The handover document, the disclosure, the off switch, and the assertion that makes silent failure visible — plus what you genuinely do not owe, agreed in writing before you start.
- If AI is in the pipeline, say so in writing — not because you must in most cases, but because the alternative is them finding out from an output.
You automated something for a client. It works. What you owe them is not the automation — it is everything that lets them survive it failing when you are not there.
You know what it does, what it assumes, and where it is fragile. The client knows none of that, and will discover it at the worst possible moment. Everything below is about closing that gap before it opens.
What the handover document contains
- What it does, in one paragraph, in their language. Not the architecture — the outcome.
- What it assumes. Every dependency: a file in a location, a field name, a page layout, an API. These are what break, and they break silently.
- What it costs to run. Monthly, with the API line separate. See the repo analysis — API bills run 30–50% of margin and clients are rarely told.
- How to turn it off. One instruction, written for someone who is panicking.
- What "wrong" looks like. The output when it is working, so they can recognise when it is not.
- Who to contact, and what you will and will not do.
Disclosure
If AI is in the pipeline, say so in writing — not because you must in most cases, but because the alternative is them finding out from an output.
Under the EU AI Act, Article 50(4) requires labelling of AI-generated text published to inform the public only where no human editorial control was exercised. Enforceable since 2 August 2026.Regulation (EU) 2024/1689, Art. 50(4) · Commission Guidelines, 20 Jul 2026 If your client is publishing unreviewed output, that obligation is theirs — and they need to know it exists.
The clause that matters most
Automations do not usually stop. They keep running against something that changed, producing confident output that is now wrong — a field renamed, a layout altered, a source moved.
A chain that fails loudly costs an afternoon. A chain that fails quietly costs whatever it produced in the meantime, multiplied by how long nobody noticed.
So the handover needs one thing beyond documentation: an assertion the client can see. A count that should be roughly twenty. A file that should appear daily. Something whose absence is visible without reading a log. Automations covers the design side.
What you owe, and what you do not
- You owe: the documentation above, a working off switch, honest cost figures, and disclosure.
- You owe: telling them which parts you did not verify. If you did not read the generated code, say so — published vulnerability rates in AI-generated code run 25% to 62%.Range across studies incl. Snyk 2026 and Pearce et al. 2022 — see the full correction
- You do not owe: indefinite free maintenance, or liability for a dependency the client changed.
- Both of those need to be in writing before you start, not negotiated after something breaks.