From Madhur Jain | Product & Market Analysis
An AI Agent RFP Template for Replacing a SaaS Tool, Clause by Clause
On this page
Replacing a SaaS tool with an agent means signing one contract while unwinding another. A standard software RFP only covers the first. Under the EU Data Act, a cloud customer's switching terms must guarantee at least 30 calendar days to retrieve data after the transition ends. This AI agent RFP template has 9 sections, and every clause traces to a public procurement rule or a published vendor contract.
Key takeaways
- A SaaS replacement RFP has to govern two exits, not one. You need data out of the incumbent tool before you cancel it, and a tested route back to it if the agent fails in production.
- Public buyers already wrote most of the clauses you need. OMB memo M-25-22, GSA's proposed AI clause and the EU's model AI contract clauses cover portability, training bans and documentation in plain language.
- The EU Data Act sets the exit numbers worth copying. Article 25 caps switching notice at 2 months, sets a 30-day transition and requires at least 30 days of data retrieval afterwards.
- Agent contracts often say nothing about export at termination. Anthropic's Commercial Terms, effective 17 June 2025, state that on termination the customer may no longer access the services, so the export right has to be negotiated in.
Why a SaaS replacement RFP is a different document
A normal software RFP assumes a greenfield purchase. You describe needs, vendors respond, you pick one and sign.
Replacing a point SaaS product with an agent breaks that assumption in three places. The agent does work rather than storing records, so you buy an outcome instead of a feature list. The agent acts on your data and systems, so audit access stops being optional. And the incumbent tool still holds your history, so its exit terms decide your timeline.
I think most teams get the third point wrong. They negotiate hard with the new vendor and then discover the old contract auto-renews, or that export takes a support ticket and three weeks. That pattern is part of why so much software lingers after it stops being used, a problem measured in the analysis of companies running 291 apps.
What an agent RFP adds to a feature RFP
A feature RFP asks whether the product can do a thing. An agent RFP asks how often it does the thing correctly, on your data, and what happens when it does not. Those are measurement questions, and they need a baseline you probably do not have yet.
It also asks what the vendor can change without telling you. A SaaS vendor ships a new screen. An agent vendor can swap the underlying model, which changes behaviour on every task at once.
The two exits you are actually planning
The first exit is from the incumbent SaaS tool. You need a full export, in a usable format, before the cancellation date, plus an overlap period where both systems run.
The second exit is from the agent vendor, if the pilot fails or the vendor changes terms. This is the rollback route, and it only works if you kept the incumbent's data and process documentation alive. Treat both as requirements in the RFP, not as clean-up work after signature.
How to use this agent RFP template
The template below has 9 sections in three groups. Sections 1 to 3 define the outcome and how you will test it. Sections 4 to 6 cover data rights and audit access. Sections 7 to 9 cover export, rollback and the charges attached to leaving.
Each clause names its source. Paste the clause text into your own RFP, then hand it to counsel. Nothing here is legal advice.
| # | RFP section | Source it traces to |
|---|---|---|
| 1 | Outcome definition | OMB M-25-22, test solutions during evaluation. |
| 2 | Baseline from the incumbent | EU Data Act Art. 25(2)(e), exhaustive list of exportable data. |
| 3 | Acceptance test and parallel run | OMB M-25-22, testing and documentation for high-impact uses. |
| 4 | Data ownership and no training | OMB M-25-22; GSA proposed GSAR 552.239-7001; Anthropic Commercial Terms. |
| 5 | Model change notification | GSA proposed clause, 7-day notice; 30-day disclosure of AI systems. |
| 6 | Audit access and incident reporting | EU MCC-AI templates; GSA proposed clause, 72-hour incident report. |
| 7 | Data export at exit | EU Data Act Art. 25(2)(a), (d) and (g); GSA export tools requirement. |
| 8 | Rollback and knowledge transfer | OMB M-25-22, knowledge transfer and portability. |
| 9 | Switching charges and deletion | EU Data Act Art. 25(2)(h) and Art. 29. |
The GSA clause is a proposal published in March 2026, not a final rule. The EU model clauses are non-binding. Both are cited as drafting precedent, not as obligations on a private buyer.
Sections 1 to 3: outcome definitions, baseline and acceptance
Outcome definitions are where an agent RFP differs most from a SaaS RFP. You are not asking for a capability. You are asking the vendor to commit to a measurable result on a defined task, against a number you already hold.
Section 1: Define the outcome as a task, a rate and a sample
OMB memo M-25-22 tells federal agencies to test proposed AI solutions during evaluation to the greatest extent practicable. That reading comes from CASRAI's comparison of the memo. Copy that instinct. Write the outcome as a task, a pass rate and the sample it is measured on.
Clause text: The Vendor shall state, for each task in Schedule A, the expected completion rate without human correction. The rate shall be measured on a sample of no fewer than [N] cases drawn by the Buyer from production records. The Vendor shall run this test on Buyer data during evaluation, before contract award.
Pick N yourself. The point is that the buyer draws the sample, not the vendor. A vendor-selected demo set measures the demo, and the gap between pilot and production is covered in the five sections most agent RFPs leave out.
Section 2: Pull the baseline out of the incumbent first
You cannot judge a completion rate without knowing what the current tool and team achieve. That number usually lives inside the incumbent SaaS product, in reports and logs you may lose at cancellation.
The EU Data Act requires cloud switching contracts to carry an exhaustive specification of all categories of data and digital assets that can be ported, under Article 25(2)(e). Use that as your checklist. Ask the incumbent for the list, then export every item on it before the RFP closes.
Clause text (to the incumbent): Provide an exhaustive list of all data categories and digital assets held for the Buyer. Include activity logs, configuration, workflow rules and report definitions, with the export format for each.
Section 3: Acceptance test and parallel run
Acceptance for an agent should be a period of running both systems on live work, not a sign-off meeting. During the parallel run, the incumbent remains the system of record and the agent's output is checked against it.
Clause text: Acceptance requires the agent to meet the Section 1 rates across a parallel run of [X] weeks on production volume. The Buyer may extend the parallel run once at no cost if the rates are not met.
The "extend once" wording borrows from Article 25(5) of the Data Act, which gives a cloud customer the right to extend a transition period once.
Sections 4 and 5: data rights, training bans and model changes
An agent reads more of your data than the tool it replaces, and it produces outputs that may themselves be sensitive.
Section 4: Ownership of inputs and outputs, and no training
Start with the federal rule. M-25-22 tells agencies to "permanently prohibit the use of non-public inputted agency data and outputted results" to further train publicly or commercially available AI algorithms, absent explicit consent. Note that it covers outputs, not just inputs.
GSA's proposed clause goes further. Wiley Law reports that it bars the contractor from using government data for any purpose other than performing the contract, including to train, fine-tune or improve the AI system. Anthropic's Commercial Terms, effective 17 June 2025, state that "Anthropic may not train models on Customer Content from Services," and that the customer owns its outputs.
Clause text: The Buyer owns all inputs and outputs. The Vendor shall not use Buyer inputs, outputs or derived data to train, fine-tune or improve any model, including through subprocessors, without the Buyer's prior written consent.
Ask whether the vendor's model provider is bound by the same term. An agent vendor that resells a foundation model is only as good as the upstream contract. That is why the terms in the AI clauses to add to a data processing agreement matter here.
Section 5: Notice before the model changes
This is the clause with no real equivalent in a SaaS RFP. Per Wiley Law, GSA's proposed clause would require contractors to notify the government within 7 days of any change that materially increases output bias or decreases safety guardrails. It would also require disclosure of all AI systems used within 30 days of award.
A private buyer should want both, and should want notice before the change, not after. Model swaps also change cost, which is covered in the breakdown of model switching costs and lock-in.
Clause text: The Vendor shall disclose all models and AI systems used to deliver the service within 30 days of award, and give 30 days' written notice before changing any of them. Where a change causes Section 1 rates to fall below the accepted level, the Buyer may terminate without penalty.
Section 6: audit access, logs and incident reporting
Audit access is the second section a SaaS RFP rarely needs. When the software only stores records, you can inspect the records. When it takes actions, you need the reasoning trail and the action log, and you need them in a form you can keep after the contract ends.
What the EU model clauses ask for
The EU's model contractual clauses for AI procurement were updated on 5 March 2025, according to the European Commission's public buyers community page. There is a full version for high-risk AI and a light version for other systems. Both are built on the AI Act's Chapter III requirements for documentation, record-keeping and transparency. They are non-binding and leave out liability, IP and acceptance, so treat them as an annex to your contract.
Use the light version as your starting point unless the agent falls into an AI Act high-risk category.
Clause text: The Vendor shall retain a log of every action the agent takes on Buyer systems, with timestamp, input, output, model version and any human approval. Retention runs for the contract term plus [12] months. The Buyer may export the log at any time in a documented open format. The Vendor shall report any security incident affecting Buyer data within 72 hours.
The 72-hour window mirrors GSA's proposed clause, which Wiley says requires incident reporting to CISA within 72 hours with daily status updates. The field list for the log itself is set out in the agent audit log specification, and I would attach it as a schedule rather than retype it.
Sections 7 to 9: data export, rollback and switching charges
Exit terms are where the published sources are most specific, and where vendor paper is often thinnest.
Section 7: Copy the Data Act's exit clock
Article 25 of the EU Data Act sets the exit clock for data processing services. Switching contracts must include a maximum notice period of two months, a 30-calendar-day transition and at least 30 calendar days of data retrieval afterwards. If the switch is technically unfeasible, the provider must say so within 14 working days and propose a transition of no more than 7 months.
Those numbers bind providers serving EU customers, from 12 September 2025. They are also a sensible default for anyone else.
Clause text: On notice of termination, the Vendor shall provide a transition period of up to 30 days and a data retrieval period of at least 30 days after transition. During retrieval, the Buyer may export all data listed in Schedule B in the formats stated there. Notice shall not exceed two months.
Why the agent vendor's own paper may say nothing
Do not assume export rights exist. Anthropic's Commercial Terms, effective 17 June 2025, say in Section I.4 that "Upon termination, Customer may no longer access the Services." The terms contain no export window. Data handling sits in a separate processing addendum, which a buyer has to read alongside them.
API-first vendors often hold little persistent customer data. An agent vendor building on top of them may hold a lot: memory, logs, task history and configuration. Ask the agent vendor, not the model provider, for its export terms in writing.
Section 8: Rollback and knowledge transfer
Rollback means returning the work to the incumbent tool, or to people, if the agent fails. It needs three things. The incumbent's data and configuration stay intact through the parallel run. Process documentation stays current enough to restart. The vendor hands back anything the agent learned about your process.
CASRAI's summary of M-25-22 says solicitations should seek knowledge transfer, data and model portability, clear licensing and pricing transparency. It also describes a separate lock-in protection step triggered as soon as a decision not to extend is made. Rollback planning should start the day you decide to leave, not the day the contract ends.
Clause text: On notice of non-renewal or termination, the Vendor shall deliver within 30 days all prompts, workflow definitions, tool configurations, evaluation sets and documentation created for the Buyer, in editable form. The deliverables shall be sufficient for the Buyer or a successor to operate the process.
The wider set of routes out of a point tool is mapped in the escape routes from a point solution.
Section 9: Switching charges and certified deletion
Under Article 29 of the Data Act, providers may charge only reduced switching costs until 12 January 2027. From that date they may not impose switching charges at all, according to Faegre Drinker's analysis of the Act. Early termination penalties are a separate thing and may still apply, so ask about both by name.
Article 25(2)(h) adds the closing step: a clause guaranteeing full erasure of all exportable data and digital assets once the retrieval period ends.
Clause text: The Vendor shall charge no fee for data export or transition assistance. The Vendor shall list any early termination fee in the pricing schedule. After the retrieval period, the Vendor shall erase all Buyer data, including backups and logs, and certify erasure in writing within 30 days.
Scoring the responses to a SaaS replacement RFP
Weight the sections by how hard each would be to fix after signature. Features can be added in a release. An exit clause can only be added at renewal, when your bargaining position is weakest.
| Section group | Weight | A weak answer looks like | A strong answer looks like |
|---|---|---|---|
| Outcomes and acceptance (1 to 3) | 35% | Benchmark scores on public datasets | A rate measured on your sample during evaluation. |
| Data rights and model changes (4 and 5) | 25% | "We take privacy seriously" | A no-training clause that binds subprocessors, plus advance notice. |
| Audit access (6) | 15% | Dashboard access only | Exportable action logs with model version per action. |
| Exit, rollback and charges (7 to 9) | 25% | "Data available on request" | Stated retrieval window, formats, deliverables and zero export fees. |
| Where the weak answer is fine | A vendor holding no persistent data can answer Section 7 briefly. Score the substance, not the length. | ||
Outcome pricing changes the scoring. If the vendor bills per resolved task, Section 1's definitions become billing definitions too. Put the clauses that make outcome pricing enforceable in the same schedule.
Where this template is weakest
This template has real gaps, and it is better to know them before you paste it into a live process.
The sources bind other people
M-25-22 binds US federal agencies. GSA's clause is a proposal. The EU model clauses are voluntary, and the Data Act protects customers of data processing services in the EU. A private buyer outside the EU gets none of these rights by default. You are borrowing their drafting, not their enforcement, and a vendor can simply refuse.
Several M-25-22 points also reach this post through CASRAI's secondary summary rather than the memo text, because the PDF did not extract cleanly during research. Check the memo itself before you quote it to a vendor.
A small buyer has little bargaining power
A team buying 20 seats will not get a bespoke audit clause from a large agent vendor. In that case the template still works as a scoring tool. Ask every question, record which vendors answer in writing, and treat silence on exit as a cost. I would rather pick the vendor with a weaker agent and a written export clause than the reverse.
There is also a fair counter-case. For a low-stakes, easily reversed process, a 9-section RFP is heavier than the risk deserves. If you can rebuild the workflow in a week and the data is not sensitive, a short trial and a written export promise may be enough.
Frequently asked questions
What should an AI agent RFP template include?
An AI agent RFP should include an outcome definition measured on your own data, a baseline from the tool being replaced, an acceptance test with a parallel run, data ownership and no-training terms, notice of model changes, audit log access, data export at exit, rollback and knowledge transfer, and switching charges with certified deletion. Each of those maps to a published public procurement rule or vendor contract.
How is a SaaS replacement RFP different from a normal software RFP?
A SaaS replacement RFP governs two exits. You must extract complete data from the incumbent tool before cancelling it, and you need a tested way back if the agent fails. A normal software RFP assumes a greenfield purchase and treats exit as a contract formality. Replacement also needs a baseline, because the agent's performance is judged against what the old tool achieved.
How long should the data export period be after terminating a SaaS contract?
The EU Data Act offers a useful benchmark. For data processing services in the EU, switching contracts must allow a transition of up to 30 calendar days and then at least 30 calendar days to retrieve data, with notice capped at two months. Outside the EU no such rule applies by default, so write a retrieval window into the contract explicitly.
Can an AI vendor train on my company data?
It depends on the contract. Some commercial terms forbid it. Anthropic's Commercial Terms, effective June 2025, state that it may not train models on customer content from its services. OMB memo M-25-22 tells federal agencies to prohibit training on non-public inputs and outputs without consent. Ask for a clause that also binds subprocessors and covers outputs.
What is a model change notification clause in an AI contract?
It requires the vendor to tell you before it changes the underlying model or AI systems delivering the service. GSA's proposed AI clause, published March 2026, would require notice within 7 days of changes that weaken safety guardrails or raise output bias. A stronger private version asks for 30 days' advance notice and a right to terminate if accepted performance drops.
Do the EU model contractual clauses for AI apply to private companies?
Not automatically. The EU model contractual clauses for AI procurement, updated in March 2025, were written for public buyers and are non-binding. Private companies can adapt them clause by clause as an annex to a main contract. They do not cover liability, intellectual property or acceptance, so they work alongside your own contract rather than replacing it.
Where to start this week
Before you send a single RFP, open the incumbent SaaS contract and find three things: the renewal date, the notice period and the export clause. Put the renewal date minus about 121 days in your calendar. That is the latest point to start, if you want a standard exit and a parallel run.
Then ask the incumbent for an exhaustive list of the data categories it holds for you, using the Article 25(2)(e) wording. How fast they answer tells you how hard your exit will be, and it gives you the baseline that Section 1 of this template needs.
Related on procurement
For the security side of the same purchase, pair this template with the 24-question AI security questionnaire mapped to the NIST AI RMF.
References
- Regulation (EU) 2023/2854 (Data Act), Article 25, contractual terms concerning switching, and Article 50 on application from 12 September 2025. Read via the article-by-article text at eu-data-act.com; EUR-Lex did not return the document during research. Used for notice, transition, retrieval, data specification and erasure terms.
- Faegre Drinker, The EU Data Act: data switching rights for EU customers, August 2025. Used for the Article 29 switching charge phase-out. Should be upgraded to the Article 29 text.
- Office of Management and Budget, M-25-22, Driving Efficient Acquisition of Artificial Intelligence in Government, 3 April 2025. Primary document; quotations in this post were taken from the CASRAI summary below.
- CASRAI Editorial Board, AI procurement clauses: OMB M-25-22 vs EU MCC-AI, updated 25 September 2026. Used for M-25-22 training prohibition, testing, knowledge transfer and the 180-day applicability point.
- Wiley Law, GSA delays rollout of AI procurement terms and conditions, 24 March 2026. Used for proposed GSAR 552.239-7001 terms. The clause text itself was not available on the GSA page during research.
- European Commission Public Buyers Community, Updated EU AI model contractual clauses, 5 March 2025. Used for the high-risk and light templates. Non-binding status per Inside Privacy, 7 April 2025.
- Anthropic, Commercial Terms of Service, effective 17 June 2025. Used for the no-training clause, output ownership and Section I.4 on termination.
The weakest part of this source base is that two of its four public procurement sources reach this post through secondary legal summaries, not the primary text. Clause wording in this template is Zan Digital drafting informed by those sources, not quoted law. Last verified 28 October 2026.
Related reading