When the Vendor Adds AI to the Product You Already Bought

The renewal quote arrives with a line item that was not there last year. The old SKU is gone, replaced by a new tier that includes a generative AI assistant. The account manager calls it a productivity multiplier. The Data Processing Agreement calls it a change in permitted data use.

You are not just buying a new feature. You are funding the vendor’s AI strategy and changing where your data goes.

Vendors use AI as a wedge to retire grandfathered pricing tiers. The AI justifies a price uplift. They price the feature per seat across the entire organization, even though text summarization is used by a small fraction of the workforce. You end up paying a premium for shelfware.

The feature often ships default-on. The opt-out is buried in user settings or only works for the user interface, leaving the API active. Meanwhile, the subprocessor list changes. The vendor’s AI wraps a third-party model, and your data boundary bleeds across regions.

Before the renewal call, separate the license from the data terms. Send the pricing and SKU changes to procurement. Send the updated terms of service and subprocessor list to legal and security.

Read the Data Processing Agreement, not the trust center. The trust center is marketing. The DPA is the deal. Look for language about using data to improve services. That usually includes model training. If the trust center contradicts the DPA, the DPA wins.

Check the admin console. Ask the vendor to demonstrate the disabled state in a live environment. If the toggle is per-user, or if it hides the interface but leaves the API open, it is not a control. It is a compliance risk.

Check the subprocessor list. If the underlying model provider is not on it, or if the retention window is thirty days for abuse monitoring, you have a new subprocessor. You have a contractual window to object. Use it.

The decision is not whether your organization wants AI. It is about data terms, price, administrative control, and exit rights. Here is how to choose your path.

Option A: Accept the feature and the new terms This fits when the feature is embedded in a core workflow, the data is not regulated, the vendor’s terms match your policy, and the price uplift is justified by measurable adoption. Before signing, check the DPA, the subprocessor list, the tenant-level opt-out, and the adoption dashboard.

Option B: Accept the feature, negotiate the terms This fits when the feature is useful to a specific group, but the data terms are insufficient, the opt-out is not at the tenant level, or the per-seat uplift is larger than the value. Negotiate for disable-by-default, a tenant-level opt-out, explicit contractual amendments stating inputs and outputs will not train models, audit rights, and exit language.

Option C: Decline the feature, hold the old price This fits when the data is regulated, the feature is not in the workflow, the vendor cannot explain the data flow, or the opt-out is per-user only. The risk is that the old SKU is end-of-sale. Ask for the old price to be honored for the renewal term. Verify what running without the feature means for support and future upgrades. Price the replacement as a migration, not a routine renewal.

Option D: Pilot before deciding This fits when the feature is plausible but unproven, and the business owner is willing to own the adoption number. Require a named user group, a fixed term, a data-use addendum, an adoption report, and a decision date before the renewal.

Several conditions change the answer.

If the feature touches regulated data, the bar is higher. Legal and privacy own the decision.

If the pricing is consumption-based, finance cannot forecast it. Demand caps or committed-use discounts.

If the vendor’s non-AI roadmap is empty, the old SKU is a dead end. The decision becomes about terms, not features.

If the vendor refuses to put the data terms in the contract, or refuses to offer a pilot, that is your answer.

The internal process matters more than the vendor negotiation. Security, legal, privacy, procurement, and the business owner have to agree before the renewal call.

The business owner is the person who has to defend the adoption number at the next budget cycle. Get them in the room. A seat count is not a use case.

Demand telemetry before paying per seat. Ask for a trial with full usage telemetry. If the vendor cannot show you who is using the feature, they cannot tell you what data is leaving the environment.

Silence is opt-in. If you do not intercept the release notes, update the DPA, and configure the administrative console, users will start feeding proprietary data into the tool on Monday morning. An opt-out toggle buried in a user’s personal settings is not a data governance strategy.

The vendor is selling a feature, but you are negotiating a data-processing agreement.