Your Contract's Notice Date Is Your Real Risk Deadline

Eight of the 21 third-party risk teams we spoke with in October asked about contracts. Can we track renewals? Can we be alerted before the notice deadline? Can the terms be read automatically? It came up as often as AI did.

The date most teams track is the renewal date. The date that matters is the notice date.

Leverage has an expiration date

Most vendor contracts renew automatically unless someone gives notice, often 60, 90, or 180 days before the term ends. Once that window closes, the renewal is effectively decided. You can still raise a concern, but you have given up the strongest tool you had: the credible option to leave.

That makes the notice date the real deadline for risk work. If an assessment finds a material problem, the time to act on it is before notice, when the vendor has a reason to fix it. A finding that arrives after notice becomes a remediation request with no teeth for another full term.

The business owner belongs before the deadline, not after

One practitioner described a process worth copying. Before the notice deadline, the business owner gets a short set of questions. Is the vendor still needed? Has the use changed? Has performance been acceptable? Have there been incidents? For the most critical vendors, the answers then go to an executive who signs off on renewal or non-renewal, which their regulator expects to see documented.

That is not a contract process or a risk process. It is both, and it only works if the notice date is visible to the people doing the risk work.

Contract terms are controls

The other half of the contract question was about terms: right to audit, breach notification windows, data return at termination, subcontractor approval, governing law. These are risk controls written in legal language, and they are often the only controls you can actually enforce.

An assessment that finds weak incident response and a contract with a 30-day breach notification window are describing the same risk from two directions. Keeping them in separate systems means nobody sees both at once.

A useful exercise: list your ten most critical vendors and write down the notice date for each, not the renewal date. Then check when each one's last risk review happened. If the next review would land after notice, the renewal has already been decided by default.