The specific mechanisms remain fluid. Governance guides now recommend using procurement workflows to manage AI-specific risks—human oversight requirements, vendor due diligence, validation standards, bias testing, audit rights, and escalation procedures—but the extent to which these recommendations have been adopted across industries and deal types is not yet clear. The practical scope of contractual AI governance, and whether courts will enforce these terms as written, remains untested in most contexts.
For practitioners, this signals a fundamental shift in where AI governance power actually resides. Abstract compliance policies matter less than contract language that determines operating rules. Attorneys advising on AI procurement should expect governance obligations to become standard deal terms, not afterthoughts. Conversely, those representing AI vendors should anticipate increasingly granular contractual demands around model transparency, performance monitoring, and liability allocation. The question is no longer whether AI governance happens—it is whether it happens through regulation or contract, and that answer is increasingly: contract.