Generally, there are three categories of information technology buyers: non-technology enterprises, non-IT technology companies and IT technology companies. Each category of IT buyer is very different.

The second category of IT buyers includes telecommunications service providers, medical device manufacturers, robotics companies and non-IT outsourcing service providers.

The third category above includes all levels of IT vendors, including fintech (ie, IT solutions for financial services), enterprise IT-led transformation, enterprise resource planning solution providers, software developers, and IT cloud and outsourcing service providers.

Since most of my tech practice has been devoted to helping non-technology companies buy IT products and services, I am always pleased when technology companies retain me to help them buy their own IT products and services. But there are reasons for that, which non-tech companies might appreciate.

First, technology vendors who have retained me have seen me on the other side of the contract negotiations for a customer that they are trying to sell to. They tell me that it is my approach to contract negotiations that they want emulated for their own IT purchases.

Second, because of (not in spite of) their own vendor contract “nuances”, they do not trust the contracts of other technology vendors — not at all. As tech vendors themselves, they want experienced counsel to merge a healthy “vendor contract paranoia” with commercial pragmatism.

Third, at the risk of sounding like Donald Rumsfeld, in-house counsel at tech companies tend to know what they do not know. To their credit, since their experience is exclusively devoted to selling technology, they have an informed appreciation about what they don’t know when buying technology.

Non-technology buyers of IT goods or services (eg, the public sector, financial services, hospitality, natural resources, shipping and transportation, etc), often don’t fully appreciate what they don’t know about well-crafted IT vendor contracts and related negotiations.

There are exceptions, of course, such as when the enterprise is large enough to have internal IT expertise and leadership, usually in the form of a chief information officer or chief technology officer, or when an enterprise has already been burnt on large tech procurements or transformation projects and lessons have been learnt.

When procuring IT solutions, from data analytics software development to cloud or outsourcing services, some of the key risk management considerations that technology vendors keep in mind, which non-technology buyers might also consider, include:

• A sceptical due diligence into the vendor and the solution being offered, including know your vendor customer reference checks and related litigation searches

• Ensure that you have a contract that is consistent with pervasive industry practices, commercial norms and accepted legal practices — regulators are watching

• Stipulate detailed and complete operational, functional and technical performance specifications, including data formats, interoperability, service-level agreements and key performance indicators

• Ensure you have remedies for failed SLAs and KPIs, without vendor earn-back (why pay for a service you did not receive?)

• Contract precondition for reasonable solution acceptance testing by the customer (not the vendor)

• Regular and frequent performance monitoring activities, including real-time dashboard and periodic reports

• Stipulate who owns what intellectual property, since customer specifications often contain original works and methods

• Ensure you have the clear statutory, privacy law, common law and contractual rights to provide the subject data to third-party vendors

• Ensure the contract complies with all Bermuda laws and regulations, whether related to cybersecurity, privacy law or otherwise (including all compliance flow-downs)

• Stipulate standard internal dispute escalation and resolution procedures before disputes are allowed to otherwise be litigated, with some exceptions.

As for the third bullet above, it remains widely accepted by lawyers who specialise in commercial technology transactions that the leading cause of IT project failure and litigation, by far, arises from the failure of the parties to share an agreed understanding of what the performance requirements of the IT goods or services contract are.

It makes excellent sense for non-tech companies to put the same quality of diligence into their IT contracts that technology companies do when they buy IT goods and services.

• Duncan Card is a partner at Appleby who specialises in IT and outsourcing contracts, privacy law and cybersecurity compliance in Bermuda. A copy of this column can be obtained on the Appleby website at www.applebyglobal.com. This column should not be used as a substitute for professional legal advice. Before proceeding with any matters discussed here, persons are advised to consult a lawyer