AI capabilities are being added to existing vendor contracts under the radar — before buying or renewing software, organizations must be sure they understand how new AI features affect security and data privacy.