891: AI in Your Contracts: You Still Own the Risk W/ David Tollen

0:05Hi there, my name is Philip Ideson. I want to welcome you to the Art of Procurement podcast, the podcast that helps you, a forward-thinking procurement professional, position yourself and your team to proactively take advantage of the revolution that's taking place in procurement today. By interviewing industry trailblazers and sharing insights from our own experiences, my team and I pull back the curtain and shine a light on the strategies, tactics, and tools that procurement teams are using to elevate their impact. And today on the show, I'm delighted to welcome David Tollin. David is an attorney and expert witness, and he specializes in technology-related contracts.

0:42David is also the founder of Tech Contracts Academy, where he teaches software contracting. Now, David is the author of the American Bar Association's bestseller, the Tech Contracts Handbook, and also an adjunct professor at UC Berkeley Law School. David was one of our featured panelists at Catalyst San Francisco back in May of this year. So we're delighted to be reconnecting to have this conversation on the record rather than in the room so that we can share it with our entire community. David, it's a pleasure to see you again, and thanks for joining me on the podcast. Thank you for having me.

1:13It's great to be back with you. Yeah, and I usually ask a question around how a guest found procurement, but you're within the contract side of the world. Within the practice of the law, how did you end up focusing on corporate contracts? I actually started out in litigation. I was at a large global law firm and litigation seemed to be the thing, but I found that the slow pace of discovery and everything else that went with it was boring. And I ended up negotiating some settlements. I negotiated contracts as settlements and I ended up doing a couple of other sort of transactional things related to the litigation work.

1:52And I discovered I really like that. I like both the sort of get more action, believe it or not, because you negotiate and it's probably not hard for you to believe. But I also found I like the putting together a puzzle and creating a structure element of creating a contract and found that really satisfying. So I switched departments and it took off from there. Yeah, the dopamine hit of the negotiations and kind of coming up with settlements and solving kind of conflicts, I think, is a faster hit, like you say, than waiting for years of litigation to work itself through the legal system. Yeah, yeah.

2:35And actually the procurement side was there from the start because the first, I started out doing information technology contracts, but not initially for the usual tech startup clients. There were plenty of those, but we had big banks and we had procurement departments. That was, you know, most of the initial clients were people buying technology, procurement. Now, you may argue otherwise, but I think contracting hasn't changed a lot in a lot of years, certainly since I was starting in procurement. And then AI came along. What do procurement teams need to understand today about how AI is actually changing SaaS contracts?

3:13Yeah. So the way I put it is there was a big move in contracting around the beginning of this century where you started replacing on-premise software with software as a service. And everyone was kind of thrown into a tizzy about this because, you know, we know how to do on-premise software licensing and now we've got this new thing and we're scared we don't understand. And when I started out doing our trainings, which became my second business, training people to do these, one of the first things I would say is take a deep breath. 85 % to 90 % of what you already know still applies when we move from on-premise to the cloud.

3:56And it's really the same with AI. There are, maybe I'd bump it down a little bit lower and say 80 % to 85%. there are a bunch of new issues that we have to address with procurement of artificial intelligence. And we have to detect when it's happening because sometimes a tech vendor adds AI functionality without making a particular big deal of it. But the vast majority of what people have learned about how to do tech contracts over their career is still entirely applicable, particularly software as a service, other cloud hosted software. So we've now just got to A, detect when the vendor is adding AI functionality and then address a series of issues that AI raises that other forms of technology don't.

4:50Yeah. What are some of those issues then? What do we need to be on the lookout for that we didn't have to be before? So the issues are mostly probably familiar to a lot of your audience, although, frankly, very often misunderstood. So the issue of training, the issue of to what extent is the system going to use my information, both inputs and outputs, to train the model, usually not a terribly hard thing to negotiate in an enterprise system where the vendor will generally say, we won't or we won't except for your version. there's a level of intellectual property risk that we haven't seen before in that you know they just can't promise that outputs will be free of infringement and they're not going to give ip warranties in most cases saying so although you might get an ip indemnity very very different and then there's a bunch of new issues with agentic ai which which really kind of pushed the frontier of newness, which is because it's systems that can take so much autonomous action.

6:00In the past, you didn't have to worry about your software doing things like buying something it wasn't supposed to do. You worried about your employee doing that. Now we have to worry about the software and address that, which actually, even before you get to agentic AI, we also now have to worry about your software doing things like defaming people or discriminating against people or saying very harmful things, which again, we worried about our employees doing that with the software. Now we've sort of crossed this weird line where we have to worry about it with the software. And so we have terms that are addressing all of these issues, at least if we can get them.

6:40So I imagine that the legal burden is still on you as an individual, you as a company in terms of AI acting and operating on your behalf. There is no defense legally in court to say, well, it was my AI agent that did this autonomously. It wasn't me. It's a good question. Not so far. I mean, the argument's going to come up and it's going to come up repeatedly. The AI agent that goes and purchases 10 times more supplies than it was supposed to. And so the customer of that AI is going to not want to pay for it. And the seller is going to insist on it being paid for and sue that customer. And the customer is going to say, well, it's really nothing to do with me.

7:26It's the AI supplier. They did it. And so you're probably going to start seeing these three-way battles, but you know what the vendor's view is and what their contracts say, at least as a starting point, which is this is all on you. We can't promise that this won't happen. You have to monitor your AI, both for standard outputs and agentic features. Yeah, I think back to I was involved in financial services and, you know, we had to operate within the restrictions of third party requirements, third party management governance, you know, the Fed was watching us. And in all those instances, essentially the ownership and the leadership of a company were responsible for any outputs of a service provider.

8:14No matter if you outsource it, you're not outsourcing the risk, you're not outsourcing the accountability and responsibility for what they do on your behalf. And I feel like the same is probably true for AI. And it's harder to govern what an AI, an agentic AI agent may do on your behalf than it is a person. Yeah, that's right. I saw an interesting article in, I think it was the Wall Street Journal recently, responding to all the tech leadership, the AI leadership concern about existential risk from AI. And this op-ed pointed out something interesting, which is, this is just technology. The idea that this is going to be some rogue instrument that has ill will towards us is ridiculous.

8:57It's going to do what we program it to do. And if we don't do a good job programming it, it's on us. And the point in that op-ed was we shouldn't be giving the AI companies a pass for having raised the red flag and said, this is scary. We should all take precautions. But I think the flip side of that is the customer of the AI isn't going to get a pass either. In the end, I think the law is going to look at human systems. did the humans do a good job managing the technology, whether it's AI or a forklift? And if you didn't manage it effectively, reasonably, and it caused an injury to a third party, you're probably on the hook.

9:40You may have an indemnity from the supplier of the AI or the forklift, but you're the first line of defense and you're the first one who's going to get sued by the injured person. Yeah. Yeah. It's how you used it. When we think about the contract language, is the language that we used to just look at as being, you know, I don't really need to worry about that. Oh, that's not really a big deal to me. That now carries very different meanings because of AI. Yeah, there's a lot of that. So one of the key things that I point out a lot in our trainings is it's very typical for software as a service and other cloud hosted software our contracts to say something like, you've got all these restrictions on what they can do with customer data, but then there's a, but we can access customer data within the constraints in order to improve our systems.

10:32That seemed pretty innocuous at the time. There was actually some cautions that you should be taking around that, but most customers were generally okay with that kind of thing. Now it's got whole new meanings and the access for training could lead to all kinds of impacts. The vendors, by the way, they are often relying on this language still in order to enable them to train, which I don't recommend to them either. I think both sides need to get clear. Access to our data to improve the system, does it or does it not mean training? because if it's training that means that information in your in your in your inputs could end up in outputs for other people yeah you know there's actually a long list of these issues yeah it's not because i think back to services again it was aggregation anonymizing data and we can use that you know in the service of our services to other people um but this on one hand this is you know the next generation of aggregated and anonymized data but it actually goes further than that because it's not really aggregated well it's might be aggregated but It's not anonymized.

11:40And so, as you say, it opens you up to a whole new level of kind of exposure. That's right. And the existence of AI itself, whether you're buying it or not, has cast a shadow on all those aggregated and anonymized data terms, simply because the technology to de-anonymize has gotten better. It's easier to de-anonymize data that you thought was really secure. I don't think that aggregated and anonymized data is going away. I think the vendors are still asking for it and they're not being aggressive or greedy. There's real value to that data. It helps them understand their business and report on it.

12:20But it is problematic. And I think it's something we're going to have to watch over the years. Privacy law is very unforgiving for accidentally exposing private information. you tried but that's not necessarily going to defend you and and aggregate and anonymized data is one of those issues i think this is going to be one of the issues of our time is this data use do you do you see different approaches in different jurisdictions you know when you're working in multinational environments either you know from a cultural risk aversion or risk tolerance to what is required by law? Yeah, I definitely do.

13:02So the big gap, there's a big gap between the United States and the European Union, of course. And of course, the UK has left, but its version of GDPR is essentially the same as EU GDPR. And yeah, you have both a cultural higher risk aversion in the European Union than the US, and you have much stricter laws. So you do have more and more state laws that look like GDPR that are protecting data, rarely quite as vigorous as GDPR. But you also have just a very high level of caution. And this does become much more sensitive with AI. And of course, the European Union, you know, went out fast and came up with their sort of AI GDPR, their regulation of GDPR, which has turned out a bit problematic.

13:55They went out really fast. And now it's very hard to enforce these regulations because no one can figure out what they mean. Yeah. Now, you're in California, which is obviously the probably most advanced state in terms of regulation around things like, you know, U.S. versions of GDPR in the States. Do you see anything on the cards in terms of regulatory or legal kind of restrictions that would be coming to the U.S. that may be akin to GDPR or the use of access to and processing of data for the training of these models? Or is that something that is not really on the agenda over here in the States?

14:33So I'll display some serious folly by predicting anything that's going to happen in the U.S. federal government, but I will. I think we are relatively safe in assuming that the regulations you've started to see in the states, California's law, Colorado's law, Virginia's law, these privacy-related laws telling us what we have to say in contracts, among other things. I think it's relatively safe that when the federal government does act and create a national privacy law, which we desperately need, this does not make sense to regulate this international market state by state. I think it's relatively safe that the federal legislation when it comes will be consistent with state legislation.

15:24Obviously, we don't have a highly functional federal government at the moment, and the ability to pass a major piece of legislation like that just doesn't seem to be there. but it is silly to be regulating this kind of thing state by state and, and, you know, in our trainings and, and in our deals, we, we deal with this, like whose data do we have? I mean, there's, you know, you have data from so many jurisdictions, um, at least one nation like the United States, you'd think they could give us one law. So we don't have to try and figure out, you know, this data is governed by California and this by Virginia.

16:00And you have this, this baffling setup. Compliance becomes impossible, doesn't it? Yeah. It's, it's, there's a deep flaw in privacy law because complying with the law, not complying with the law should be what's hard, what's risky, what's difficult, what's expensive. Complying with privacy law is difficult and expensive. And a lot of people make an honest try and fail and And the law shouldn't really work that way. So it's a problem. Yeah. Do you see, you mentioned at the beginning how you're seeing, you know, lots of obviously SaaS providers, they're at different maturity in terms of how they've embedded AI into their products that we're now contracting for.

16:45Some are AI native. Some may have just put a wrapper in it. But I was doing some work this morning. We're looking at the procurement technology market. And from a positioning perspective, 98 % of the companies that we track have AI somewhere on their website in terms of how they talk about what they do. So it's basically everywhere. When we start thinking about AI coming into everything, are you seeing that as an excuse then that these providers are using to reopen contracts to say, hey, because of all this, either because our capabilities have changed or because legal risks have changed, that we now need to open up our contracts for renewal?

17:22It seems to me that it's going in one of two ways. One is just that, that they are creating this new AI functionality and they want to use it to leverage a better deal than they've had. But the other is they sort of want to get it in without changing contract terms. I mean, sometimes the vendor's strong incentive is to avoid any conversation about the contract until absolutely necessary and then get you to renew swiftly under existing terms. So we've kind of got to watch for this on both ends on the procurement side. A lot of what SaaS vendors and other cloud hosted software vendors are doing is adding AI functionality, mostly as deployers, mostly as sort of renting out AI functionality from OpenAI or Anthropic or whoever, and adding it to some existing system.

18:15and they want to add it under existing terms or maybe just a few sort of new clauses. And this requires, this is an area where I think procurement needs to be really vigilant. If you're going to have AI functionality added, you want to have a requirement in your contract for disclosure and a lot of disclosure. You really want to, you just don't want the, you know, people to get all excited in the IT team and we're buying this new thing that the vendor's providing. Just like that, it's done. Somebody signed a statement of work or an order form. You want terms that require really good information about what you're getting, what it does.

18:58Ideally, it's test history, what kinds of issues have come up. And so a lot of times what you're seeing is this sort of easy addition of AI proposed by the vendor and the customer's coming back with, here's the disclosures we need. before this goes into production. Yeah. Do you see that actually happening in the real world? Yeah, I do. It's nascent, but I think a lot of sophisticated customers have done that. So what you'll sometimes see people write in their AI addenda. So the customer wants to add, procurement team wants to add an attachment to the existing contract with a bunch of terms about AI.

19:39In some cases before the AI is even available, which can be a very good protection. And those terms say things like you got to disclose the following before you put any AI functionality online. One thing, though, I'll throw in as a as a caution about this is let's not overdo it. You also see people throw into new AI addendums terms that saying vendors shall not use any artificial intelligence in their work for us without our consent. And that gets silly. If you think about it, I understand the instinct. But what you're saying is their staff can't go onto ChatGPT and ask a question that's publicly available about our business.

20:22Or their staff can't make use of, you know, AI coding tools. When what do we care? There's IP issues if they do, but we're just the customer. What do we care? So you don't want to go crazy in the other direction either and say, well, this it's like people sometimes have done about open source. And they said, no open source software. Why wouldn't you want open source software? And so you need to have some balance and look for the things that are actually risk creating and those that are not. I have a couple of follow-ups, but just on that, it makes me think how much can we truly protect against in the use of – because we could even have that in a contract.

21:04And the reality is that people are still putting me using Copilot or using ChatGPT or whatever it is to do their work now, no matter what's in a contract, which introduces risk of that information being used, as we talked about in training. And I wonder if this is something that is, we just can't manage this risk to 100 % of being comfortable knowing what's happening with our data. And that's a new problem. That's not necessarily a legal problem. That's like, how do we think about that and mitigate that risk as a business? in expecting that it's going to happen. Yeah, I have two thoughts on that.

21:39One is you're exactly right. And we've always got to understand that the contract is the beginning of protection and enforcement. If you don't do anything to monitor the vendor's performance, all the rights in the contract, they basically buy you a lawsuit, which is the absolute last thing you ever want. So the contract is the beginning. The other side of this, though, is that you got to appreciate we got to appreciate how existing contract terms are likely to already protect us from some of the things we worry about. Like people worry that, OK, our vendor who is developing software for us is going to be using artificial intelligence to to do that work and good odds that they are.

22:27And as a result, they may give us software that infringes because the AI got software from somewhere else unbeknownst to anyone. And once the software is in production, somebody notices that it is substantially similar. It's a copyright term to someone else's software. Vendor was innocent, if careless. We were innocent. Now we've got this and we've got a lawsuit. existing contract terms actually should already protect us the fact that this happened through ai or by the way same argument about open source software the fact that it's open source software that creates this problem doesn't change an ip warranty on software we have a normal tech development deal we got a warranty saying that the deliverables won't infringe ip it doesn't matter whether it infringes IP because of AI generation.

23:23It doesn't matter whether it's because you added open source software. That warranty is there and that indemnity is there. So the concern is less that behind the scenes they're using AI to do their work. I can explain one concern that does come up about that. The concern is more, are they giving us AI functionality? And we're going to create these infringement problems because we write software, we write marketing content, we create images that infringe, and most likely they're not warranting that that won't happen. But just them using AI doesn't necessarily create new problems. We've got IP warranties.

24:06um the other thing i wanted to follow up on was you talked about an ai addendum um that that that the smart buyers are kind of putting in place but what was interesting to me is you say in some cases doing it proactively does that mean essentially you know i think about and this is going back to my experience on uh in the financial services company i was in a financial services company that um took bailout funds and became a bank overnight and as a part of that we had to put a whole load of contractual requirements in place because we're now federally regulated where we weren't before. And that required us to go look at every single contract that we had over the course of a year and essentially amend every single contract for that language.

24:45When you think about something like proactively adding an AI addendum, is it the same process? Ultimately, like we're just going to go and we're going to go and look at, you know, let's do the Pareto on our contracts and just go to everybody and put this in place proactively rather than just wait for somebody to come to us and say, hey, I want to open the contract and that's the opportunity to change it? How should we be thinking about this as a reactive versus proactive? I like proactive in general. And the good news is that the very AI tools that we're worried about help us do this. So heaven forbid you're going to hire outside counsel at hundreds or thousands of dollars an hour to go through all of your contracts and figure out where the addition of AI would create a problem, but your in-house legal department, procurement department, et cetera, hopefully has a safe, privilege-controlled, confidential AI that can do it and give you some very good recommendations on what you need to do.

25:43But whether you do that or not, I do think there's some value if you have a bunch of contracts without AI terms, which you certainly do, in the proactive approach with or without the AI analysis, you probably can assess even on your own, what kinds of issues are likely to come up if the vendors start adding AI. And so you at least prepare an AI addendum in advance, and maybe you have it ready the first time the vendor throws something in, or maybe you go even further and, and you ask vendors one by one to sign your standard form. The more you make it look standardized and non-negotiable, the better, but that's, you know, depends on the size of your vendor.

26:30Some will just sign it. Some will send you say, no, we're Microsoft. Here's our AI identity. But either way, if it says things like if you add AI functionality for our use, we're not getting into what you're doing behind the scenes. If you add it for our team's use, you're going to notify us. And the new terms say that, and you're going to provide us with whatever testing information is available. Whatever information is available, by the way, about the training data. People assume the training data is the whole internet, but that's just large language models. You may have a small language model, another small model, and they can give you really useful information about what's in the training data.

27:13The more we get that in place in advance so that the notification is required, the better. um how do we then um assess that the information like if we get disclosure and we're actually able to get the information how do we think about even assessing that i know from a procurement perspective it's probably beyond i think right from my perspective beyond my pay grade to understand what any of this stuff means even if you're asking for disclosure um you know do you do you find that organizations are there for then asking for that information when they have that disclosure language in the contract, or it's more of a, you know, it gives me protection if I ever need it.

27:53We do see in AI and other fields, a lot of information requested, which then the customer can't do anything with because no one understands it. Ideally, you have the technical capability in-house. If not, you know, if not us personally, someone in-house can assess it. That said, the information that you get about artificial intelligence is not is not always fantastically complex in fact if the vendor gives you disclosures that are baffling it may be more a problem with the disclosure quality than the underlying information i mean you want to know things like um is there a record of defamation related to this have there been complaints etc i mean there's stuff that can be relatively easily recorded.

28:41You don't need to know at sort of an in-depth level how it is, if anyone knows, that a system goes off the rails and does something that it shouldn't do and hallucinates. That's not an explanation we need. We're very often looking for what records are available about how the system has performed so far, along with, by the way, notices where performance declines. I was just writing up an AI addendum where it said they're going to A, do regular monitoring and B, annual testing. And they're going to tell us about system declines. That kind of thing may be presented in a way that's relatively understandable.

29:23And we should be asking for that. We should be asking for terms about clear disclosures. Yeah. That's a really interesting one about model quality as well, how and declines our improvements in model quality and being able to assess that. So you're still buying tomorrow what you thought you were buying today. Yeah, that's right. And keep in mind too, a lot of what the AI deployers are doing is they're providing technology that is accessing third-party AI. So they're switching around. They've got Claude and GPT-5 hooked up. And maybe you want to know if they're going to add another LLM to this existing feature because maybe you're worried about one LLM more than another.

30:03You have opinions on those. Yeah. So you have opinions on those or you want to protect against open source models or things like that. That's right. And that's not necessarily fantastically complicated information for them to disclose. Yeah. You alluded to it a little bit earlier, but I wanted to ask about your thoughts on actually using AI as a drafting mechanism for contracts are supporting contracting. I know it's a very overly general question and you sit, you know, in a seat of somebody who, you know, has done a lot of legal drafting, a lot of contract drafting. What's your perspectives on using AI as an aid to draft contracts, to draft clauses, to assess clauses for points of risk, things like that?

30:49Yeah, I have many thoughts on this, not surprisingly, because we make a lot of use about it. And we actually train people on how to use AI models, how to use them effectively. So a bunch of things. One is, I think one of the key things that we all need to recognize is that artificial intelligence tends to make the same mistakes we do. So there's a, you know, we all have dealt with the AI output that is absolutely confident of its answer, and it turns out wrong. And that's, you know, it's no different with drafting. What you very often get is mistakes that look familiar. I see this all the time that my students make, my staff makes, my parties on the other side of the deal make, because the AI is trained on everything out there about how to do these contracts.

31:41So it's picked up all of our mistakes. I often compare it to the news. So AI is actually not so bad at reporting the news because you have crazy stories on the right and crazy stories on the left, and you have sort of a bell curve of better stuff in the middle, and the AI can make sense of that. Contracts are less like a bell curve and more like a pyramid with the good stuff at the top, and the base is lower quality contracts. So first question on using the AI is, are you over trusting it? Are you, we've got to avoid assuming that it's confident answer is right. We've got to look for the same kinds of flaws and issues that we do in other types of, in human work.

32:29Yeah. The other side of it too, is you need to understand the pattern of success and failure from AI models. So for instance, an AI model that is specialized on contract drafting and legal issues, which I've been using something lately, what it's going to likely do is overcompensate. It's going to give you ridiculously long clauses addressing everything that could possibly go wrong at a level that's going to bog down your deal, addressing things that are not necessarily relevant, but it has been trained to throw in the kitchen sink. again with human issues littered in yeah but but but overly done whereas you use a you know use a just raw foundation model or something without that particular training you're likely to get under coverage under compensation it's going to miss stuff because it doesn't have it's going to miss more because it doesn't have the underlying stuff so another question is do i really understand what I'm getting?

33:31And am I prepared to respond to it? Am I prepared to say, this is overbaked what it's giving me? All in all, there's no way out of the human still needing to know what they're doing. There's just no escape. Like everything, it's more powerful in the hands of people who understand the underlying content and more dangerous in the hands of those that don't and are just relying on it to create something that they don't really understand. And that's right. It's it's that is absolutely right. All of this said, so I've been giving you cautions. The tools are really useful. I think, you know, they obviously can do things we can't like I was talking about, you know, reviewing your thousands of contracts at once and noting patterns or issue spotting.

34:16I mean, no matter how expert you are, you get tired, you're hungry, whatever. You miss things that the AI won't miss. I wouldn't rely on it as the only issue spotter. But supplementing your issue spotting, it's just wonderful. Saving time on putting clauses together. If you're comfortable reviewing its clause and feel relatively confident, you'll know when the clause is problematic. Yes, it'll save you so much time. So I absolutely think we should be using the tools and we will. We've just got to understand their strengths and weaknesses. Yeah. Now, I have one last question. This isn't related to AI at all, but it's actually something that I'm very passionate about when it comes to contracting.

34:57And you kind of mentioned something earlier, so that's why I wanted to bring it up, is this idea of a contract being a relationship, a roadmap for a relationship, and a contract being like my view of the world was always, if I ever look at the contract again after I've signed it, then there's a problem. And so I want to draft something which basically creates the foundation for a really strong relationship that I never have to go and look at it ever again. And I just wonder how you think about that in terms of how you go about contracting to maximize the chances that that will be true, that you will never actually have to go back to it ever again because you did such a good job of contracting in the first place.

35:37I don't look at it quite that way. I'm actually glad you asked this because there's a series of points made in the introduction to my book, The Tech Contracts Handbook, that addresses what contracts are for. And one of the points made is we don't sign contracts in order to win or manage disputes later. We sign contracts because good fences make good neighbors. The contract is the fence or the contract is another way to put it, particularly things like orders and statements of work. It's the how-to guide, the instructions manual for the relationship. So I don't feel like the contract is only there to go look at if you've got a problem.

36:19If it's done well, it should be a guide to what everybody was supposed to do. A lot of times you get to the following has happened and we don't know what to do. Has something gone wrong? If the contract is done thoughtfully, it is a really good chance that it will answer the question. And a lot of time people get into trouble and litigation. And I work as an expert witness, so I testify in these cases where the contract actually gave an answer three years ago, if you had looked at it and everybody would be, you know, everybody would be getting along or at least the dispute would have been headed off earlier.

36:57So I do feel like a good contract, it's not that we're constantly holding it up and it's guiding us or we're shoving it in the other party's face and saying, you were supposed to do this. But if done well, it's a roadmap for the relationship. And that actually is very encouraging for, I think, procurement people whose job it is to generate the contracts. Because it's not clerical. It's not risk management. It's not just something that you're preparing for a fight later. it should be a really useful tool. And actually, let me, I know this is going beyond your question, but let me throw something in about too.

37:33A lot of times we're made to feel bad about the time we spend negotiating, the business team who wants this thing. We're stuck in legal all this time. Yeah, it's stuck in legal, it's stuck in procurement, they don't know how to get a deal done. The things that, by us raising issues in the beginning and even triggering a battle over them, we are not just getting the contract done, but we're getting an understanding of what can happen in the deal out and addressed and agreed upon before it happens instead of after when it's more likely to lead to a dispute. These battles that we sometimes trigger in contract negotiation are very productive because they resolve it in advance.

38:18People don't even know about the issues until the other side mentions it, that's extremely valuable. That's part of what we are adding doing contracts. It makes contracts being much more of a strategic activity rather than something we feel like, why is all these people taking all this time to do it and it's slowing down my deal? And we have to position that with our stakeholders. Who wants you and anybody just to sign off on anything? Or they'll come and say, we're ready to do the deal. Can you just sign the contract? Yeah. And the answer to that is, no, you're not ready to do the deal. You've got 80%.

38:50I mean, you've got 20 % of the terms of the deal. You don't even know what you need. You didn't get the other 80. Right. Well, David, I want to thank you so much for joining me. What I'll do is I'll put a link to your LinkedIn profile. I'll put a link to Tech Contracts Academy and also your book, The Tech Contracts Handbook. There's links in our show notes for today's episode. Those are all going to be at www.artofprocurement.com slash podcast. You'll just be able to search for David Tolland. you'll find this conversation right there with all those links within it. It's been a pleasure to speak to you and to welcome you onto the podcast finally.

39:24So thanks for joining me, David. Thank you so much for having me. It was fun.

39:31If this episode struck a chord with you, please do send it to somebody. We grow here at Art of Procurement through word of mouth, and that would be really appreciated. You can also support us by giving us a thumbs up, a star rating or a review wherever you listen to your podcasts. Since 2015 we've built the world's largest free resource for procurement professionals looking to elevate their impact. Our resources span podcasts like this, videos, blog posts, papers and events. To join us on the inside and to ensure you never miss an episode, a webinar, an event or a post please do subscribe to our weekly newsletter This Week in Procurement.

40:08You can do that at artofprocurement.com slash subscribe that's art of procurement.com slash subscribe thank you for joining us today and I look forward to seeing you again soon