A renewal date is a line on a contract, and it does not move. Between one renewal and the next, a client's employees put in roughly a year of GenAI use — it arrives on the provider's side as a finance lead asking whether the spreadsheet they pasted into a chatbot is now somewhere they cannot get it back, as an office manager who needs an acceptable-use policy by Friday, as the Monday call after a contract went into a summarizer. None of it is in the agreement, because nothing unapproved ever is.
Check Point Research's AI Security Report 2026 gives that year a shape. Organizations used an average of 10 AI applications a month, many without official approval, and the share of prompts classed high-risk doubled over the report's year, from 2% to 4%, roughly one in every 25 interactions. In Business Services the rate reached 5.91%, nearly one in 17. Nobody can say what the rate will be at the next renewal, and there is no honest way to project it from one interval. What matters is when you started counting, not what you guess the number will be.
The Date You Already Know
A service agreement is scoped once and holds until the next signature. Every client on the book has a renewal date, and at each one, this year or next, the AI question will be on the table, raised by the client's board, an insurer, an auditor, or the client's own staff who have been asking it for a year already. When it is raised, one of two things is true.
Either the provider holds a year of measurement from the client's own tenant, or it is answering the client's AI question from a vendor's aggregate. The first is a scope conversation the provider leads, with the seat count and the hours justified by evidence the client has never seen: which tools are in use, what leaves the business through them, and who is allowed to use what. The second is a scope conversation the client leads, usually with a figure from a press release and a question the provider cannot answer about the client's own people.
That year of evidence cannot be bought at renewal. It has to already be running by then.
Why The Year Went Unobserved
The provider can answer with evidence because it already runs the client's identity, endpoint, and browser, and that is where AI use shows up. It went unobserved for the same reason it is easy to observe once someone decides to: the session looks like a browser tab because it is one. Nothing in the existing stack was wrong to let it through — it was just never asked to count it.
Counting it is a decision about what the provider wants to know before the client asks. No product makes that call on its own.
What To Tell The Client
Your team's use of AI tools changes month to month, and our agreement with you does not. So for the past year we have been watching what is actually in use across your tenant rather than assuming. Before we renew, I want to walk you through which tools showed up, how many came in without anyone approving them, and where the risky interactions cluster. Then the next 12 months get scoped against what your people do, not what either of us guessed last year.
The Rolling Clock
A book of 20 or 30 clients has no single renewal date. It has a rolling one. The first client whose renewal lands with a year of evidence behind it becomes the template for the next, and by the third the provider has a scope line, a reporting format, and a reason to be in the room before the question is asked. The provider who waits for the question has the same 12 months on the calendar and nothing to show for them.
