each component, including knowing where your data is stored and processed.
— Jeremy Barber
AI systems generate variable outputs that may change over time as models are updated or retrained, creating liability questions that standard limitation-of-liability clauses were never designed to answer.
— Nathan Schissel
Contracts should include measurable performance standards that go beyond availability, such as accuracy thresholds, hallucination rate benchmarks or fairness metrics.
— Kristél Kriel
Agencies
Canadian Centre for Cyber Security