An agency contract that allows AI buying agents should state which agents are used, what each one may decide alone, which decisions need a named human, and how every agreed deal is recorded and audited. Most media agency agreements were written for people placing orders, so these points are usually missing or scattered across schedules. The 12 clauses below turn them into a checklist an advertiser can take into its next contract review.

TL;DR: Add 12 clauses covering disclosure, consent, delegated authority, a record of every deal, decision logs, approval thresholds, protected deal terms, audit access, a pause right, data ownership, agent identity and accountability. Industry templates from the ANA and ISBA already address AI, but agents that commit spend raise questions of authority and evidence that need their own wording. This is an editorial checklist, not legal advice, and any clause should be drafted or reviewed by a qualified lawyer in your jurisdiction.

Why do existing agency contracts struggle with AI buying agents?

The industry templates moved first on AI in general. In June 2023 the ANA's updated media agency contract template added a clause requiring an agency to obtain the advertiser's prior consent before using AI applications in its services, MediaPost reported, although the template did not define AI. In July 2025 the ANA added a generative AI contract rider covering disclosure, ownership and human oversight, according to AdExchanger, and ISBA's Media Services Framework 2025 refined its generative AI elements.

Agents that negotiate and commit media change the question. Advertising lawyers at Reed Smith wrote in September 2026 that brands must now consider "how much authority an AI agent holds, what actions it may take without approval, and whether its decisions can be reconstructed."

Agencies are mostly updating contracts through addendums, Digiday reported, and clients want human oversight, indemnity, disclosure of tools and intellectual property spelled out. "Ultimately, people want disclosure. They want to know what tools are being used," Keri Bruce, head of Reed Smith's advertising group, told Digiday.

What are the 12 clauses to add?

Each clause says what to write and what to check. Treat them as headings for your lawyer, not finished drafting.

1. Disclosure: which agents and models touch the budget

Require the agency to list every AI agent that plans, negotiates or buys on the account, the model or vendor behind it, and any third-party tools in the chain. The ANA rider already asks agencies to be transparent about third-party AI tools. Add a duty to update the list before any new agent touches live spend.

Check: a named register of agents, kept by the agency and refreshed before each change.

2. Consent: what needs permission and how it is withdrawn

Prior consent was the ANA template's original AI provision, and it remains the simplest control. Specify which agent uses need advance written consent, which are pre-approved, and the advertiser's right to withdraw consent with a stated notice period.

Check: consent is given per agent and per use, not in one blanket sentence.

3. Delegated authority: the agent's mandate in writing

Define what the agent may decide alone: spend and pacing limits, channels, deal types, prohibited inventory and any sensitive audience data or inferences it may not use. Melissa Bonnick, head of programmatic at JPMorgan Chase, described clear restrictions as telling the machine "Here is your box, stay in [the] box," AdExchanger reported. Keep the mandate in a schedule that can change without reopening the agreement.

Check: every limit is a number or a list, never an adjective.

4. A record of every agreed deal

Require a written, timestamped record of the terms of each deal an agent agrees, available to the advertiser and not only to the agency. Otherwise a dispute rests on each party's own logs, which may not match. Alkimi offers one worked example: on its Marketplace, a DealSheet is written at agreement, timestamped, held by both parties and retrievable by either side independently.

Check: the advertiser can retrieve any deal record without asking the agency for it.

5. Decision logs that explain why

The agency should also keep a log of what each agent did and why, for a stated retention period. Digiday described an agency team using a supply-side audit log so that a buyer could ask an agent "why did you make that change?" and reconstruct the answer. Each change was "time-stamped, stored with all the details of the change," a PubMatic sales engineering director told Digiday.

Check: the log links each action to the brief and mandate in force at the time.

6. Human approval thresholds

Name the decisions that need a human, and which human: for example, any deal above a set value, any new seller, or any term outside the mandate. IAB Tech Lab's open-source seller agent supports approval gates that pause a proposal until an operator approves, rejects or counters it, recording who decided and why. Tie thresholds to an autonomy stage, such as the earned autonomy sequence of Observe, Recommend, Draft, Human-approved action and Bounded automatic action, so that autonomy widens only on evidence.

Check: thresholds are numbers, and approvers are roles with named deputies.

7. Deal terms the agent may not trade away

List the terms the agent cannot concede without approval, such as viewability floors, brand safety settings, frequency caps and make-goods. The risk is measurable: in Concourse Bench v1, a benchmark of AI media-buying agents, 95 of 110 signed contracts promised a viewability floor below 70%. Fixed minimums give a clear test of whether the agent kept to its brief, as in CTV viewability floor clauses.

Check: each protected term has a minimum value and an approver for any exception.

8. Audit rights that reach the agents

Extend existing audit rights to agent activity: deal records, decision logs, instructions given to agents and log-level delivery data. The 2023 ANA template kept audit rights with no limit on the number of audits, according to MediaPost, language worth keeping. Betty Louie, general counsel at The Brandtech Group, said at Programmatic IO that "that level of auditability is really important" for confidence in AI tools, AdExchanger reported.

Check: the audit clause names agent records explicitly, as set out in buyer audit rights over agent-negotiated deals.

9. The right to pause, override and roll back

The advertiser should be able to pause any agent, override a decision or stop automated buying entirely, with a stated response time. The Reed Smith guidance lists "the right to pause or roll back autonomous activity" among its recommended oversight terms. Specify who can trigger a pause and what happens to deals already in flight.

Check: a named contact can stop every agent on the account within an agreed time.

10. Data ownership, confidentiality and model training

State that the advertiser owns its data, outputs built on it and any models trained on it, and whether the agency may use that data to improve tools for other clients. "The client has to retain that data ownership, because then, if you ever have a breakup, the agency can't take that data with them," Bob Lord, president of Horizon Media, said at Programmatic IO, AdExchanger reported. Carve confidential information out of any training rights.

Check: the exit clause covers data, outputs and trained models, not only campaign files.

11. Agent identity and the standards agents work to

Require the agency to confirm the identity of the agents it deploys and of the counterparties they trade with, and to name the protocols they use. IAB Tech Lab's AAMP (Agentic Advertising Management Protocols) includes an Agent Registry that sets "a trusted framework for agent identity, verification, and disclosure." The Ad Context Protocol (AdCP), published by AgenticAdvertising.org, is a further open standard for agent-based advertising.

Check: the contract names the standards in use, giving audits a shared reference.

12. Accountability, incidents and liability

Name an accountable person at the agency for each account, and a deadline for telling the advertiser when an agent acts outside its mandate. "Every deliverable has an accountable human," Jonathan Whiteside, global EVP of technology at Dept, told Digiday, adding: "It's not an excuse to say, 'Oh, AI did it.'" Then settle indemnity for agent actions outside approved parameters, and confirm errors and omissions insurance covers AI-driven operational risk, as Reed Smith suggests.

Check: incident notice, indemnity and insurance are agreed before the first agent goes live.

How should an advertiser test these clauses before signing?

A clause is only as strong as the evidence that the agent obeys it. The Reed Smith guidance advises controlled testing with defined criteria "before expanding autonomous authority or media spend allocated to such tools," and VML's Brian Yamada told Digiday to build in flexibility "to re-examine" as the market changes. Run the agent against its mandate in a test setting, then write the limits it actually held into the schedule.

Alkimi, which runs Concourse, builds for this stage. Its Gym lets buyers and sellers build their own agents, set the rules they work to and spar against counterparty agents before any real money moves, and its Marketplace keeps human approval rights at the deal level.

Frequently asked questions

Is this checklist legal advice?

No. It is an editorial checklist of contract topics, and every clause should be drafted or reviewed by a qualified lawyer for your market.

Do the ANA and ISBA templates already cover AI buying agents?

Both address AI, including the ANA's prior consent clause and ISBA's 2025 generative AI elements. Mandate, approval and deal-record terms for agents that commit spend usually need their own wording.

Who is liable if an AI agent makes a bad media buy?

That depends on the contract and the governing law, which is why clause 12 matters. The Reed Smith guidance warns that AI-driven decisions "are likely to be treated by regulators as company decisions, and the absence of human intervention will not shield brands from liability."

Should the contract name specific AI tools?

Yes, ideally in a schedule rather than the main agreement, so it can be updated as tools change. The schedule should list each agent, its function, the model or vendor behind it and the consent that covers it.

How often should AI clauses in an agency contract be reviewed?

Set a fixed review date plus a trigger for any new agent or change in autonomy stage. Agencies told Digiday they already update contracts through addendums, which suits a schedule-based approach.

What Your Agency Contract Should Say About AI Buying Agents: 12 Clauses