Commercial Contracts Counsel in Chicago: Vendor, SaaS and Services Agreements

Most commercial contracts arrive on the vendor’s paper, with a signing date already set by the business team. What matters is not whether the document looks standard but what happens when the service fails, when data is exposed, or when the term renews without anyone noticing. Those outcomes are decided in a handful of clauses: the service description, the remedies, the liability cap, the data terms and the termination mechanics. We negotiate them before your company is bound.

The agreements we review and how they fit together

A master services agreement (MSA) sets the general rules: warranties, indemnities, liability limits, confidentiality and termination. Each statement of work (SOW) or order form adds the scope, price and dates for a particular project. A SaaS agreement often combines both functions with online terms of use the vendor can change. A data processing agreement (DPA) and a HIPAA business associate agreement (BAA) allocate the duties for the information the vendor will receive. We review these documents together, because a carefully drafted BAA loses its value if the MSA says the MSA controls over every exhibit, or if the MSA’s liability cap shrinks recovery for a data incident to a token amount.

That is why we start with order of precedence. Our recommendation is that the data and security exhibits control on their subject, and that changes to online terms do not bind you without notice and a right to terminate.

A negotiation memo behind every redline

A redlined contract tells your team what changed but not why. With the redline we deliver a memo that explains every position: the risk it addresses, what the vendor is likely to say, the fallback position you can accept, and what you should not give up. Your team learns with each contract. When a clause turns on the law, such as a HIPAA requirement or the Illinois data security statute, the memo cites the rule so no one mistakes a legal requirement for a negotiating preference.

Service levels with remedies that work

Many service level agreements (SLAs) measure uptime with metrics the vendor controls, exclude most outages, and offer a small credit as the only remedy. A promise like that is illusory. Turning it into an enforceable SLA takes four things: a defined, measurable metric, narrow exclusions, reporting you can verify, and a remedy that changes the vendor’s behavior. We recommend that repeated failures trigger a right to terminate without penalty, with a refund of prepaid fees and transition assistance.

When the contract is a sale of goods, Article 2 of the Illinois Uniform Commercial Code adds rules of its own. The parties may limit remedies, for example to repair or replacement, but if an exclusive or limited remedy fails of its essential purpose, the buyer may turn to the remedies the statute provides (810 ILCS 5/2-719(1), (2)). Consequential damages may be limited or excluded unless the limitation is unconscionable, and a limitation where the loss is commercial is not unconscionable on its face (810 ILCS 5/2-719(3)). For SaaS and services agreements, we draft the remedy precisely rather than rely on default law.

Data, AI and security terms

When your company shares personal information about Illinois residents with a vendor, the Illinois Personal Information Protection Act requires the contract to include a provision obligating the recipient to implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification or disclosure (815 ILCS 530/45(b)). That is a floor. We also recommend defining what those measures mean in a security exhibit, with incident notice deadlines, audit rights or third-party reports, and return and deletion rules at termination.

For practices and other covered entities, the HIPAA regulation sets the content of the BAA. The contract must establish the permitted uses and disclosures and require the business associate to use appropriate safeguards, report uses or disclosures the contract does not allow, including breaches of unsecured protected health information, bind its subcontractors to the same restrictions, support patients’ rights in their information, and return or destroy the information at termination where feasible (45 C.F.R. 164.504(e)(2)(i), (ii)). It must also authorize the covered entity to terminate if the business associate violates a material term (45 C.F.R. 164.504(e)(2)(iii)). That right matters because a covered entity that knows of a pattern of noncompliance and does not take reasonable steps to cure it, or to terminate where feasible, is itself out of compliance (45 C.F.R. 164.504(e)(1)(ii)).

If the vendor supplies timeclocks, identity verification or cameras that capture biometric identifiers, the Illinois Biometric Information Privacy Act (BIPA) follows the data. A private entity in possession of them must store and protect them with a reasonable standard of care and may not disclose them without consent or another basis the statute allows (740 ILCS 14/15(d), (e)). The contract should say who obtains the written release and who answers if the vendor uses the data for another purpose.

AI terms are mostly a matter of negotiation, not statute. Our usual recommendations: the vendor does not use your data or outputs to train models without your written approval, gives notice before material changes to the model or to subprocessors, treats your inputs and outputs as confidential, and leaves you the rights you need in the outputs to run your business.

Conflicting forms, renewals and termination

In purchases of goods between merchants, your purchase order and the vendor’s confirmation rarely match. Under the Illinois Uniform Commercial Code, an acceptance that adds different terms is still an acceptance unless it is expressly conditioned on assent to those terms. Between merchants, the additional terms become part of the contract unless the offer limits acceptance to its own terms, the terms materially alter the contract, or they are objected to in time (810 ILCS 5/2-207(1), (2)). We recommend that your purchase order limit acceptance to its terms and that you object in writing to vendor terms you do not accept.

A supply contract with no fixed term has default rules too. If it provides for successive performances but is indefinite in duration, it is valid for a reasonable time and, unless otherwise agreed, either party may terminate it at any time. Termination, except on the happening of an agreed event, requires that the other party receive reasonable notification, and a clause dispensing with notification is invalid if its operation would be unconscionable (810 ILCS 5/2-309(2), (3)). For a vendor your operations depend on, we recommend agreeing on a term, a notice period and transition assistance rather than relying on those minimums.

Automatic renewals deserve particular attention. The Illinois Automatic Contract Renewal Act protects consumers, and the Act itself says it does not apply to business-to-business contracts (815 ILCS 601/20(c)). A vendor agreement that renews on its own is therefore governed only by its own notice clauses, and a renewal calendar is the only real protection. If your company sells subscriptions to consumers, the Act does apply: it requires clear and conspicuous disclosure of the renewal terms before you charge, the consumer’s consent and an acknowledgment, and for terms of 12 months or more a written notice 30 to 60 days before the cancellation deadline (815 ILCS 601/10(a), (b)). Our guide to the Illinois Automatic Contract Renewal Act walks through each step.

Electronic signatures and signing authority

The federal E-SIGN Act provides that, in transactions in or affecting interstate or foreign commerce, a signature, contract or other record may not be denied legal effect, validity or enforceability solely because it is in electronic form (15 U.S.C. 7001(a)). Where the law requires a record to be in writing, the electronic version satisfies that requirement only if it can be retained and accurately reproduced (15 U.S.C. 7001(e)). In practice, the harder question is usually the signer’s authority. The Illinois Frauds Act requires certain agreements, including those that cannot be performed within one year of their making and promises to answer for another person’s debt, to be in writing and signed by the party to be charged or by someone that party lawfully authorized (740 ILCS 80/1). We recommend a written matrix that assigns who may sign what. Our signature-authority matrix is a starting point.

A contracting playbook for your team

We turn recurring questions into a contracting playbook for your team: preferred and fallback positions for the clauses that matter most, the issues that always go to counsel, who approves each type of agreement, and how notice and renewal deadlines are recorded. The playbook is built on your actual contracts, not a generic model.

By the project or as your outside general counsel

Many clients start with a single contract as a fixed-scope project: we quote up front and identify in writing the deliverables, assumptions, exclusions and any milestone that could require new approval. When contract volume is steady, a monthly retainer lets us serve as your outside general counsel, with a defined monthly scope, an agreed meeting and reporting cadence, and advance approval for any work outside that scope.

The work is led by our founding attorney, Abdul Kadir Mohamed, licensed in Illinois and Missouri. He has served as in-house general counsel and privacy officer for multi-site healthcare organizations with an MSO/PC structure, and as in-house general counsel, chief compliance officer and corporate secretary for multi-state, vertically integrated medical and adult-use cannabis companies.

Common questions about commercial contract review

What do we receive at the end of a contract review?

A redline ready to send to the vendor and a memo that explains each change, the fallback position, and the points we recommend you not concede. If the deal includes a DPA, BAA or security exhibit, we review it with the main agreement so the documents do not contradict each other.

Does the Illinois auto-renewal law protect our business from a vendor’s renewal?

No. The Illinois Automatic Contract Renewal Act does not apply to business-to-business contracts (815 ILCS 601/20(c)). Your protection lies in the notice and termination clauses you negotiate and in a calendar that records every cancellation deadline.

The vendor says its BAA is not negotiable. What can we do?

First we confirm that it contains everything 45 C.F.R. 164.504(e) requires. If something is missing, that is not a matter of preference. Then we review what the regulation leaves open, such as incident notice deadlines, responsibility for notification costs, and how the BAA interacts with the main agreement’s liability cap.

Is an electronically signed contract enforceable?

Generally, yes (15 U.S.C. 7001(a)). The practical risk is usually whether the signer could bind the company and whether you keep an accurate copy of the signed document.

Which contracts should go to counsel before signing?

Our recommendation: any agreement that involves personal or health information, a multi-year commitment or automatic renewal, exclusivity, a broad indemnity, or a vendor your daily operations depend on.

Related resources

General information only; not legal advice and does not create an attorney-client relationship.