Mayer Brown Maps the Agentic AI Contract Gap Procurement Teams Must Close

What happened

Why it matters

• ·Existing AI vendor agreements almost never define who is liable when an agent takes an unauthorized or harmful action in an external system. Without explicit contract terms, the question will be resolved in litigation, at unpredictable cost.
• ·Regulators including the FTC Enforcement on AI (Section 5 of the FTC Act) and data protection authorities are already treating agentic AI failures as actionable. Contracts that lack incident notification clauses, audit rights, or agent shutdown provisions leave enterprises unable to enforce the response timelines those authorities expect.
• ·The plugin and MCP supply chain risk documented by Mayer Brown reflects a real pattern. Vulnerabilities in third-party connectors are now a primary attack path, as covered in 253 MCP Server Bugs and Six Framework Bypasses Expose Agent Authorization Gap and 68 MCP Server CVEs in One Month Expose a Systemic Agent Supply Chain Gap. Contracts that do not assign liability for those connectors leave a direct exposure gap.

Governance controls affected

What to do now

• ☐Pull your three to five most-used agentic AI vendor contracts and check whether they define what actions the agent is permitted to take autonomously, what requires human approval before the agent acts, and who is liable if the agent exceeds those boundaries.
• ☐Confirm whether your contracts give you an unconditional right to shut down a deployed agent immediately, without waiting for vendor consent or notice period, and update any agreement that does not.
• ☐Ask your procurement and legal teams to add a clause to your standard AI vendor template requiring the vendor to notify you within a defined window (for example, 24 or 72 hours) if a plugin, MCP server, or third-party tool connected to the agent is found to have a security flaw or is compromised.
• ☐Identify every agentic system currently in production that connects to external tools or data sources, and map whether each connection is covered by a contract that assigns liability for failures in that connection.
• ☐Brief your general counsel or outside counsel on Mayer Brown's identified risk areas and ask them to redline any in-flight agentic AI vendor agreement before execution.

What to watch next

Courts and regulators are beginning to treat agentic AI failures as events with named legal consequences, making the absence of agent-specific contract terms an increasingly visible liability. Watch for enforcement actions under the FTC Enforcement on AI (Section 5 of the FTC Act) that cite inadequate vendor controls or notification failures as aggravating factors. The Five Eyes Guidance on the Careful Adoption of Agentic AI Services and rules such as the Colorado SB 26-189: Automated Decision-Making Technology Act may further define the baseline expectations that contract terms will need to satisfy. Organizations operating in the EU should also track enforcement under the EU AI Act (Regulation (EU) 2024/1689). Incident reporting and human oversight obligations are already in force there. These could intersect with contract terms when an agentic system causes harm.