The Master Service Agreement is the umbrella contract between a customer and a vendor that sets the legal terms of the relationship once. Every subsequent order form, statement of work, or addendum points back to it. The MSA covers the durable terms; the order form covers the deal-specific ones (price, term, scope).
A modern SaaS MSA carries a recurring set of clauses: license grant or subscription terms, fees and payment, intellectual property ownership, warranties, indemnification, limitation of liability, confidentiality, term and termination, governing law, and increasingly, AI-specific terms around training data, output ownership, and acceptable use. The DPA typically attaches as an exhibit or rides as a separate document.
The leverage in MSA negotiation sits in a small handful of clauses. The cap structure on limitation of liability. The carve-outs from that cap (IP indemnity, breach of confidentiality, gross negligence, data breach). The IP indemnity scope. The customer's right to terminate for convenience and what happens to data on exit. The renewal mechanics. Everything else is usually closer to standard than the parties realize.
A common drafting mistake is treating the MSA as a one-time exercise. Modern MSAs are revised regularly as the vendor's business changes, as case law shifts, and as AI clauses get added. The vendor that keeps a single living MSA template, refreshed quarterly, gets through procurement reviews dramatically faster than the vendor that drafts each contract from a stale base.