Tender Clauses That Quietly Lock You In

Nobody tables a paragraph that says the department will be unable to leave. The lock is assembled from clauses that sound like hygiene. Software will be licensed on a subscription basis. Usage will be metered. Logs will be available in the vendor portal. Source code may be escrowed if commercially reasonable. Transition support will be discussed in good faith. Each sentence would pass a tired reading. Together they mean you will renew.

Agent platforms lock harder than a 2014 MIS. The MIS at least left you a database. An agent leaves you prompts, traces, tool mappings, eval sets, and sometimes an adapter that will not load without the vendor's runtime. If the tender never named those objects, exit is a negotiation you will lose while the service is already in the noting file.

This teardown is for commercial and procurement officers who still have a draft out. It is not legal advice. It is a list of sentences we keep crossing out of Indian AI bids before they become a three-year hostage.

The licence that phones home

A clause that says licence keys will be issued and renewed by the OEM looks ordinary. On an air-gapped or even a merely on-prem stack it is a remote kill switch. When a commercial dispute freezes the vendor account, inference returns 403 on hardware you already paid for. The tender called this software assurance. It was a standing outbound dependency.

Rewrite: entitlement must work offline for the paid term plus a defined wind-down, from a file or local licence server the department controls. Renewal must not require a packet to a vendor host. If the vendor cannot do that, they are not selling on-prem software. They are selling a hosted product you happen to rack.

The metric you cannot audit

Token, call, seat, GPU-hour, active agent, document page processed — any unit can be honest if you can count it on your side. Lock-in begins when only the vendor's dashboard emits the number, and the invoice is not disputable without their log. Departments then discover that retrieval-augmented drafts burn tokens they never budgeted, and the only way to stop the bill is to stop the work.

Rewrite: define the unit, the counter the department can export, the sampling method for disputes, and a cap or an alert before a threshold. If the vendor will not let you count, you are not buying a price. You are buying their word.

Routine sentences and the lock they hide.

Clause that looks harmless	What it does in year two	Buyer rewrite
Licence validated against OEM cloud	A billing dispute becomes an outage	Offline entitlement for the paid term plus wind-down
Usage as recorded in the platform	You cannot challenge the invoice	Department-exportable counter and a dispute sample
Logs available in the vendor console	You lose traces at exit or during a CERT-In request	Nightly export in a named format to your SIEM
Models and prompts are vendor IP	You paid to improve their product	Split objects: your data, your evals, your adapters
Transition assistance mutually agreed	Assistance is priced after you are desperate	Priced exit schedule in the bid itself
Standard MSA prevails on conflict	Your tender annexure loses	Tender and corrigenda prevail; MSA is subordinate
Proprietary trace / index format	The next vendor starts from zero	Open or documented export that a second tool can load
Subcontractors as required to deliver the service	An undeclared model host appears	Named subprocessors, including model hosts, with a change notice

The MSA that eats the tender

Bidders love to attach a standard master services agreement and a clause that the MSA prevails on any conflict. That sentence undoes your isolation annexure, your training ban, and your penalty schedule. The tender becomes a cover letter.

Order of precedence must put the bid document, corrigenda and your schedules above the vendor MSA. If they cannot live with that, they cannot live with a public contract. Do not discover the conflict after award when legal finally reads page forty of their PDF.

Watch for quiet change-of-control and assignment rights. A startup you evaluated as DPIIT-recognised and on-prem can be sold to a group whose default is a foreign model API. The lock is not malice. It is an acquisition plus a clause that let the contract travel without your consent.

Formats as handcuffs

If prompts live only inside their editor, if the vector index is a closed blob, if traces are a binary the next SI cannot parse, you have built a second vendor into the department's memory. Escrow of that blob does not help unless a documented loader exists on hardware you control.

Demand exports in formats a competent second contractor can read: plain prompt files, a documented index dump or a rebuild recipe from your corpus, JSON or syslog traces, and weights or adapters in a stated format. Then price a restore drill. An untested export is a souvenir.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note. A spoken answer without paper will be forgotten by the next officer.

Every OEM uses a licence server. We cannot fight the industry.

Then you are not buying an isolated platform, and the file should say so. Several Indian on-prem vendors can issue offline entitlements. Industry practice is not a GFR limb and it is not a CISO control.

If we demand exports we will get no bids.

You may get fewer brochure bids. That is the point. If truly nobody can export traces and prompts, you are buying a black box and should write the risk, not pretend you have a three-year option to switch.

Legal will handle exit at the time of exit.

Legal at exit has no leverage. Price and specify transition in the bid, while bidders still want the work.

Escrow already covers this.

Escrow of platform source can help a competent SI restart the app. Escrow of model weights without a loadable format is a disk in a vault. See the companion note on escrow. Do not let a bank locker replace an export drill.

A two-week lock-in teardown of the draft bid

Print the draft RFP, the ATC, and any vendor template already in the file. Mark every sentence that creates a dependency you cannot operate without the incumbent.

1. Day 1–2: list runtime dependencies — licence, model host, registry, identity, support tunnel, APM. Each one needs an offline or department-owned answer, or an honest exception.
2. Day 3–4: list information objects — prompts, evals, adapters, indices, traces, tool maps. Each one needs an owner, an export format, and a restore test.
3. Day 5: kill standard MSA prevails and mutually agreed transition. Replace with precedence and a priced schedule.
4. Day 6–7: send the marked draft to CISO and stores, not only to the indentor. If a clause only the preferred vendor can meet, disclose it or delete it.
5. Week 2: issue the cleaned draft, or a corrigendum if the bid is already out. Do not wait for a representation to do this work.

How this shows up in the file

Subject: Review of draft AI-platform bid for hidden lock-in.

The draft has been read for dependencies that survive only if the incumbent remains. Licence validation, usage counters, log custody, model-host subprocessors, proprietary formats, MSA precedence and unpriced transition are listed in the attached schedule with proposed rewrites.

No clause in the attached rewrite is presented as a statutory requirement. The purpose is to keep a future competition possible and to keep isolation claims true. Competent authority may accept a named exception if the risk is written. Silence is not an exception. This note is not legal advice.

What the next noting must contain

“Tender Clauses That Quietly Lock You In” belongs in a file, not only in a search result. A P2 Procurement should be able to point at one artefact that proves “vendor lock-in tender clauses”: a packet capture, a processing schedule, a scored evaluation row, a dated notice, or a refusal rule. If the only evidence is a slide, you have a heading.

Lock-in rarely arrives as a clause titled lock-in. It arrives as a licence daemon, a token metric, a proprietary trace format, and an MSA that says exit assistance will be mutually agreed. DPDP 2023 does not define sovereign AI and does not write a blanket localisation rule for every model hop. CERT-In’s 28 April 2022 directions still set specified incident clocks and 180-day log retention in India for in-scope events. The November 2025 AI governance text is guidance, not a statute. A Proprietary Article Certificate, when it is lawful, lives in GFR Rule 166 — not Rule 161.

Write three dated sentences under C5 AI Tenders: what was decided, which designation owns it after the next posting order, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the designation that owns “vendor lock-in tender clauses”, plus a deputy.
• Attach one artefact a stranger can open next year.
• Name the instrument you are actually using — Act, direction, GFR clause, GeM term, or guideline paragraph.
• Leave unsourced percentages, GMV slides and house forecasts out of the noting.
• Revisit when the model, the SI, the notice, the region or the posting changes.

This article is a field guide for Indian public buyers, not legal, procurement, financial or audit advice. Confirm every citation against the live GFR compilation on doe.gov.in, the relevant DoE procurement manual, GeM terms, CVC guidance and your own counsel before a sentence enters a tender file.