Cloud suspension clauses: when may the provider shut down an AI service?

The standard terms for the major cloud and AI services give the provider a broad right to suspend the service and to terminate the agreement. The OpenAI Services Agreement, effective from 1 January 2026, allows OpenAI to limit or suspend access where the customer breaches the agreement or OpenAI’s usage policies, where a security emergency arises and where the law so requires (Section 8.2). Anthropic, AWS, Google and Microsoft have comparable provisions. The EU has also prohibited the provision of AI services to Russian entities, and that prohibition has applied in Norway since 27 March 2026. The questions are which grounds for suspension the terms contain, what protection legislation offers the customer, and what the customer should agree on notice, proportionate suspension, wind-down, data export and liability.

What is a suspension clause?

A suspension clause is a contractual term that allows the provider to halt performance in whole or in part without bringing the agreement to an end. It differs from termination in that the agreement continues, so the customer normally remains liable to pay. Under AWS Section 4.2, for example, the customer remains liable for fees incurred during the suspension and receives no service credits for that period. Suspension is therefore a more severe remedy than its wording suggests, because the customer bears both the disruption and the cost.

In every set of terms examined, the right to suspend depends on the provider’s own assessment, using phrases such as “reasonably believes” or “reasonably determine”. In practice the customer cannot have that assessment reviewed before access is cut off.

What grounds for suspension do the major cloud providers rely on?

The grounds fall into four groups, namely breach of usage policies, security risk, non-payment and legal prohibition. The table is based on the providers’ standard online terms as they stood on 11 November 2026, not on negotiated framework agreements.

Microsoft and OpenAI expressly confine suspension to what is necessary, whereas Anthropic, AWS and Google do not. Microsoft’s wording is the clearest.

“If Microsoft suspends the Online Service, Microsoft will suspend only to the extent reasonably necessary.”

Several of the grounds are broad. OpenAI defines a “Security Emergency” as use that could reasonably result in a security risk, a credible risk of harm, infringement of third-party rights or liability to OpenAI. Anthropic may suspend where providing the service would materially increase its costs, or where a vendor suspends services on which Anthropic depends, and it excludes liability for losses “including any loss of data or profits” caused by a suspension (Section I.3.b). How breaches of Anthropic’s usage policy in high-risk use cases may lead to suspension is discussed in the article on AI vendor terms for high-risk use.

How quickly may the provider terminate the agreement?

Under most of the terms, the provider may terminate for convenience on 30 days’ notice. This applies to Anthropic (Section I.2.a), AWS (Section 5.2(a)) and Google for its cloud services (Section 8.5). OpenAI has no equivalent right, but its agreement runs for the term in the order form, and notice of non-renewal must be given at least 30 days before a renewal term (Section 1.2). In the event of material breach, either party may terminate under all the terms if the breach is not cured within 30 days of written notice.

Where there is a legal obstacle, the provider may terminate with immediate effect. Anthropic may do so where it reasonably believes that providing the services is prohibited by law (Section I.2.c), and Google where it reasonably believes that continued provision would be unlawful or that the customer has breached export control laws (Section 8.6). AWS may terminate immediately in order to comply with the law or requests of governmental entities (Section 5.2(b)). Under Section 5.3(b) of the AWS terms, the customer has 30 days to retrieve its content after termination, but only where AWS has not terminated for cause and only where all amounts due have been paid.

Can sanctions and export controls shut down an AI service?

Sanctions may oblige the provider to discontinue the service, and the contract terms also allow the provider to suspend for breaches of sanctions and export rules. Under Regulation (EU) No 833/2014 Art. 5n(1)(g), it is prohibited to provide artificial intelligence services consisting of access to models or to platforms for their training, fine-tuning and inference to the Government of Russia or to legal persons established in Russia. Point (h) covers high-performance computing, and both points took their current form through Regulation (EU) 2025/2033 of 23 October 2025. The Norwegian Ministry of Foreign Affairs announced on 27 March 2026 that the prohibition in sanksjonsforskriften Ukraina § 19c had been extended to AI services and high-performance computing with immediate effect.

For most Norwegian customers, the risk lies in the provider terms rather than in the prohibition itself. OpenAI prohibits use in US-embargoed countries and requires a warranty that neither the customer nor its end users appear on a restricted party list (Section 16.11). Under Section 16.12, the service may be suspended if the customer or its end users access or offer access outside the countries OpenAI supports. AWS requires a warranty that neither the customer, its financial institutions nor any party that owns or controls them is subject to sanctions or designated on a list of restricted parties (Section 11.6). Anthropic prohibits export and access where this is unlawful under US or other applicable international law (Section M.8), and use is permitted only in the countries and regions Anthropic supports. The terms refer to US rules such as the Export Administration Regulations and OFAC lists, and the provider’s reading of those rules determines whether it suspends.

A business offering an AI-based service in several countries may consequently lose access for all its customers if end users are located in a country the provider does not support. The providers’ rules on resale and intermediaries are covered in the articles on OpenAI’s approval requirement for intermediaries and reselling AI services and the provider role.

Do cloud suspension clauses fall under the Data Act?

The Data Act, Regulation (EU) 2023/2854, governs the customer’s right to switch provider, but it does not regulate the provider’s right to suspend the service or terminate the contract. Under Data Act Art. 25(2)(a), the contract must give the customer a transitional period of no more than 30 calendar days during which the service is maintained and the provider gives reasonable assistance. Under Data Act Art. 25(2)(g), the customer must then have at least 30 calendar days to retrieve its data. These rights are triggered by the customer’s request to switch, subject to a notice period of no more than two months under Data Act Art. 25(2)(d).

The Regulation does not expressly address whether the customer has the same rights where it is the provider that terminates. In our view, a clause that cuts off access to the data immediately upon termination by the provider is difficult to reconcile with the duty in Data Act Art. 23 to remove contractual obstacles to porting the customer’s data, but the question is unsettled. The switching rules are discussed further in the article on cloud exit.

The Data Act does not yet apply in Norway. According to EEA-Lex, the draft EEA Joint Committee decision incorporating the Regulation was sent to the European Commission on 6 November 2026. Incorporation then requires a Joint Committee decision, parliamentary consent and Norwegian implementing legislation. Until then, Norwegian customers must secure wind-down and data export through the contract.

What does Norwegian contract law say about suspension clauses?

Norwegian contract law applies directly only where Norwegian law has been chosen. For customers in the EEA, the OpenAI Services Agreement and Anthropic’s terms are governed by Irish law, with disputes resolved in Dublin. The choice of law determines how the clause is construed, as explained in the article on choice of law and jurisdiction.

Where Norwegian law applies, a suspension without a contractual basis is a breach of contract by the provider. Whether the customer may terminate depends on whether the breach is material, and the duration of the outage and its effect on the customer’s business are central factors. Under avtaleloven § 36, a term may be set aside or amended where enforcing it would be unreasonable or contrary to good business practice. The threshold is high between commercial parties, but in our view a right to suspend that requires no connection with the customer’s conduct, combined with a full exclusion of liability for loss of data, is the most obvious candidate. Limitations of liability are discussed in the article on limitation of liability in SaaS agreements.

What does DORA require of suspension and exit clauses?

DORA, Regulation (EU) 2022/2554, imposes specific requirements on ICT contracts in the financial sector and has applied in Norway since 1 July 2025 under DORA-loven § 1. Under DORA Art. 30(2)(d), the contract must ensure access to, recovery and return of data in an easily accessible format, including on the provider’s insolvency and on termination of the contract. Under DORA Art. 30(2)(h), the contract must set out termination rights and related minimum notice periods. For services supporting critical or important functions, DORA Art. 30(3)(f) requires an exit strategy with a mandatory adequate transition period during which the provider continues to deliver the service, and DORA Art. 28(8) requires that the entity be able to exit without disruption to its business.

The requirements apply only to financial entities, but in our view they are a sound benchmark for any customer whose critical processes depend on an AI service. None of the standard online terms examined provides such a transition period on termination by the provider, so financial entities must ensure that it follows from the contract in some other way.

What should the customer negotiate in a suspension clause?

The customer should first identify which processes stop if the AI service is suspended, and whether the model or provider can be replaced at short notice. The degree of dependency determines how much negotiation is worthwhile. Further articles on cloud and SaaS agreements are available on the contracts topic page. The following terms should be prioritised.

1. Require written notice with an opportunity to cure before suspension for policy breaches, and confine immediate suspension to acute security incidents.
2. Agree that any suspension is limited to the affected users, keys or functions and is lifted as soon as the issue has been remedied.
3. Remove grounds for suspension unrelated to the customer’s conduct, such as increased costs for the provider.
4. Require a wind-down period of at least 90 days on termination for convenience by the provider, during which the service is delivered on unchanged terms.
5. Secure the right to export all data, fine-tuned models, configurations and logs for at least 30 days after any termination, including termination for cause and during payment disputes.
6. Agree that an unjustified suspension entitles the customer to service credits and damages, and that the provider may not invoice for that period.
7. Give the customer the right to terminate without charge if a suspension lasts longer than an agreed period, for example five business days.
8. Map ownership and the location of end users, and agree that the provider will give notice before suspending on sanctions grounds unless notice is prohibited by law.

Questions and answers

Next legal review: 31 January 2027