Penalty Clauses That Make AI Vendors Walk

Legal pasted the delay-penalty schedule from a civil-works file into the AI annexure. One percent of the contract value per day of delay, uncapped, plus one percent of annual value per hour of SLA miss, plus a complete waiver of limitation of liability for any AI harm, plus a right to recover consequential losses including loss of reputation. Three of four firms that had attended pre-bid did not submit. The fourth doubled the price and wrote a twenty-page deviation list.

Public contracts need teeth. They do not need theatre that no solvent vendor can underwrite. Liquidated damages must be a genuine pre-estimate of loss your rules will recognise, not a mood. This teardown is not a plea for toothless paper. It is a map of the clauses that empty a capable bid room, and the clauses that should stay because they protect the actual harm an agent can do.

Clauses that empty the room

Uncapped delay damages at works-contract percentages on a software install. Agent projects slip on data, identity and MIS readiness as often as they slip on vendor labour. An uncapped daily percentage makes the vendor price your own unreadiness.

Hourly credits sized as a share of the annual value against an unmeasurable 99.99 percent. You will never raise the invoice, or you will raise it once and then fight for a year.

Accuracy fines. Vendors will refuse hard files, shrink the workflow, or argue the dataset. You will not get better drafts. You will get a better lawyer.

Unlimited liability for all AI outputs, including officer misuse. Capable firms cannot buy insurance for that sentence. The remaining bidder is either naïve or judgement-proof. Personal liability of named startup directors for model error will not see DPIIT firms. You will see a shell that has nothing to take.

Keep the harm; change the instrument.

Harm you actually fear	Theatrical clause	Clause that capable vendors can sign
Late go-live	1 percent of TCV per day, uncapped	Capped LD; extensions when department dependencies slip; terminate for persistent delay
Agent down	Four nines and huge hourly fines	Measured probe; modest credits; persistent miss as default
Wrong draft	Monthly accuracy penalty	Failed acceptance; shadow mode; reduce workflow
Silent write-back	Unlimited consequential damages	Material breach; restore; audit costs; a defined liability cap with a carve-out for wilful undeclared egress
Logs missing	Small SLA credit	Security breach; hold payment; terminate if repeated
Undeclared model host	A warning letter	Material breach and a named indemnity for that event

What should still hurt

Undeclared egress and undeclared subprocessors. This is not a service-credit event. It is a breach of the isolation and processing schedule. Failure to deliver a loadable exit package at the milestone deserves a holdback, not a polite observation.

Disabling a human gate, or running a write tool on production without the card, is unauthorised processing. Training or improvement on customer content in breach of the ban deserves deletion, a certificate, and a price that does not assume they keep the benefit. Persistent failure of a measured SLA object after a cure period should make termination real, not ornamental.

Caps and carve-outs without becoming a doormat

A limitation of liability aligned to a multiple of fees is normal commercial practice. Public buyers can still carve out: fraud, wilful misconduct, IP infringement, and deliberate breach of the data/egress schedule. If every carve-out is any AI-related harm, you have deleted the cap.

Do not copy a US tech MSA that caps the vendor at three months of fees and excludes everything you care about. That is the opposite error. Read the paper. Negotiate the carve-outs you will actually need to explain to a PAC. Performance security and retention exist. Use them for delivery and exit milestones instead of inventing a new nuclear LD for every fear.

GeM and standard terms

Portal terms may already contain delay and SLA language. Confirm the live GeM or departmental template before you stack a second, wilder annexure on top. Two conflicting penalty regimes is how a court, or even just a clever deviation list, dismantles both.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

If we soften LD, audit will say we favoured vendors.

Audit can also say you wrote unenforceable theatre and then selected a hollow L1. Show that the remaining teeth map to real harms and that capable firms stayed in the room.

Works files use these percentages. Why not us?

Works have different delay physics and different sureties. Copying the percentage is not copying the rationale.

Our counsel insists on unlimited AI liability.

Ask counsel what insurance exists for that sentence and who will bid. Then decide if you want a market. This is not a request to drop data-breach carve-outs.

Vendors always mark up for LD. Let them.

They will, and you will pay it, if they stay. If they leave, you pay in a worse way.

Rewrite the penalty annexure in six days

1. Day 1: list harms, not emotions.
2. Day 2: map each harm to credit, holdback, breach, or termination.
3. Day 3: cap delay LD and exclude department-caused slip.
4. Day 4: delete accuracy fines; move quality to acceptance.
5. Day 5: draft liability cap plus narrow carve-outs for egress, training-ban breach, and fraud.
6. Day 6: align with GeM or departmental standard terms so you do not have two regimes.

How this shows up in the file

Subject: Recasting of liquidated damages and liability for the agent bid.

The draft annexure copied from a works file has been replaced. Delay damages are capped and recognise department dependencies. SLA credits follow measured objects. Accuracy is an acceptance issue. Undeclared egress, training-ban breach, disabled gates and missing exit packages remain material. Liability is capped with carve-outs for fraud, wilful misconduct and deliberate data/egress breach.

The aim is a solvent bid room and enforceable teeth. This note is not legal advice.

Use security and retention for the harms that need money

Performance security and a retained last tranche already exist in most government IT files. Point them at the gates that matter: isolation proof, log export, loadable exit, and a human gate that cannot be switched off. A five-percent retention that actually waits on those artefacts does more work than a one-percent-per-hour fantasy nobody will invoice.

Write the release conditions in the same schedule as the SLA objects. If the SOC has not seen a week of traces in the department store, the retention stays. If the restore drill failed, the retention stays. The vendor then has a reason to produce the ZIP while they still want the rupee. That is the opposite of a works-percentage LD that only fires after a lawyer is already in the room.

If your standard conditions already set a security percentage, do not stack a second, wilder percentage on top. Point the existing instrument at the agent-specific artefacts. Two securities plus nuclear LD is how a solvent firm walks and a hollow firm signs.

This article is a field guide for Indian public buyers, not legal, procurement, financial or audit advice. Confirm every citation against the live GFR compilation on doe.gov.in, the relevant DoE procurement manual, GeM terms, CVC guidance and your own counsel before a sentence enters a tender file.

How to put this in the RFP, not the preamble

A P2 Procurement who searches “penalty clause IT contract” is usually drafting or scoring a bid. “Penalty Clauses That Make AI Vendors Walk” belongs in eligibility, the evaluation matrix, or a numbered annexure. If it only lives in the covering note, L1 will ignore it.

Uncapped hourly damages on a fantasy uptime, plus an accuracy fine, will not make the agent safer. They will leave you with the one bidder who did not read the annexure. QCBS weights are a choice you must publish before opening. Accuracy is a task plus a dataset, not a slogan. SLAs for agents must name tool-calls, human gates and log export — uptime alone is a hosting metric.

Do not let a vendor write the specification and then bid on it. Record unsolicited proposals. Pay for pilots that touch personal data. Write exit before you write go-live.

1. Move the control from the preamble into a scored or eligibility row.
2. Attach a one-page definition (accuracy, SLA, language, data handling).
3. Require an artefact in the technical bid, not a slide.
4. Extend the bid date if a corrigendum is material.
5. Minute the demo on your data, offline if you claimed air-gap.

Close this loop before the next CAB

Put “Penalty Clauses That Make AI Vendors Walk” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P2 Procurement, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “penalty clause IT contract” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.