Most MSP contracts wouldn’t survive a courtroom – here’s where to start fixing that

Robert Dutt: Hello and welcome to In The Channel from ChannelBuzz.ca, bringing news and information to the Canadian IT channel community for the last 16 years. I’m Robert Dutt, editor of ChannelBuzz.ca, and your host for the show.

My guest today is Rob Scott. Rob is the co-founder of Monjur and managing partner at Scott & Scott LLP, where he’s spent more than 27 years at the intersection of technology and law. His firm works with over a thousand managed service providers across North America on their contracts, and he recently launched Monjur Pilot, an AI-powered legal assistant built specifically for MSP contracting.

Now, I know what you’re probably thinking – contracts aren’t exactly the sexiest topic in the channel. But here’s the thing. Most MSPs, I think, know their contracts are out of date, and they also know that they should do something about it. They just don’t. And in a world where the threats are evolving, AI is changing the service landscape, and the regulatory environment, particularly here in Canada, keeps getting more complex, the gap between what your contracts say and what your business actually does is becoming a real liability. Rob has seen what happens when that gap catches up to you, and he’s got some very practical advice about what to do about it.

Let’s get right into it. My chat with Rob Scott.

Rob, thanks for taking the time. I appreciate it.

Rob Scott: Thank you for having me.

Robert Dutt: You’ve been working with MSPs on their contracts for, I think it’s over two decades. What’s the state of the contract stack for the average MSP in 2026, and how wide is the gap between what most MSPs are actually running on and what they should be running on?

Rob Scott: That’s a great question. When I look at contracts, I see three big areas of risk for MSPs. One is that their agreements don’t keep up with their services. In the MSP world, that means you’re offering compliance advisory services without proper compliance advisory contracts. We call that service attachment for managed compliance. You’re now working with clients in and around AI and AI products, which are using a pre-AI customer contract. These are the things that change with frequency in IT, and for MSPs, that means one area of contract protection – static agreements don’t fit with emerging service offerings like tech.

Sometimes their agreements don’t keep up with their services, and other times, their agreements are not reflected for trends in the marketplace or specific risks. For example, ransomware attacks or emerging cybersecurity risks. MSPs don’t frequently have, for example, very clear-cut exclusions from responsibility for the criminal acts of third parties. Similarly, their contracts don’t limit their liability for acts or omissions of vendors. We monitor the terms and conditions of over 1,200 vendors in the MSP channel, and our clients get their customers to sign a waiver for any acts or omissions of those third parties. That’s an area – what I call vendor risk – which many MSPs are exposed.

Then the third big category is regulatory risk, operating with customers in regulated markets without the appropriate data protection agreements and data processing agreements that are required by both international, federal, and state laws. Those are the areas where most MSPs have been underserved by traditional legal services, which have caused many to move in the direction of do-it-yourself, which has many exposing themselves to unsupervised LLMs. While contracting for MSPs is very complex, they really have not been well-served by traditional legal services.

Robert Dutt: The open LLMs is what keeps me up at night. Shadow AI is a concern for lawyers, or at least us, as much as it is for MSPs. Shadow AI in their customers’ organizations, us for different reasons. But the MSPs are faced with a challenging choice between choosing fast and inexpensive do-it-yourself legal protection that lacks accountability and supervision, or traditional legal services that can be slow, can be expensive, and can be out of touch with what MSPs do. Many of my clients have shared stories about interactions with lawyers, not fondly, in part because the lawyers had no clue what they did, and they felt like they were paying the legal fees to explain to the lawyers what an MSP does.

Rob Scott: And so it’s been a challenge for many MSPs to get legal protection that’s both fast, affordable, and offered by MSP-specific attorneys.

Robert Dutt: You touch on the problem of keeping up with technology trends. I’m thinking in broader terms than that. What about whole directions of risk, I guess I would say. The example I think of is we’re doing a lot of tracking of the trend of abuse of trust. Attackers not breaking in, but logging in through trusted identities, VPNs, software supply chain attacks, those kinds of things. Basically, when the threat itself has shifted so fundamentally, how far behind are most MSPs in terms of accounting for that in their contracts?

Rob Scott: I would say very far behind. I would say overall, the customers that we talk to, the people we meet, are either on some do-it-yourself approach that really hasn’t been updated by an experienced attorney, or hasn’t been updated recently to reflect the emerging threat landscape as you described it. But we’re constantly updating our agreements to properly reflect detailed terms and conditions about these emerging threats.

And I’ll give you an example. We have in our MSA a provision called security recommendations. And what that provision says is the MSP may from time to time give the customer recommendations about security compliance. For example, multi-factor authentication. And if the client does not accept or move forward with those proposals, anything that happens as a result that those things could have prevented is 100% on the customer – the MSP is off the hook.

And so when I think about emerging technology and the changing threat landscape, a lot of it has to do with how you manage the communications and the risk associated with that. And MSPs have had the hard choice in the past of having to either tell a client, “No, I’m not going to support you,” or, “Hey, I’m going to give you this waiver to sign.”

And this whole topic of declination of services around point solutions that deal with emerging threat factors has been a common issue with MSPs. They go to the customer. They’re like, “You’re exposed. You need these advanced security features.” I mean, there’s new stuff all the time, but right now, it’s a lot of focus on zero trust. And so it’s not inexpensive to implement a zero trust model within a business. And if an MSP wants to implement zero trust, the customer has to cooperate to buy those things. And the customer doesn’t understand them well enough to know what they do or why they need it. So their first reaction is to say, “No, it’s too expensive.” And that puts the MSP at risk, because I tell the MSPs, my opinion is their network is only as strong as its weakest link. So if you let these customers on that you know are overly risky, that puts the whole portfolio of customers at risk.

And that’s a lot of what you’re talking about with those threat vectors. Those threat actors are thriving on being patient. And it’s not just like, “Do we have guards at the front door?” It’s like, “We need guards in every room.” They’re already in. So that’s one of the things that I think most people think about. Cybersecurity is like hacking events or ransomware events, but so much more of it is they’re in your networks, they’re able to move around, they’re squirreling their way into different areas, and they’re being very patient waiting for that opportune moment. And so it’s not just about keeping people out, it’s also about catching them after they get in. And that’s where a lot of these emerging technologies and emerging threats are posing unique challenges from a cybersecurity perspective.

And the question is, “How are your agreements evolving?” And that’s where making sure that your vendors are all on there. So if there’s any act or omission of a vendor, that you can be covered for it. And the things that happen in cybersecurity, like criminal acts of third parties, is expressly excluded. I don’t think you need to go into as much of the specific threats. If you get a strong and enforceable exclusion against the criminal acts of third parties, almost every cybersecurity risk that would be impactful to an MSP is also a criminal act by the person who perpetrates it.

Robert Dutt: About a year ago, you did a piece around the theme of “Your MSA is broken and AI is to blame.” We’re a year further in, things have only accelerated. MSPs are selling Copilot bundles, offering AI-powered services. Their customers are deploying AI tools whether the MSP knows about it or not. From the customers’ point of view, how far behind are most MSP contracts relative to the AI services that they’re delivering or their customers are using today?

Rob Scott: We came out with a special service attachment for managed AI in 2024. And at that time, people said, “I don’t really need it. We don’t know what we’re doing yet.” Today, people come to Monjur just because of that attachment.

And the way that attachment is built is, number one, you don’t have the right definitions in your current agreement for things like AI input, AI output, the model, the trainings – all of these things that are relevant to AI that wouldn’t be in a master services agreement for managed services. Beyond that, you need your service descriptions. Is this AI readiness assessments? Is this app dev? Are we building RPA and automations? What is it exactly that the services entail? And so that’s a big part of it. And our structure is designed to cover just about every AI service that an MSP could do.

But it’s also important to make sure that you have the proper exclusions and client obligations. So when you think about exclusions, it’s like the MSP shouldn’t be responsible if the legal world changes and suddenly that client’s use becomes illegal. Think of helping customers deploy voice agents. And then it becomes clear that you can’t use a voice agent to do cold calling, or voice agents get outlawed altogether. It needs to be clear that the MSP is not taking the responsibility for how government reacts to the impact of AI.

Similarly, there should be an obligation on the customer’s part to be committed to ethical use of AI. Responsible AI is something that I put in as a mutual obligation to all parties to a contract that I write around AI. I think it’s foundational for humans to be committed to responsible AI.

So there’s things – just a few examples – but things that you wouldn’t see in an MSA. So ask yourself, why would you expect your pre-AI MSA to protect you in an AI world? The answer is MSPs increasingly are offering AI-related services under contracts that weren’t built for these services, and those that are, are putting themselves at significant risk. And it’s not necessary, because there is a ready-made solution for MSPs to protect themselves when engaged in selling Copilot, helping clients with AI projects, which we’re all going to be doing.

Let’s get it straight. This is not new. This is not a temporary blip. I think the only temporary part of it is this AI distinction. I don’t think there will be, in the long run, a distinction between AI tools and non-AI tools. All tools will be AI. So the way things are going, MSPs need to be prepared for that. All of what so many more MSPs are now in the territory where they would be protected by a specific service attachment that doesn’t exist in their contract stack today.

Robert Dutt: The other side of that equation of AI use in the MSP is that a lot of MSPs themselves are tempted to use some of the generic LLMs to draft or review their own contracts. Where do you see the line between that being helpful and that being dangerous?

Rob Scott: I don’t think MSPs should be forced to choose between using AI and using attorneys. I think that’s the state of the market today. They’re faced with these unsupervised LLMs that are risky, where there’s no accountability. They’re telling you, “Don’t use this for law,” and you’re using it for law. If you have a bad outcome, whose fault is it?

The New York State Senate has got a Senate bill, which I think will be the first of many, that would make it illegal for LLMs to give out legal advice, because it’s doing way more harm than good. I think the one thing to think about the perspective on this is lawyers are getting sanctioned and held in criminal contempt for using AI, and the AI is making mistakes. If it’s going undetected by the lawyers, why do you think you’re in a position to supervise the AI to protect your legal interests?

I mean, it gets it wrong so much. The accuracy of legal outputs from unsupervised LLMs is so low that it is like playing Russian roulette. So I don’t blame the MSP. I just think that the future is attorney-supervised AI, where the customer starts with a template that is lawyer grade. I think if you put Monjur Pilot up against these unsupervised LLMs and you draft an agreement starting with a Monjur template versus starting with nothing and an unsupervised LLM, your first pass is a totally different thing.

And then the second thing is lawyers need to be in the loop at the last mile. You should be able to press a button within your AI and say, “Submit for legal review,” and the lawyer should be able to just look at it in-app and finish what you built. So you start with a legal template that’s legal grade. You operate in a legal-grade AI environment that has the proper guardrails, and you make sure that attorneys supervise all of the work that the clients are doing, so that the MSP no longer has to choose between fast and inexpensive and slow and sometimes cost-prohibitive.

So we think that AI unlocks something pretty special for the Monjur subscriber, which is the benefit of having your lawyers at your fingertips 24/7 through a trained AI legal assistant. But that’s not a replacement for your lawyers. It just supplements your relationship with your lawyer. So in this way, we deliberately call them legal assistants because they play the same role as a legal assistant in a law firm. The legal assistants don’t practice law without the lawyer supervision. They help the clients get better service from the lawyers.

And that’s the role of AI in the Monjur vision, which is attorney-supervised LLMs that provide a safety layer on top of the LLM of your choosing. So our system is called “at any LLM,” but in each instance, we’ve implemented prevention of hallucination and preservation of context through RAG architecture that allows our legal assistants to give responses that the lawyers feel they can stand behind and nevertheless supervise.

Robert Dutt: Our audience is primarily Canadian MSPs and other types of IT solution providers. You serve over a thousand MSPs across North America, including Canada. What are the things that Canadian MSPs need to be thinking about in their contracts that their American friends don’t? I’m thinking PIPEDA, I’m thinking Quebec’s Law 25, the cross-border data question and data sovereignty, but I’m curious what you see as the biggest gaps from the Canadian side specifically.

Rob Scott: I think the ones that you mentioned are sort of at the surface, in the sense that those are concrete, objective things. Like, the data processing agreement for our US customers has different regulations in it than our Canadian customers, and the Canadian ones contain the laws that you mentioned.

The bigger issue that I see in Canada is a cultural issue. This idea that contracts are not important because we’re not in America where everybody sues at the drop of a hat. We don’t value legal protection in the same way that people might in the US, because the threat of litigation in their mind is lower than maybe the threat of litigation in the minds of the MSPs in America.

My response to that is I acknowledge the differences between the US and Canada as relates to litigation and dispute resolution, but I don’t think that that means that Canadian MSPs don’t benefit from having great contracts. It’s more of a question of what level of risk is being mitigated and the best way to mitigate it. I fear that too often in Canada, it’s not a question of does your DPA properly reflect Law 25 or PIPEDA. It’s a question of, are your agreements well thought out at all, because maybe you don’t think that it’s that important to have good agreements.

And it’s about 15 years culturally and mindset-wise behind the MSP market that I began working on. Where early on in America, there was a large sentiment that a handshake deal is good enough. I deal with my friends and I don’t perceive a high risk of litigation. And if someone wants to get out of my contract, they’re not happy with me, I let them go anyway. Why do I need all this paperwork?

And I think that’s a big thing that we have to work on for education with MSPs in Canada, which is you don’t have to be in a litigious market like America to benefit from good contracts.

Robert Dutt: Well, and here’s an interesting aspect to that cultural thing too. A lot of Canadian MSPs are serving clients on both sides of the border, or are using US-based vendor tools to deliver services to their Canadian customers. How should MSPs be thinking – even if they’re functional just in Canada in terms of customer base – how should they be thinking about cross-border exposure in their contracts?

Rob Scott: Well, look, I think that unless you know, for example, where every data subject resides in every system that you manage, you could be in Canada with customers with data subjects in their systems that you manage all over the US. And the laws run by where the data subject resides. So that’s one of the big challenges.

And then the other challenge is, don’t you want to put yourself in the position where you can say yes to as many deals and customers as possible? And don’t you want to make sure that you have compliant agreements that will allow you to operate in multiple markets?

And we have a lot of MSPs, I would say, that are on the Monjur platform that are enjoying dual libraries. So a set of agreements in English for the US, a set of agreements in Canada in English for English-speaking provinces, and then a set of agreements in Quebec, specifically for Quebecois law, presented in French. So we do offer some granularity in terms of localization in each market. And our strategy is we partner with local law firms in each jurisdiction to localize and maintain the updates of our agreements. And so we have a law firm that we work with in Quebec and several others in other provinces, including one in Toronto, where we partner with them to keep the agreements updated for those markets.

Robert Dutt: I think for a lot of MSPs, contracts are in the category of necessary evil, something they grudgingly do to avoid getting sued – or in some cases don’t do well enough to avoid getting sued. But I wonder if there is a case to be made for treating your contract stack as a competitive advantage, and if so, can you walk me through what that looks like in practice? How you can take a solid contracting situation and use it as a way to help your organization grow, and not just stay out of trouble when things go wrong.

Rob Scott: Yeah. So I think it’s an excellent question. I think the first part of it is something that now jives to me going to the dentist. Like, I know I have to go to the dentist. If I want to not have cavities, I have to go to the dentist. If I don’t want gum disease, I have to go to the dentist. I hate to go to the dentist. I’m so anxious when I get there, I tell them, please don’t take my blood pressure until we’re done, because it’ll just make it worse when you give me a really high blood pressure reading. I’m only going to be more anxious.

And I think with MSPs, that’s real too, as it relates to law. Many don’t feel comfortable with the subject matter. Many have had bad experiences. Many, like you say, would say it’s a necessary evil, but they try to avoid it as much as possible. Even if you caught them in a quiet moment of reflection to ask them if they really needed it, they would say yes, but they would go back to their office after that and lose track.

And this is why I think dynamic agreements that auto-update are so important for MSPs. I think legal needs to work in the background. And MSPs, I think, as a group, are carrying a very heavy cognitive load around contracting. A lot of the senior people that run MSPs are not contract people. It’s way out of their element. It doesn’t play to their strengths. It drains them of their energy. They’re constantly second-guessing whether they’re getting it right.

And what I think about competitive advantage, we talk in terms of the maturity model. Maturity level one: legal protection. You have the legal protection in place. Maturity level two: standardization and efficiency. Standardization and efficiency is like, how well have you collapsed your contracting processes into your sales process, so sales and contracting is one seamless step? So that’s kind of level two. Are all of your customers efficiently on the right paper? Can we update their terms without having to go get a signature?

This is how Monjur enables MSPs to grow revenue fast. We remove the friction from the sales process. We make deals go faster. We make it less likely that customers are going to want to comment or request changes to agreements. So that’s level two.

Level three is what we call contract intelligence. Using AI to optimize revenue opportunities. Making AI context-aware of your renewals, of your upgrades, of what people are paying, who is using a lot of resources but not paying for very much. These are the opportunities where contract intelligence drives better decision-making as well as automation to fuel efficiency to grow revenue faster.

So it really depends on where you are on this maturity level about how it helps you grow. Initially it may make it harder to grow while you’re getting the right legal protections in place. But ultimately you want something that can scale with your business, and that means dynamic versus static agreements.

Robert Dutt: My last question – I want to make this as concrete as possible. If you’re talking to a Canadian MSP owner, let’s say a 15-person shop doing managed services, building out security, starting to do AI in there too, they know their contracts are out of date or in bad shape but don’t really know where to start. What are the first two or three things that you’d tell them to do right now, right away, to get that ball rolling and to hopefully see the most improvement in the situation?

Rob Scott: Well, one of the things that I would say is benchmark what you’re currently using. Do an assessment of where you are. We have some tools online that can help you walk through an assessment of your current contracts, and we’ll also review them for you for free. If you have a contract, you’re an MSP in Canada and you want to understand what the gaps are relative to best practices, we’ll use our toolset to analyze your agreement, compare it to what we think are best practices in Canada, and do a report for you. We do that as part of our consultation process. There’s no fee for that. That’s a complimentary review. If you could get an experienced attorney to help you benchmark it, great.

The other thing to think about is updating your vendor list and asking yourself the question, “How am I protecting my MSP against acts or omissions of the vendors in my tech stack?” If you don’t have a good solution for that, then you need to be thinking about something like our schedule of third-party services, which allows you to list all your vendors and contains a waiver of the right for your clients to sue you. Now we’re covering a really big category of risk with that one attachment.

Then emerging services – advanced security and AI. You need specific agreements for these things. You can’t just continue to operate under the agreements that you were using pre-AI in the AI world. You can’t start offering compliance-related advisory services like GRC and other advanced security and compliance offerings without the appropriate contract. We call it the service attachment for managed compliance. Similarly with AI, we have a service attachment for managed AI.

You really need to be thinking about, do your agreements cover the services that you’re offering, delivered through the tech stack that you’re delivering it through, and in a way that’s compliant with the emerging framework of regulations that impact you and your customers? Given all of that – and we cover that with our data processing agreement – you can see why static agreements for MSPs can become very challenging very quickly.

If I was in the process of trying to figure out a way to manage risks for my MSP in Canada, I would be looking for a service that would give me dynamic updates that was specific to managed services, that was customizable for me and my customers. And think about this question: if my client were to sue me in court tomorrow, how confident am I that my current agreements would hold up in court? If the answer to that is, “I’m not so sure,” or “I’m not that confident,” or “I’m sure it would be a problem,” then getting a complimentary review of your current agreements and a game plan to move forward with broader protection is probably a good idea.

Robert Dutt: All right, I appreciate that. It’s a lot to think about, and it’s an area that I don’t think we focus on as much. We tend to get caught up in the tech stack and all that, so I appreciate your taking the time to share some wisdom on where things are at with contracts and where they’re going.

Rob Scott: Thank you. Thank you very much. I appreciate you having me.

Robert Dutt: There you have it. Rob Scott from Monjur. I’d like to thank Rob for his time. He brought a lot of depth to a topic that frankly doesn’t get a lot of attention in channel media.

A few things that are sticking with me from this conversation. First, the idea of the security recommendations clause – building language into your contract that says if you recommend a security measure and the client declines, anything that could have been prevented is on them. That’s the kind of provision that can save your business, and I’d wager a lot of MSPs listening don’t have it.

Second, his point about Canadian MSPs being about 15 years behind their American counterparts on contracting maturity – not because the laws are weaker, but because the culture around litigation is different up here. That’s a gap that works until it doesn’t.

And third, the question he posed that I think every MSP should sit with: why would you expect your pre-AI master service agreement to protect you in an AI world? If you’re selling Copilot bundles or managed AI services on a contract you wrote five years ago, you’ve got some homework to do.

If you’re enjoying the ChannelBuzz.ca podcast, we’d love it if you’d follow or subscribe. You can find us on Apple Podcasts, Spotify, YouTube, and most podcast directories. And if you have a minute to leave a rating or review, that goes a long way in helping other folks in the channel find the show.

Until next time, I’m Robert Dutt for ChannelBuzz.ca, and I’ll see you in the channel.