The Trust Ledger

AI Service SLAs: Uptime, Reliability and What Buyers Should Negotiate

By The Trust Ledger team · 6 min read

A large globe filament bulb glowing amber against a black background
In short

Read an AI service SLA in minutes and layers. A 99.9% monthly commitment allows about 43 minutes of downtime, and availability multiplies across dependencies. Buyers should also negotiate latency targets, rate limits and model change notice, which many SLAs cover loosely or not at all.

An AI service can meet a 99.9% uptime promise while your workflow is unusable for hours. The gap lies in what is measured.

A shop can be open all day and still have sold out of the one item you came for. By the sign on the door it was available, but not by your experience. This guide shows you how to read an AI service SLA for what it truly promises, expose weak commitments with simple arithmetic and plan the reliability the contract leaves out.

Why AI service SLAs fall short

A service level agreement (SLA) sets out what a provider commits to, how it is measured and what happens when it is missed. For AI, a service can be reachable and still useless, because reliability has four layers. Most SLAs cover only the first one well.

  • Availability: the service is reachable and returns valid responses.
  • Latency: it responds quickly enough, even at the slow end of the range.
  • Capacity: it serves your peak volume without throttling you.
  • Behaviour: results stay comparable after model updates or retirements.

Two further issues compound the gap. Many AI products depend on an upstream model provider, so your supplier may not control the component most likely to fail. Downtime is also often defined as total unavailability, so a slow or throttled service still counts as up.

Convert every percentage into minutes

Translate availability into time before comparing offers. The measurement window matters as much as the number, because an annual commitment allows the whole year's downtime in a single bad day.

AvailabilityDowntime per 30-day monthDowntime per year
99.5%About 3.6 hoursAbout 43.8 hours
99.9%About 43 minutesAbout 8.8 hours
99.95%About 22 minutesAbout 4.4 hours
99.99%About 4.3 minutesAbout 53 minutes
Simple arithmetic: (1 minus availability) multiplied by minutes in the period.

Your workflow depends on a chain, and availabilities in a chain multiply. Take a hypothetical AI product at 99.9%, an upstream model service at 99.9% and an identity provider at 99.95%. Together they reach about 99.75%, or roughly 108 minutes of downtime a month. That is two and a half times what the headline figure suggests. Ask which upstream services the product relies on, and whether their failures are excluded.

Read the clauses that carry the risk

Read the service description and the SLA together. The most important limits usually sit in definitions and exclusions rather than in the headline commitment.

ClauseWhat to look forRed flag
Downtime definitionError rates and failed requests countOnly complete outage counts
ExclusionsPlanned maintenance capped and notifiedUpstream model failures excluded, no redundancy
LatencyA target at a high percentile, such as p95No latency commitment at all
CapacityWritten rate limits for your tierLimits changeable without notice
Model changeWritten notice and time to testModels retired at the provider's discretion
RemediesCredits that scale, exit rights for repeat breachesLow capped credits with short claim windows
Use the red flags as negotiation points. This is general information, not legal advice.

Rate limits deserve particular care, as they cap how many requests you may send each minute. They rarely matter in a pilot and often matter at rollout. Size your tier against forecast peak demand, and ask whether throttled requests count as downtime.

Ask how the last model retirement was handled and how much notice customers received, because history is better evidence than policy. Ask also for twelve months of availability history and post-incident reports. Where a SOC 2 report exists, check whether availability is in scope, since many reports cover security only.

Service credits are a signal, not insurance

Consider a hypothetical company paying USD 15,000 a month for an AI chat assistant. The SLA promises 99.9% monthly availability, with a 10% credit below that. A four-hour outage at peak brings availability to 99.44%, so the credit is USD 1,500.

Meanwhile, 900 chats move to human agents at eight minutes each. That is 120 hours of overtime at USD 40 an hour, or USD 4,800. Two hours of very slow responses that week did not count at all, because the service was technically up. The credit covered less than a third of the direct cost, which is entirely normal.

Plan the reliability the contract omits

Protection comes from your own design, scaled to how critical each workflow is. A batch summary can wait an hour, whereas a customer-facing assistant cannot. We recommend three habits.

  • Measure from your side: log response times, errors and throttling at your integration.
  • Test the fallback: switch to a second model or a manual process once a quarter.
  • Retest on model change: run a fixed set of real tasks before any update reaches users.

For EU financial entities, the Digital Operational Resilience Act has applied since 17 January 2025. Its Article 30 requires contracts for ICT services supporting critical or important functions to include precise performance targets and exit strategies. It is a useful benchmark even outside its scope.

The bottom line

Conclusion

The shop with its door open and its shelves empty kept its promise and still failed its customer. An AI SLA can do the same, because most contracts commit firmly to availability alone.

Convert every percentage into minutes, read the exclusions, negotiate latency, capacity and model change notice, and test your fallback. This week, list the AI services your teams rely on, note each SLA's measurement window and downtime definition, and mark which workflows have no fallback.

Frequently asked questions

How much downtime does 99.9% uptime allow?

About 43 minutes in a 30-day month, or about 8.8 hours a year. An annual measurement window allows that whole amount to fall in a single incident.

What is model deprecation in an AI service?

It is when a provider retires an older model version. Buyers often seek written notice and a testing period, because a replacement model can change outputs.

Are service credits enough compensation for an AI outage?

Usually not. Credits are typically a capped share of the monthly fee and rarely match the business cost of an outage, so they signal confidence rather than insure you.

Should an AI SLA include latency?

For real-time or customer-facing workflows it should, ideally as a target at a high percentile such as p95, because a slow response can break a workflow as surely as an outage.

What fallback should I plan for a critical AI workflow?

Common options are a second model or provider, a degraded or rules-based mode, or a manual process with a named owner, tested deliberately at least once a quarter.

References

  1. EUR-Lex, Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), Article 30
  2. Secureframe, SOC 2 Trust Services Criteria explained

Disclaimer: General information only, not legal, security, compliance or financial advice. Check the cited sources and seek professional advice. Names belong to their owners; no endorsement implied.