Most MSPs have a contract. Far fewer have a contract that actually protects them when something goes wrong. That gap was the focus of a recent webinar hosted by Gradient and Monjur, where Colin Knox, co-founder and CEO of Gradient MSP, sat down with Rob Scott, co-founder and CEO of Monjur and managing partner of Scott & Scott, a law firm that has represented MSPs for more than 25 years.
The conversation covered the clauses that decide whether a claim is a nuisance or a company-ending event, why AI-drafted agreements fall short, how waivers really hold up, and how to move an existing client base onto better paper. Here is a full recap of what MSP owners need to know.
This recap is for general education and is not legal advice. Talk to a qualified attorney about your specific agreements.
An AI-generated MSA lacks the vertical context that managed services contracts require, so it often misses the protections an experienced MSP attorney would consider essential. Rob calls this "shadow AI for legal": MSPs with few affordable legal options turning to unsupervised AI tools for contract drafting.
Illustrative example: One MSP spent seven hours building a full customer contract stack with a leading frontier AI model, using a collection of sample agreements as input. When Monjur ran it through its MSA review, an objective framework of key provisions, it scored 22 out of 100. Many required elements were missing entirely.
Rob ran a similar test with one of his own business development reps, who asked the fair question of why an MSP wouldn't just use ChatGPT. They prompted the best MSA they could, then placed it next to Monjur's. The difference in depth and specificity was dramatic, and it all came down to context.
The takeaway is not that AI is useless. Starting with a law firm grade set of agreements and then using AI produces far better results than starting from a blank prompt. A general model can write a decent contract for a house painter; it does not know the nuance of modern managed services across state, provincial, federal, and international jurisdictions.
The most important clauses are the risk-balancing provisions: indemnity, limitation of liability, and insurance. In Monjur's Shield, Lock, and Grow framework, these "shield" provisions decide whether a security incident, data breach, or ransomware attack is a nuisance or a close-the-company problem. As Rob put it, people make mistakes, and one technician's error shouldn't cost you your business.
What is indemnity? Indemnity is the contract concept that decides which of the two parties will be legally responsible for future claims brought by third parties.
Rob shared several of the top clauses Monjur's framework checks for:
|
Clause |
What it does |
Why it matters |
|---|---|---|
|
Limitation of liability |
Caps what the MSP can owe if something goes wrong |
Keeps a single claim from becoming existential |
|
Indemnity |
Assigns responsibility for third-party claims |
Prevents the MSP from absorbing risk that isn't theirs |
|
Insurance (no subrogation) |
Stops the client from assigning their carrier the right to sue you after a payout |
Closes a common back door to litigation |
|
Mandatory arbitration, no court carve-outs |
Keeps disputes out of public court records |
Fee disputes often spark false public claims about service quality |
|
Free assignability |
Lets you assign client contracts if you sell the business |
Protects the value of your MSP at exit |
|
Third-party services schedule |
Waives claims against the MSP for listed vendors' acts or omissions |
Addresses vendor risk you can't negotiate away |
Vendor risk is one of the areas almost nobody has figured out. Vendor agreements typically say the vendor has no relationship with your client, and that you must indemnify the vendor even when the vendor is at fault. That leaves the MSP stuck in the middle: the client points at you, and you have no recourse.
Monjur's answer is a schedule of third-party services covering roughly 1,200 tracked vendors. When a client signs a quote powered by Monjur's online terms, they also agree to waive the right to sue the MSP for any act or omission of the vendors on that list.
Illustrative example: Colin pointed to two recent incidents involving backup vendors, one where hardware failures wiped retention history for a subset of partners, and one where a backup tool's admin access to Microsoft 365 tenants was exploited at scale. If your agreement promised specific retention periods or recovery objectives, those vendor failures land on you unless your contract says otherwise.
For most MSPs, the honest answer is no. Even a well-written MSA was not designed for the AI era. Concepts like hallucinations, input and output data, model training, APIs, and MCP servers simply weren't contemplated when managed services contracts were first written.
When Colin polled the live audience, only about 10 to 20 percent said their agreements address AI at all. One attendee noted that only their newest agreements include it, and it hasn't reached legacy clients yet.
That matters because AI is already inside your stack. AI agents are triaging tickets, and those tickets may contain protected health information. Endpoint tools are rolling out AI-driven remediation. Every one of those touchpoints raises questions about data exposure and liability.
Monjur addressed this in 2024 with a service attachment for managed AI. It rides alongside your MSA, the same way a managed services or managed compliance attachment would, and covers AI-specific liability exclusions and client obligations. If you offer readiness assessments, Copilot implementations, app development, or support any AI tools, Rob says you need this coverage now.
On their own, waivers are weak protection. Courts construe waivers narrowly as a matter of public policy, so any ambiguity tends to be read against the party relying on the waiver.
What makes a waiver enforceable? In most jurisdictions, a waiver must be a clear and unequivocal waiver of a known right. If the scope is vague, the intent is uncertain, or the client didn't know which rights were in play, the waiver is likely to fail.
This is the problem with asking a client to sign a waiver after declining MFA, backup, or AI governance. Waiting until the moment of refusal, or worse, after an incident, puts all the power in the client's hands. If they simply don't sign, you have nothing.
Rob's recommendation is to handle declined services at the relationship formation stage, inside the MSA itself. Monjur's agreement includes a security recommendations provision that says, in essence, the MSP may make security and compliance recommendations from time to time, and if the client refuses one, the client is responsible for the outcome. Once that clause exists, all the MSP has to do is make the recommendation.
Waivers still have a role as a sales tool layered on top of a strong MSA. When clients are asked to formally sign away protection, a high percentage choose to sign the quote instead. That's good for your business and good for the client, as long as you don't rely on the waiver as your only line of defense.
You don't need a mass re-signing campaign. Rob recommends treating contracting as a dynamic, evergreen process rather than a static document signed once and forgotten. Services evolve, laws change, and client needs shift, but many MSPs are still relying on paperwork from five years ago.
Here is the approach he outlined:
What is incorporation by reference? Sometimes called browser wrap, it's language in a quote stating that by accepting the quote, the client agrees to online terms linked from it. Rules vary by jurisdiction. In Quebec, for example, Monjur's partner law firm advises against relying on it. Where tools allow, Rob prefers an affirmative checkbox where the signer confirms they read the terms and have authority to bind the company.
Colin raised a common scenario: office managers, accountants, or co-managed IT leads signing agreements. Legally, you generally only need apparent authority, meaning the person acts as if they can bind the company. Getting them to explicitly represent that authority is stronger still. And if someone has the authority to buy the laptop, they have the authority to bind the company to the terms that come with it, including a new MSA. The one exception: if you actually know the signer lacks authority, don't rely on their signature.
A strong contract defines what you promised. Your billing has to reflect it. Gradient helps MSPs make sure the agreements they've signed are accurately represented in their PSA, and that vendor usage, costs, and client quantities line up across every service.
That accuracy is also a contract compliance check. Many MSPs bundle security, backup, and other services into a single per-user or per-device price, which means counts should be consistent across every vendor in the bundle.
Illustrative example: A client has 34 users, and you're billing 34 seats for nearly everything in your stack. But your MFA vendor shows only 28 licenses. That gap may not change the invoice, but it means six people are unprotected, and you've likely promised otherwise. With Gradient, you see the discrepancy and can get those users covered before it becomes a liability.
Take the next step:
Having a contract is the starting point. Being protected means your agreements, your services, and your billing all tell the same story.
Can I use ChatGPT or another AI tool to write my MSP's MSA? You can, but expect gaps. Without managed services context, AI-drafted agreements tend to miss key protections. In one case, an AI-built contract stack scored 22 out of 100 on Monjur's review framework. Starting from law firm grade agreements produces far better results.
What is the most important clause in an MSP contract? The risk-balancing clauses: limitation of liability, indemnity, and insurance. Together they determine whether a claim is manageable or threatens the survival of your business.
Will a signed waiver protect me if a client declines a recommended service? Not reliably. Courts read waivers narrowly and require a clear, unequivocal waiver of a known right. A security recommendations clause in your MSA, agreed at the start of the relationship, offers stronger protection.
How long does it take to move all clients onto a new MSA? With terms attached to every quote and legacy auto-renewals stopped, most MSPs reach full standardization in about 18 months or less.
Does my MSA need to address AI? Yes, especially if you offer or support any AI services. Traditional MSAs don't cover concepts like hallucinations, model training, or input and output data. A dedicated managed AI service attachment fills that gap.