What to Include in an AI Agent Scope of Work, a Practical Checklist for 2026
Malay Parekh
CEO & Director, Unico Connect
In this article
- Quick Answer
- Key Takeaways
- How an AI Agent Statement of Work Differs From a Software SOW
- The Fifteen Sections of an AI Agent Scope of Work
- Example Acceptance Criteria
- Sample Clause Language
- Common Mistakes in AI Agent Scopes
- A One Page SOW Checklist
- How We Recommend Scoping AI Agent Projects
- Frequently Asked Questions
- Sources
A statement of work for an AI agent looks like any other software contract until the first acceptance meeting. Then the gaps show. The agent passes most test cases but not all of them, nobody agreed what share was good enough, the model bill arrives separately from the invoice, and a model update changes behavior a month after sign off. This guide sets out what to include in an AI agent scope of work so both sides agree up front on what the agent may do, how it will be judged, what it will cost to run, and who owns what at the end. It reflects the approach we recommend for agent projects, with external standards and dates checked on 22 September 2026.
Quick Answer
An AI agent statement of work should define the business goal, what the agent may do alone, what needs approval, and what it must never do, the tools and data it can reach, and how it will be accepted, as a pass rate on an agreed evaluation set. It should also cover security testing, running cost caps, compliance owners, liability terms, handover of prompts and evaluations, rechecks when models change, and payments tied to evaluation gates.
Key Takeaways
- Define autonomy explicitly. List what the agent may do alone, what needs approval, and what it must never do.
- Accept on evaluations, not demos. Agree an evaluation set and pass thresholds before build starts, because agent output varies from run to run.
- Put running costs in writing. Model, tool, and hosting costs continue after launch, so agree budgets, caps, and who pays each bill.
- Plan for model change. Providers update and retire models, so the SOW should say how behavior is rechecked when that happens.
- Own the assets that make the agent work. Prompts, evaluation sets, tool code, and configuration should transfer at handover, not just the application code.
How an AI Agent Statement of Work Differs From a Software SOW
| Topic | Traditional software SOW | AI agent SOW |
|---|---|---|
| Acceptance | Features work as specified | Pass rates on an agreed evaluation set meet thresholds |
| Behavior | Deterministic, same input gives same output | Probabilistic, output can vary between runs |
| Costs after launch | Hosting and maintenance | Hosting, maintenance, model tokens, tools, and sandboxes |
| Risk surface | Application security | Application security plus prompt injection, excessive agency, and data leakage |
| Change over time | Changes when you release code | Can change when the underlying model changes |
| Key assets | Source code | Source code, prompts, evaluation sets, tool definitions, and configuration |
The Fifteen Sections of an AI Agent Scope of Work
1. Business objective and success metrics
State the problem in business terms and the metric that proves it is solved, with a baseline. For example, the share of support tickets resolved without a person, average handling time, or hours of analyst work saved per week. Agree how and over what period each metric will be measured after launch.
2. Scope of autonomy
This section is often left vague. Write three lists.
- Actions the agent takes alone. Such as reading records, drafting replies, or classifying requests.
- Actions that need approval. Such as sending external messages, issuing refunds, or changing records.
- Actions the agent must never take. Such as deleting data, changing permissions, or contacting certain customers.
3. Tools, systems, and data access
List every system the agent will connect to, whether access is read or write, the permission scope, and who provisions the credentials. Least privilege should be the default, with write access granted per action rather than per system. List what you will provide and by when, such as system access, sample data for the evaluation set, subject matter experts, and time for testing, and add an out of scope list for the project itself. In its June 2026 analysis of agentic AI contracts, the law firm Mayer Brown advises that dependencies be identified with enough specificity to tell whether a missed target was caused by the vendor, the client, or an upstream provider.
4. Model and hosting choices
Name the models in scope, any fallback model, where the system is hosted, and where data is processed. Hosting choices can decide compliance on their own. For example, the OpenAI Agents API currently supports data residency only in the United States and does not support Zero Data Retention, which rules it out for some regulated workloads. Allow model substitution with reevaluation, so the agent is not locked to one provider. Our guide to choosing an AI model for production covers the tradeoffs.
5. Evaluation plan and acceptance criteria
Agree an evaluation set of real or realistic tasks, how it is scored, and the pass thresholds, before build starts. Include a regression suite that runs on every change and a sample of production outputs reviewed by people after launch. Because output varies between runs, run each evaluation task more than once and judge the pass rate across runs. State what happens when a threshold is missed, such as a fixed remediation window, a rerun on the same set at no extra cost, and the right to reject the milestone after an agreed number of failed attempts.
6. Security requirements
Reference a recognized list of risks rather than a vague security clause. The OWASP GenAI LLM Top 10 for 2026, published on 3 August 2026, covers risks such as prompt injection, sensitive information disclosure, excessive agency, and unbounded consumption, and it maps to the separate OWASP Top 10 for Agentic Applications, which covers agent risks such as goal hijack, tool misuse, and privilege abuse. For US buyers, CISA and its US and international partners published Careful Adoption of Agentic AI Services on 1 May 2026, guidance on the security challenges and risks of agentic AI with steps for designing, deploying, and operating these systems safely. Citing it alongside OWASP gives both sides a shared public baseline. Specify the testing, such as prompt injection and red team exercises, and who fixes findings before launch. Our guide to AI agent security and prompt injection covers the controls in detail.
7. Human in the loop and escalation
Define who approves what, the expected response time, what happens when nobody responds, and how the agent hands a case to a person with full context. See our guide to enterprise AI guardrails and human approval flows.
8. Observability, logging, and audit
Require traces of every model call, tool call, and decision, state how long logs are kept, and who can access them. Audits and debugging both depend on being able to reconstruct what the agent did and why. Our guide to AI observability in production covers what to trace.
9. Durability and failure handling
State that long running work must survive restarts and resume from the last completed step, that side effecting tools must be safe to retry, and what the agent does when a model or tool is unavailable. Thoughtworks placed ignoring durability in agent workflows in the Caution ring of its Technology Radar in April 2026 for exactly this reason.
10. Running costs and budget limits
Separate the build fee from running costs, and state who pays model, tool, and hosting bills. Agree a cost estimate per completed task, a monthly budget, hard caps per task, and alerts when spend spikes. For what running an AI system costs after launch, see what it costs to maintain an AI product.
11. Compliance
Identify the rules that apply and who is responsible for each. In the EU, the AI Act rules for high risk systems in sensitive areas apply from 2 December 2027, and for AI embedded in regulated products from 2 August 2028, after the AI Omnibus entered into force on 27 July 2026. Even an agent that is not high risk can be affected. The European Commission says the AI Act transparency rules apply from August 2026, so people using a system such as a chatbot should be made aware that they are interacting with a machine. Name who owns that disclosure. For health data in the US, name who signs the business associate agreement. For personal data under GDPR, name who signs the data processing agreement. The voluntary NIST AI Risk Management Framework, with its Generative AI Profile published in July 2024, is a useful shared reference for risk controls.
12. Ownership, IP, and handover
Specify that you own the project specific application code, prompts, evaluation sets, tool definitions, configuration, and any fine tuned models, and that they transfer as they are created. Vendors usually keep their background IP, such as reusable frameworks, connectors, and templates, so list what counts as background IP and require a perpetual license to any of it the agent needs to run. State who owns the data, logs, and outputs the agent produces, and that none of it may be used to train models belonging to the vendor or its suppliers without your written consent. Require documentation that lets another team run and change the agent.
13. Support and model change management
Model providers give published notice before they retire models. OpenAI publishes minimum notice periods of six months for generally available models and three months for specialized variants, and says preview models may be retired with much shorter notice, such as two weeks. Anthropic gives at least 60 days of notice before retiring publicly released models. The SOW should keep preview models out of production, say who watches these notices, require the acceptance evaluation to be rerun whenever a model is updated and on the replacement model well before the retirement date, and state how fixes are priced during the support period.
14. Timeline, phases, and payment milestones
Phase the work and tie payments to evaluation gates rather than calendar dates. A common shape is discovery, a pilot that must pass its evaluation thresholds, a limited production rollout, and full rollout. Our guide to moving an AI pilot to production covers the rollout stages.
15. Liability, indemnity, and warranty
Standard software liability terms were not written for systems that act on their own. Mayer Brown suggests aligning responsibility with control, notes that traditional IP indemnities may not cover claims arising from the actions of AI agents, and warns that indemnities from AI providers are typically narrow and heavily conditioned. The SOW, or the master agreement above it, should say who is liable when an agent action causes harm, how liability caps apply, which model provider indemnities pass through, and how long the vendor fixes defects after acceptance at no extra cost.
Example Acceptance Criteria
The thresholds below are illustrative, not benchmarks. The right numbers depend on the task, the risk, and the baseline.
| Criterion | How it is measured | Example threshold |
|---|---|---|
| Task success | Share of evaluation tasks completed correctly | At least 90 percent on the agreed set |
| Critical errors | Tasks where the agent took a forbidden or harmful action | Zero on the agreed set |
| Escalation accuracy | Share of cases correctly handed to a person | At least 95 percent |
| Grounding | Answers supported by retrieved sources | At least 95 percent in reviewed samples |
| Cost per task | Model and tool spend divided by completed tasks | Within the agreed budget |
| Latency | Time to complete a typical task | Within the agreed service level |
Sample Clause Language
Adapt these with your counsel.
- Autonomy. The agent may read records and draft replies without approval. It may issue refunds or send external messages only after approval by a named approver. It must never delete data, change permissions, or contact customers on the exclusion list.
- Acceptance. The pilot is accepted when the agent completes at least the agreed share of evaluation tasks across repeated runs, with zero critical errors. If a threshold is missed, the vendor fixes the agent and reruns the set within an agreed window at no extra cost.
- Running costs. The client pays model, tool, and hosting bills directly. The vendor designs the agent to stay within the agreed cost per task and monthly budget, with hard caps and spend alerts configured before launch.
Common Mistakes in AI Agent Scopes
- Acceptance by demo. A live demo shows one run. It says nothing about the next hundred.
- No autonomy limits. Without a never list, every surprising action becomes an argument about intent.
- Running costs left out. The first model bill should not be a surprise to either side.
- Assuming the model is fixed. Behavior can shift when a provider updates a model.
- Only code in the handover. Without prompts and evaluation sets, the next team starts from zero.
- Security as one line. Name the risks, the tests, and who fixes what.
A One Page SOW Checklist
- Objective, baseline, and success metric agreed.
- Autonomy lists written, alone, with approval, and never.
- Systems, permissions, credential owners, client dependencies, and out of scope items listed.
- Models, fallback, hosting region, and data processing location named.
- Evaluation set, scoring, repeated runs, pass thresholds, and the remediation path agreed before build.
- Security risks referenced and tests specified.
- Approval owners, response times, and handoff defined.
- Tracing, log retention, and access agreed.
- Resume, retry safety, and outage behavior specified.
- Running cost estimate, monthly budget, caps, and alerts agreed.
- Compliance owners named for each rule that applies.
- Ownership of code, prompts, evaluations, and configuration confirmed, background IP licensed, and no training on your data.
- Model change monitoring and reevaluation process defined.
- Phases and payments tied to evaluation gates.
- Liability, indemnities, and the post acceptance fix period agreed.
How We Recommend Scoping AI Agent Projects
Start with a short discovery phase that produces the autonomy lists, the evaluation set, and a running cost estimate before a build fee is committed, and tie later payments to evaluation gates. Our agentic AI development team can run that discovery and build against the agreed criteria. For budgets, see our guide to AI agent development cost. For the engineering side of the scope, see what breaks when AI agents run in production and our guide to the OpenAI Agents API. If you are still choosing a vendor, see how to choose an AI development company, or hire an AI engineer to work inside your team. You can also talk to our team about scoping your agent.
The most useful page in an agent contract is the list of things the agent must never do. Write that first, then agree how you will measure everything else.
Malay Parekh, CEO, Unico Connect
Frequently Asked Questions
What should an AI agent statement of work include?
The business objective and success metrics, the limits of the agent autonomy, tool and data access, model and hosting choices, an evaluation plan with acceptance criteria, security requirements, human approval and escalation, observability, failure handling, running costs and budget caps, compliance responsibilities, ownership and handover, model change management, liability, indemnity, and warranty terms, and phased milestones tied to evaluation gates.
How do you define acceptance criteria for an AI agent?
Agree an evaluation set of realistic tasks before build starts, decide how each task is scored, and set pass thresholds such as a minimum task success rate and zero critical errors. Because agent output can vary between runs, acceptance is measured as a pass rate on that set rather than by a single demo.
Who pays for model and API costs in an AI agent project?
It should be stated in the SOW. A common arrangement separates the build fee from running costs, with the client paying model, tool, and hosting bills directly or through a pass through arrangement. Either way, agree a cost estimate per task, a monthly budget, and hard caps.
What security requirements belong in an AI agent contract?
Reference a recognized risk list such as the OWASP GenAI LLM Top 10 for 2026 and the OWASP Top 10 for Agentic Applications, plus the May 2026 CISA guidance on agentic AI for US buyers, specify prompt injection and red team testing, require least privilege tool access, and state who fixes findings before launch.
How should an SOW handle changes to the underlying AI model?
It should name who monitors provider update and retirement schedules, require rerunning the acceptance evaluation when a model changes, state how any fixes are handled during the support period, and keep preview models out of production, since they can be retired at short notice.
Who owns the prompts and evaluation data in an AI agent project?
The client should own everything created specifically for the project, and the SOW should say so explicitly. Prompts, evaluation sets, tool definitions, configuration, and any fine tuned models are what make the agent work, so they should transfer with the source code. Vendor background IP, such as reusable frameworks, usually stays with the vendor, so ask for a license to whatever the agent needs to run.
Does the EU AI Act affect an AI agent SOW?
It can, if the agent is used in the EU. An agent that interacts with people falls under the AI Act transparency rules, which the European Commission says apply from August 2026, so users should be made aware that they are interacting with a machine. If the agent also falls into a high risk area such as employment or credit, the stricter rules apply from 2 December 2027 after the AI Omnibus, so the SOW should say who classifies the system and who prepares the required documentation.
Sources
Security references come from the OWASP GenAI LLM Top 10 2026 and its mapping to the OWASP Top 10 for Agentic Applications, and from the CISA guidance Careful Adoption of Agentic AI Services. The risk framework reference comes from the NIST AI Risk Management Framework, and the EU AI Act dates and transparency rules from the European Commission. Durability guidance comes from the Thoughtworks Technology Radar, Agents API limits from OpenAI documentation, model notice periods from OpenAI and Anthropic, and contract points from Mayer Brown. All were read on 22 September 2026.
