Renew, renegotiate or offboard, decided before the notice date passes

More vendor relationships are decided by an auto-renewal clause than by any review. The contract says the term extends for another year unless one side gives notice thirty, sixty or ninety days before the end. The date passes, nobody sends the letter, and the organisation has committed another year of spend to a vendor whose risk, price and usefulness nobody looked at. The fix is not complicated: know the notice date, and arrive at it with a recommendation and the facts behind it.

This post follows the renewal calendar in the demo organisation, Northwind Labs, where three contracts have notice dates inside ninety days: Ledgerly, whose notice date has already passed; Callwave, due in December; and Stackforge, the largest contract, due in January. All three vendors are fictional; the screens are the product as built.

Why renewals deserve their own process

Renewal is the one moment in a vendor relationship when the customer has leverage. Before notice, you can renegotiate price, fix contract terms that were weak at signature, demand overdue evidence or leave. After notice, most of that is gone for another term. Yet renewals are usually handled as paperwork: an invoice arrives, finance checks the budget, and it is paid.

The costs are easy to name. Spend on tools nobody uses, or on two tools doing one job. Price increases accepted because there was no time to argue. Contract gaps found during a review — no deletion clause, a low liability cap — carried for another year. And risk that has grown since the original approval, from findings that were never closed and signals nobody connected to the contract.

Regulators expect the decision to be made deliberately. US interagency guidance on third-party relationships (June 2023) treats termination as a stage of the life cycle to plan for; the EU’s DORA expects exit strategies for ICT services that support critical or important functions; ISO/IEC 27001:2022 Annex A 5.22 covers monitoring and reviewing supplier services. Confirm what applies to you with your compliance team.

The calendar, sorted by notice date

The contracts screen lists every contract with its value, its end date and the date by which notice must be given, sorted by that last date. On 9 November 2026, Northwind’s calendar shows seven contracts worth $660,000 a year, three of them with notice due inside ninety days:

Vendor	What it does	Tier	Spend	Notice by	State
Ledgerly	Accounts payable	Tier 2	$48k	4 Nov 2026	Passed
Callwave	Sales call recording	Tier 2	$64k	14 Dec 2026	35 days
Stackforge	Cloud infrastructure, production hosting	Tier 1	$420k	8 Jan 2027	60 days

The notice-by date is extracted from the contract by the Document agent, alongside the term, the auto-renewal clause and the notice period, with the page cited. That matters: a calendar built from someone’s memory of the contract is the calendar that misses dates.

How the Renewal agent builds a recommendation

Ninety, sixty and thirty days before each notice date, the Renewal agent assembles the facts a renewal decision needs and drafts a recommendation with its reasons. It does not invent the inputs; it reads them from the vendor record.

The inputs and the three outcomes. At L1 the agent only drafts; a person decides.

Recommendation	Typical reasons	What follows
Renew	Risk stable or falling, findings under control, the tool is used and needed	A renewal request with a light review; reassessment if due
Renegotiate	Needed, but price, terms or evidence fall short; findings that a contract change would fix	Redlines and evidence requests before notice; conditions on the renewal
Offboard	Risk high and not improving, critical findings open, duplicated by another tool, little use	Notice given; offboarding checklist: access, data, contract, supplier

The agent runs at L1, “Draft”, by default. That is deliberate. A renewal decision weighs things the record does not hold: how much the sales team likes a tool, what switching would cost, whether a replacement is ready. The agent brings the evidence; the owner brings the judgement.

Callwave: the agent proposes offboard

Callwave records Northwind’s sales calls: Tier 2, about $64k a year, 31 users. Its record is not comfortable reading. Residual risk is 100 against an inherent 65, with 21 findings, including a critical “No data privacy or data processing obligations” in the master services agreement and “OpenAI listed as sub-processor — AI data exposure risk” in the data processing agreement. A breach signal — “Callwave confirms credential-stuffing incident affecting a small number of accounts” — had already triggered a re-assessment.

The Renewal agent’s recommendation is offboard: “Residual risk is 100 (critical) with 8 high/critical finding(s) open”.

The owner has three honest options with 35 days to go. Accept the recommendation and give notice, then work through the offboarding checklist. Renegotiate instead: make renewal conditional on a data-processing clause in the MSA, a decision on the OpenAI subprocessor, enforced SSO for the 31 users and a full answer on the incident — with notice given as a fallback if the answers do not arrive. Or renew as is, recording the decision and the reason, and accepting the risk with an expiry date. The agent does not choose among those; it makes sure the owner chooses with the facts in front of them and before the date.

There is a procurement angle too. Earlier, the Intake agent flagged a request for another call-recording tool with “You may already have this — Callwave”. If Callwave is offboarded, that request may become the replacement; if Callwave stays, the request may not be needed. Renewal and intake are looking at the same spend.

Stackforge: too critical to leave, big enough to negotiate

Stackforge hosts Northwind’s production systems: Tier 1 Critical, $420k a year, a subprocessor, notice due 8 January 2027. Its evidence is strong — SOC 2 Type II, ISO 27001, a 2026 penetration test and an insurance certificate — yet residual risk is 100 against an inherent 89, because 23 findings are open, and an outage signal (“Stackforge us-east region outage lasts six hours”) became a finding of its own.

The facts point toward a negotiation rather than an exit. Moving production hosting in sixty days is not realistic, so a recommendation to offboard would be a threat rather than a plan; DORA-style exit planning for critical vendors exists precisely because exits take longer than notice periods. But $420k a year and 23 open findings are leverage. A renegotiation can tie the renewal to closing the highest findings, to service credits that reflect a six-hour regional outage, and to price. The agent’s recommendation, whatever it says, is the opening brief for that conversation.

Ledgerly: when the date has already passed

Ledgerly, the accounts-payable vendor, is Tier 2 at about $48k a year. Its notice date was 4 November 2026. Finance has asked to renew (“Renew Ledgerly for another year — finance needs it for AP, same 12 users”, request VR-0003), but the record also holds a SOC 1 Type II report that expired on 15 September 2026 and news that Ledgerly has been acquired by Harbour Capital.

A passed date does not end the decision; it changes it. If the contract auto-renews, Northwind is likely committed for another term and the conversation becomes conditions: a current SOC 1 or a bridge letter, a statement on what the acquisition changes, and an early review well before the next notice date. If the contract has termination rights or the acquisition triggers a change-of-control clause, those are worth a lawyer’s reading. Either way, the lesson is the calendar: the first Renewal agent recommendation, at ninety days, was the time to chase the report.

One renewal, from the ninety-day mark to the notice date.

Running renewals as a routine

What it adds up to

For procurement, no notice date passes unseen, and every renewal arrives with a recommendation and its reasons. For the CISO, findings and incidents have a deadline that matters to the business. For finance and the board, $660,000 of annual contracts are renewed, renegotiated or ended on purpose, with the decision and the reason on the record.

Keep reading