As businesses shift critical operations to cloud platforms and incorporate artificial intelligence, a gap in contractual agreements is becoming apparent. For Chief Information Officers (CIOs), legal directors, and procurement officers, it is increasingly vital to adjust contractual relationships and reclaim control over their data and systems. Traditional service contracts, which once emphasized control, now often reflect dependency. The move to the cloud has changed the model from perpetual licenses to subscription-based access, where customers have limited control over how long they can use the service, how it evolves, and under what conditions it can be suspended. Instead, the service provider manages the infrastructure, updates, security, and maintenance. Standard terms in these contracts often minimize the publisher’s liability while allowing for service interruptions, price hikes, and specific access conditions, such as service level agreements (SLAs). Data sovereignty is more than just where data is stored. While some organizations believe that hosting data in Europe provides a safeguard, the OVH case highlights the limitations of this assumption. In April 2024, the Ontario Court of Justice ordered the French company to hand over data stored outside Canada, showing that data location and the nationality of the service provider are not enough to prevent foreign authorities from accessing information. A service provider’s legal or commercial ties to another country could expose it to the demands of that country’s laws, regardless of where the data is physically stored. This means that the legal risks of the supplier and its subcontractors must now be a key factor when selecting a cloud provider. New contract clauses are necessary to ensure that companies can move to sovereign infrastructures without added costs, especially if sovereignty was not guaranteed at the time of signing the contract. Similarly, clauses allowing exit from the contract should be included if sovereignty is lost during the contract period. The integration of generative AI into core management systems or its use by teams increases legal, financial, and technological risks. One concern is the protection of intellectual property, as many publishers’ terms allow them to use customer data to train their AI models or for benchmarking. This could lead to the leakage of proprietary knowledge and industrial secrets into models that benefit not only the publisher but also competitors. Generative AI also creates uncertainty around responsibility. While the AI Act imposes compliance requirements on users, publishers often limit their own liability through contract terms. For example, standard clauses may state that the publisher is not responsible for errors, biases, or infringements of third-party rights in AI-generated content. This places the burden of responsibility on the company using the AI tool, including for any automated decisions or content produced. Negotiating fair responsibility-sharing and protecting data and outcomes has become as essential as traditional contract clauses. The contract is a powerful tool for maintaining strategic independence. Rather than being an administrative burden, legal frameworks can be an operational asset. Recent European legislation, such as the Data Act, offers new opportunities to balance power dynamics between companies and service providers. This law prohibits technological lock-in and mandates interoperability, allowing companies to request data portability without excessive exit costs. This facilitates hybrid systems, multi-cloud strategies, and greater flexibility. To retain control and avoid being at the mercy of service providers, companies must understand their risks, structure their needs, and be familiar with both legal regulations and market practices. Key steps include mapping data, assessing risks in case of leaks, auditing exposure to foreign laws, classifying AI use cases, aligning governance with suppliers and integrators, training internal teams on contract law and European regulations, and focusing on critical clauses related to sovereignty, data protection, AI regulation, service continuity, responsibility, and compliance. Companies that treat legal strategy as a negotiation tool will preserve their independence and sovereignty in the long term. By Claudia Weber, associate founding lawyer at ITLAW Avocats.