5 AI commitments enterprise procurement will demand before August

The headline a board director read this week

A VentureBeat survey landed on April 30 with a stat that should change every Series C renewal conversation in Q3. Across 108 enterprises, 88% reported AI agent security incidents in the last twelve months. Only 21% have runtime visibility into what their agents are actually doing. The piece called it “the enforcement gap.” For anyone selling AI to enterprise, it is a procurement story.

Two days earlier, a Holland & Knight client alert reminded US companies that the EU AI Act’s high-risk obligations land on August 2. The penalty ceiling for a single bad clause is real money.

Stack those two news items together and the picture is clear. Enterprise customers just had a year where most of them got burned, and a regulatory ceiling that prices a single bad clause in seven figures. They are not going to renew on last year’s terms.

What it actually means for a Series C renewal

When I talk to Series C founders this week, I keep hearing the same thing. Q3 renewals that closed in 30 days last year are landing on the procurement desk with three times the questionnaire and a ninety-day timeline. The CAIQ and SIG Lite templates now carry dedicated AI sections that did not exist eighteen months ago. Enterprise security teams are running 500 vendor reviews a year, and most of those reviews now include a model card request, a runtime visibility ask, and an EU AI Act extraterritoriality clause.

This is not a tightening cycle that resolves itself. The Cloud Security Alliance reported on April 21 that 82% of enterprises have AI agents running in their environment that no one inventoried. The same survey found only 21% have a formal decommissioning process. Those two numbers tell every CISO buying a Series C product the same thing. The supply chain is the risk surface, and the supplier has to prove it is not.

The five commitments below are what I am seeing land in actual procurement red-line drafts right now. None of them are new in spirit. All of them are new as written demands.

The five commitments enterprise procurement is now writing into contracts

1. A model and data inventory the buyer can audit on demand

The EU AI Act’s high-risk system obligations require operator-side documentation detailed enough to support post-market monitoring. Enterprise buyers are reading that obligation backward and asking suppliers to make the inventory available now, not at audit time. The CSA 82% unknown-agents stat is what gives them air cover. If the customer cannot tell their auditor what AI is in the building, the supplier has to.

What this looks like in a contract: a clause that names the models, training data sources, fine-tuning history, and any agent capabilities, with a 30-day refresh cycle and a right to audit on 10 days notice.

2. Runtime visibility into agent behavior

The VentureBeat 21% runtime visibility stat is the demand. Enterprise procurement is reading that gap and writing the missing 79% into the next contract. Buyers want logs of what the agent did, who initiated it, what data it touched, and what tool calls it made. They want those logs queryable, not zipped into a quarterly report.

What this looks like: an SLA on log latency, a defined retention period, and a query API the customer’s SOC can hit without a support ticket.

3. A 72-hour incident response commitment

The federal GSAR clause for AI procurement set a 72-hour notification floor for confirmed or suspected security incidents. Enterprise buyers are now using that floor as their template. Given that 88% of enterprises had at least one AI agent incident last year, the question is not whether a customer will trigger this clause. It is how the supplier responds when they do.

What this looks like: a defined incident severity matrix, named escalation paths, and a credit or refund tied to missed response windows.

4. EU AI Act extraterritorial coverage in writing

The Holland & Knight alert is explicit that any non-EU company whose AI output reaches EU customers is potentially in scope. Enterprise buyers headquartered in the US with EU subsidiaries are now demanding suppliers carry that exposure contractually. The 15 million euro or 3% of global turnover ceiling is what gives the redline its weight.

What this looks like: an explicit warranty that the supplier will meet Annex III obligations for any system used by the customer’s EU operations, plus indemnification for regulatory fines tied to supplier-caused noncompliance.

5. Decommissioning and exit terms with data return

The CSA finding that only 21% of enterprises have formal AI decommissioning is the silent driver here. Procurement teams are no longer willing to sign without a defined off-ramp. They want training data return, model artifact destruction certification, and a fixed transition window if the relationship ends.

What this looks like: a 90-day exit clause with documented data destruction, a statement of work for any customer-specific model artifacts, and a portability commitment that the supplier will not hold customer-specific fine-tuning hostage.

The 60-second board brief

If a director asks at the next board meeting why the Q3 renewal pipeline looks slower, the answer is not that customers are pulling back. It is that the customers who are still buying are buying differently. The right response is to staff a procurement-counterparty function inside legal and product, not to discount.

What I am watching this week

• Whether the EU’s Digital Omnibus package actually delays Annex III obligations to December 2027. The European Parliament voted to delay, but Holland & Knight’s Pregasen calls the final text not yet binding.
• Whether the major hyperscalers publish standardized AI vendor attestation packages before August 2. If they do, enterprise procurement gets a template and the questionnaire load eases.
• Whether the next CAIQ release includes a formal AI module. That single change would compress 500 customer-specific questionnaires into a single benchmark, which would help every Series C selling to regulated buyers.

That is the week. Five commitments, drafted before procurement asks for them, are how Q3 stays on track.