You Added an AI Subprocessor Last Month. Which of Your 214 Signed MSAs Required 30 Days' Written Notice First?

Who at your company can answer this, today, without guessing: of the 214 master service agreements you have signed, how many require you to give written notice before you add a new subprocessor, and how many days' notice does each one demand?

If the honest answer is "our general counsel would need a week", you are in the normal position. And it stopped being a theoretical question in 2026, because almost every B2B software company added at least one AI provider to the list of companies that touch customer data. That addition is a subprocessor change. Your data processing addendums have clauses about it. Nobody read all of them.

Where did the obligations spreadsheet go?

Every company that has been selling for more than four years has the same artifact: a contract obligations spreadsheet. It was built once, usually by a paralegal or a diligent operations person, listing each customer, their uptime commitment, their breach-notification window, their data-deletion window, and whether they have a most-favoured-nation clause on pricing. It was accurate on the day it was finished. Then the person left, three enterprise deals got signed with heavy redlines in a quarter-end scramble, two amendments were executed by email, and the spreadsheet quietly became fiction.

Meanwhile the source documents are scattered exactly the way you would expect. Signed agreements in DocuSign or Ironclad. Order forms in a Salesforce attachment. A handful of the oldest contracts as scanned PDFs in a Google Drive folder from before you moved to Ironclad, with a countersignature page photographed at an angle. Data processing addendums with a Standard Contractual Clauses annex listing your subprocessors as of 2023. Security exhibits with a 24-hour breach-notice clause in three of them and 72 hours in the rest.

The pile is not complicated — it is just larger than any single person can hold in their head at one time, which is a different problem and one that finally has an answer.

What changed: the whole signed set fits into one question

Through 2024 and 2025, asking software to read your contracts meant cutting them into pieces first, because nothing could take a whole document set at once. That cutting is exactly where contract questions go wrong: the definition of "Subprocessor" lives in section 1, the notice obligation in section 8.4, the carve-out in an amendment signed nineteen months later, and the actual notice address in an exhibit. Chop the documents up and the pieces stop referring to each other.

With Claude Opus 4.6's million-word working memory, that constraint is gone for a document pile of this size. You can hand over an entire signed agreement — master agreement, every amendment, the order form, the data processing addendum, the security exhibit — and ask one question about the whole of it. No page references, no "which section do you mean". Do that 214 times and you have the answer your spreadsheet was supposed to give you, built from the actual signed paper rather than from someone's memory of it.

flowchart TD
  A["One question: who must be told before we add a subprocessor?"] --> B["214 signed agreements, amendments, DPAs and order forms read whole"]
  B --> C["Notice required, number of days found"]
  B --> D["Silent - no notice obligation"]
  B --> E["Written consent required, not just notice"]
  C --> F["Table: account, days, notice address from the DPA"]
  D --> F
  E --> F
  F --> G["Counsel reviews only the consent-required accounts"]
  G --> H["Notices sent from the named contact on file"]

The Tuesday this actually happens on

Your VP of Engineering wants to switch the summarisation feature in your product to a different AI provider on the first of next month. That is a subprocessor change, and it starts a clock you cannot see.

By nine, your operations lead has exported every executed agreement from Ironclad, plus the pre-2023 scans from Drive. By eleven, the run has produced a table with one row per account: does the agreement mention subprocessors at all, is the obligation notice or consent, how many days, is there a right to object, and what happens if the customer objects — termination right, or nothing. It also flags the contracts where the clause was struck out entirely in redline, which is exactly the sort of thing a spreadsheet never captured.

The result is usually lopsided and reassuring. Most self-serve and mid-market customers signed your standard paper with no subprocessor notice obligation at all. A cluster of enterprise accounts — the ones whose security teams sent you a 300-line questionnaire — require 30 days' written notice. A much smaller group, often the healthcare and financial services logos, require written consent, and those are the ones your counsel needs to see personally. Eleven accounts you have to actually work on is a manageable Tuesday. Two hundred and fourteen accounts you cannot see into is not.

The second question the pile could never answer: who is owed a credit

The same read gives you something your finance team has wanted for years. You had a 71-minute outage. Who is owed a service credit, how much, and do they have to ask for it?

Here is the arithmetic on an illustrative company. Assumptions: $9.1M in annual recurring revenue, so roughly $758,000 a month; a 30-day month is 43,200 minutes, so 71 minutes of downtime is 99.836% availability. Standard paper promises 99.9% with a 10% monthly credit, claimable only on written request within 30 days. Negotiated enterprise paper promises 99.95%, with a 25% credit, and in fourteen of those agreements the credit is automatic — no request needed — while five require you to notify the customer proactively within 24 hours of an incident.

The third row is the one worth the exercise. A missed 24-hour notification is not a $2,000 credit — in a couple of those agreements it is a cure-and-terminate right sitting in the customer's pocket for the next renewal negotiation. Finding those five accounts by lunchtime on the day of the incident, rather than during the post-mortem three weeks later, is the difference between a routine outage and a bad quarter.

Why this is not your lawyer, and what still goes wrong

This produces a reliable inventory, not a legal opinion. The distinction matters. "Section 8.4 requires 30 days' written notice to the address in Exhibit B" is an inventory answer and it will be right. "Does adding this provider actually count as a subprocessor change under this definition?" is a judgement, and it belongs to your counsel — once, as a policy, applied across the whole table.

Three practical failure modes. Scanned documents from your early years read badly, especially handwritten margin notes and initialled changes on a signature page; treat anything that came in as an image as needing a human read. Amendment chains are the second: if the fourth amendment replaced section 8 wholesale and someone filed it as "MSA_final_v2_signed.pdf", you have to hand over the whole chain or you will get a confidently outdated answer. Third, the answer is only as complete as the folder you handed over — if two of your largest agreements live in a former founder's email, no amount of reading power finds them.

Give it thirty minutes of verification before you trust it at scale: take ten agreements you personally know well, run the question, and check every one by hand. If it gets ten out of ten, you have earned the right to believe row eleven.

Frequently asked questions

Do I have to send our contracts to an outside company to do this?

You are already sending contracts to DocuSign, Ironclad and your outside counsel, so the question is not whether a third party sees them but under what terms. Use a business plan with no training on your data, restrict who inside the company can run it, and check your own customer agreements first — some enterprise paper restricts where your records may be processed, which is precisely the sort of clause this exercise finds.

How current does this stay?

It is a snapshot, not a live system. Rerun it when you sign meaningful new enterprise paper, and always before a subprocessor change, an acquisition diligence request, or a fundraise. Quarterly is a reasonable rhythm for a company signing a handful of negotiated deals a quarter.

We are 30 people and only have 40 negotiated contracts. Is this worth it?

Forty contracts is roughly a week of a person's careful reading, and that person will still miss things at hour thirty. It is worth it mostly because you will run the question ten more times — change-of-control clauses before an acquisition offer, price-increase rights before a January uplift, security commitments before a SOC 2 audit — and each of those used to be another week.

What about the EU AI Act deadline?

The 2 August 2026 obligations reach US software companies whose systems affect users in the EU, and your existing customer agreements often already promise cooperation with the customer's own compliance duties. The same read tells you which of your agreements contains that promise, which is the first thing you need before deciding what you owe anyone.

Start with the outage question

Pick your last incident, gather the signed agreements for the twenty largest accounts affected, and answer one question: which of them were owed something, and did we do it? It is a small enough job to finish before lunch and it will tell you immediately whether your obligations spreadsheet is still true.

Related, and worth a thought: the hours after an incident are when your phone line and web chat get hit hardest, and that is exactly when your support team is busy on the incident itself. CallSphere builds AI voice and chat agents that answer inbound lines and website chat, capture who is calling and about what, and route the ones that need a person — so the enterprise account with the 24-hour notice clause does not sit in a queue behind everyone else.