AI in your software: the contract line that pins the model
It is the line that names the model, and it has to name a version. Under Mistral's published lifecycle policy, a model called by an alias such as mistral-medium-latest is switched to a newer model the moment that newer one reaches General Availability — no notice, and the vendor's own documentation warns that the price can move with it. A model called by a fixed major.minor identifier at General Availability changes for nobody: it gets six months' written notice before retirement, and when the date passes the call fails with a 404 rather than quietly answering from something else.
So the question to put to your software supplier is not which model they are using. It is which identifier is in the code, and what stage that model is at.
What each choice commits you to
| What the contract names | What can change, and with what notice |
|---|---|
An alias — mistral-medium-latest, mistral-medium-3 | The model itself, whenever the vendor promotes a newer one. Behaviour and pricing both. No notice. |
A pinned version at General Availability — mistral-medium-3-5 | Nothing until retirement, and no silent updates. Six months from the deprecation announcement, then a 404. |
| A Labs or Public Preview model | Anything, at any time, silently. One month's notice before retirement. |
| Open weights on hardware you control | Nothing until you change it. |
Two things follow from that table. The first is that an alias is not a shortcut, it is an open-ended change of scope: your supplier ships against a model whose behaviour on your documents was never tested, on a date the vendor picks. The second is that the notice period is attached to the stage, not to the model's importance to you. A preview model in a demo that quietly became production gets one month.
The fourth row is the one most buyers do not realise is available. Several current models ship under open licences, which is the option Samsung took: its September partnership with Mistral puts customised on-premises models inside Samsung's own semiconductor operations, on defect detection and equipment optimisation, with the data processed “entirely within the boundaries of Samsung's semiconductor infrastructure”. Stripped of the scale, that is a version-control decision. The copy on your server changes when your engineer changes it and on no other schedule, and it costs a server rather than an equity stake.
Why your own customer will ask
Because a model that feeds a decision on your shop floor is part of a controlled process. ISO 9001:2015 clause 8.5.6 requires changes to production to be reviewed, authorised and recorded. For anyone in an automotive supply chain, IATF 16949 clause 8.5.6.1 goes further and requires documented customer approval before a change affecting product realisation is implemented. “Our vendor retired the version” satisfies neither, and the auditor's question will land on you, not on the vendor.
Four lines in the statement of work close it:
- The model named by its full dated version, not by an alias and not by a marketing name, with the vendor's lifecycle stage stated next to it.
- A change notice no shorter than your own revalidation time. Six months is generous; one month, for a preview model, is not.
- The model version written into every decision log, beside the input and the person who accepted the output.
- Where inference runs — the vendor's cloud, your servers, or your own copy of the weights — and who is allowed to change that.
None of this asks the supplier to do anything unusual. It asks them to write down what they are already doing, in a form that survives the day the vendor publishes a deprecation notice.
If a renewal or a statement of work on your desk names a model without a version, send us the clause and we will tell you what it commits you to and what it does not.
Sources
- Mistral AI, Model lifecycle policy, from the company's own public documentation repository, read 24 September 2026: the lifecycle stages and which of them allow silent updates, the alias behaviour and the warning about pricing, the notice periods of one month and six months, and the 404 on a retired identifier.
- Samsung Newsroom, 9 September 2026: Samsung and Mistral AI Announce Strategic Partnership for Intelligence-Driven Semiconductor Infrastructure — the customised on-premises models, the defect detection and equipment optimisation applications, and the quoted sentence on processing data within Samsung's own infrastructure.
- ISO 9001:2015 clause 8.5.6, control of changes; IATF 16949:2016 clause 8.5.6.1, control of changes — supplemental, from the requirement text of each standard.