AI contract terms

What it does

It turns what due diligence found into enforceable rights. A set of standard positions covers the matters particular to AI: whether the supplier may train on the organisation's data, how long it keeps prompts, what notice it gives of model changes and retirement, what information it must provide, who its sub-contractors are, how incidents are reported, who is responsible for what, and how the organisation gets out. Legal owns the positions; procurement applies them; the business owner accepts any departure. It operates at contract and at renewal.

How to implement it

• Maintain model clauses for each topic, with fallback positions.
• Prohibit training on the organisation's data unless expressly agreed.
• Fix retention periods, processing locations and deletion on exit.
• Require notice of model changes, deprecation and new sub-contractors.
• Secure rights to documentation, test evidence and audit, scaled to materiality.
• Allocate responsibility for regulatory duties, including provider and deployer roles.

Evidence it operates

Design: a clause library and negotiating playbook for AI contracts. Operation: executed contracts containing the positions; a log of departures with approver; review records when a supplier changes its terms; settings in the product that match the contract.

Where it fits

At contract, after due diligence and before use. It is the primary control for vendor reuse of organisation data, and supports unannounced upstream model change, sub-outsourcing visibility gap and AI service outage. It gives ongoing AI vendor monitoring the rights it relies on.

Limits

Large providers contract on standard terms that most customers cannot change, and may amend them on notice. A right that is never exercised protects little. Contract terms allocate loss after the event and do not prevent it. Click-through tools adopted by staff have no negotiated contract at all.