Force Contracts to Cover AI Patch, Device and Compliance Risks

What happened

Ingram Micro launched The Great Migration to help partners move customers to Windows 11 Pro and AI-ready devices through a coordinated channel programme with Microsoft and hardware partners. The programme combines OS upgrades, device refresh and AI readiness into a single customer conversation with partner incentives, workshops and technical support. Watch whether partners use incentives to lock delivery terms or bundle staged acceptance and local support SLAs into deals

Why the category manager should care

Treat this as a real sourcing lever: resellers are packaging OS upgrades, device stock and AI enablement together, so procurement can demand staged acceptance and local SLAs as part of channel deals

Key facts

• Programme to move customers to Windows 11 Pro and AI-ready devices
• Includes education, technical support, customer workshops and partner incentives
• Frames OS upgrade, device refresh and AI readiness into a single sourcing conversation

What happened

ReadyTech research shows many Australian organisations are increasing AI spending while lacking consistent measures of cost, return and governance. The survey highlights integration shortfalls and governance gaps that leave procurement responsible for translating higher budgets into measurable outcomes and clear cost-allocation frameworks

Why the category manager should care

Treat increased vendor AI spend commitments as conditional: require outcome metrics, baseline productivity measures and clear cost-allocation for shared services

Key facts

• Survey of 311 Australian organisations
• 96% of respondents are using or exploring AI
• Many organisations lack AI governance and consistent return measurements

What happened

1Password's Off-By-1-Labs tested thousands of LLM-generated vulnerability patches and found a large share either failed to remediate or introduced new vulnerabilities. The most important operational takeaway is that many patches are 'fix-like' but flawed, so accepting AI-only fixes without independent validation is risky and should trigger contractual verification gates

Why the category manager should care

Require engineering-verified fixes and signed acceptance evidence for any patch work; AI can assist but not replace demonstrable QA and test artifacts

Key facts

• Assessed 6,080 LLM-generated patches
• Found 53.9% failed to remediate or introduced new vulnerabilities
• Only 26.0% fully resolved issues without materially changing application behaviour

What happened

Secureframe launched a hosted Model Context Protocol server that lets AI assistants query live compliance data without customers hosting the infrastructure. The operational detail to watch: it centralises live compliance access across frameworks like CMMC and NIST, which reduces buyer infrastructure but creates new data-flow, API and uptime dependencies that should be contractually controlled

Why the category manager should care

Treat hosted compliance assistants as an integration point: require API access, exportable evidence and controls so compliance data isn't locked behind vendor UIs

Key facts

• Hosted Model Context Protocol server for compliance
• Supports CMMC, NIST 800-171, FedRAMP and SOC 2 frameworks
• Provides hosted option for assistants such as Claude Desktop and Cursor