AI agents can make routine contract administration more efficient by preparing communications and coordinating information. Depending on their connected tools, credentials, and settings, they may also send those communications, carry out changes, or take further steps. For a business buying these AI services, the AI provider agreement should address the difference between preparing work and acting on it, as well as responsibility for the risk of AI agent going to far and performing beyond its intended scope - especially in circumstances where the AI agent unintentionally commits the business.

One message, two contractual consequences

Consider a hypothetical Alberta company using an AI agent to draft responses to proposed supplier modifications for human review. The AI agent is connected to tools and credential settings that permit it to send email. A workflow misconfiguration causes the AI agent to send confirmation accepting a proposed supplier modification before the designated human reviewer approves it. The system has used a technical permission beyond the company’s intended approval boundary.

Alberta’s Electronic Transactions Act recognizes contract formation through electronic agents. Whether that provision would apply in this situation would depend on a number of factors, including the supplier contract, any externally communicated approval conditions, the parties’ dealings and the surrounding factual matrix for contract formation.

The result could be a gap in protection: the company may face a supplier claim without having a corresponding right of recovery from its AI provider. 

Contract for what the AI agent can do

If human approval is essential, the AI provider agreement should address the technical gate and other safeguards that prevent the AI agent from acting until approval is obtained. 

The AI provider agreement should identify who supplies and maintains that safeguard, and who is responsible if that safeguard fails. Of course, a contractual allocation of responsibility is not a substitute for the control itself.

The Canadian Centre for Cyber Security’s May 2026 primer recommends attention to vendor contracts and human oversight. Applied to this workflow example, the provider terms should answer five connected questions:

• Is this a type of action or contract that is appropriate for execution by an AI agent?
• Which permission and approval settings does the customer configure, which controls must the AI provider maintain, and who reviews material changes, including new connected tools?
• Which activity records must be retained and made available to establish what actions the AI agent took and whether the approval control operated?
• What notice, containment and assistance must the AI provider supply after an unapproved AI agent action?
• How might liability caps, exclusions and indemnities affect the customer's recovery for resulting losses, including the cost of addressing the customer's claim?

Before enabling an AI agent to act, and before considering automated contract administration, a company should, at a minimum, consider these questions to avoid losing control of its approvals and workflows, and potentially taking on unforeseen liability.

Sources

Canadian Centre for Cyber Security, Top 10 artificial intelligence security actions: A primer - ITSAP.10.049 (May 2026).

Alberta, Electronic Transactions Act, SA 2001, c E-5.5, section 28.