Your company adopts a third-party AI tool. The vendor provides their standard agreement, which runs to fifteen pages of terms that your team skims before clicking accept. Six months later, a client asks who owns the content your team generated using the AI. Your finance team discovers the vendor has been training its models on your uploaded data. Your security team flags that the vendor’s contract limits their liability to three months of fees paid.
This scenario is not hypothetical. It is playing out across US businesses in every industry as AI tool adoption outpaces legal review. The challenge is that AI vendor contracts look like ordinary SaaS agreements but include provisions that create materially different risks, particularly around intellectual property, data use, and liability for AI-generated errors.
This checklist covers the eight legal provisions your counsel should review before your business signs any AI vendor contract in 2026.
1. Data Training and Data Usage Clauses
The most consequential clause in any AI vendor contract is the one that governs whether the vendor can use your data to train, fine-tune, or improve its models. Many AI vendors include broad license grants that permit them to use uploaded content, prompts, and outputs for model improvement unless you explicitly opt out. Some agreements are even more aggressive, treating your data as part of a shared training corpus by default.
Your review should identify exactly what data the vendor can use and for what purposes. The clause needs to specify whether your data is kept confidential and separate from general training data, whether you can opt out of model training without losing core functionality, what happens to your data if you terminate the agreement, and whether outputs generated using your data can be used to improve the vendor’s models without attribution or compensation.
If your business handles client data, financial records, or sensitive proprietary information, a vendor contract that permits training use of uploaded content creates both a confidentiality breach risk and a potential GDPR or state privacy law violation if European or California user data is involved. This clause requires specific, negotiated language, not the vendor’s standard template.
2. Intellectual Property Ownership of AI Outputs
Who owns the content, code, analysis, or creative work that the AI tool generates when your team uses it? The answer varies significantly between vendors and directly affects your ability to use, license, and defend that output as your intellectual property.
Some vendors assign all AI-generated outputs to you. Others retain a license to use outputs for their own commercial purposes. Some agreements are silent on ownership entirely, which creates ambiguity that a court or arbitrator would resolve against the party that failed to clarify it.
Your AI vendor contract should specify that you own outputs your team generates using the tool, that the vendor has no license to commercialize your outputs, and what the ownership position is for outputs that incorporate the vendor’s base model content. It should also address whether the vendor indemnifies you if an output is later found to infringe a third party’s intellectual property, which is a meaningful risk given that the underlying training data for most large language models includes copyrighted material of uncertain provenance. Your agentic AI liability provisions need to reflect how your business actually uses these tools.
3. Accuracy Disclaimers and Hallucination Liability
AI tools produce inaccurate outputs. This is not a vendor admission of failure; it is a documented characteristic of large language model technology. What matters legally is how your contract allocates responsibility when an AI output is factually wrong, legally inaccurate, or causes a business decision that results in loss.
Most AI vendor agreements include broad warranty disclaimers stating that outputs are provided “as is” and that the vendor makes no representation about their accuracy, completeness, or fitness for any purpose. Review how that disclaimer interacts with your limitation of liability clause. If the disclaimer is broad and the liability cap is low, you bear essentially all the risk of AI-generated errors, regardless of whether the tool was marketed as suitable for the use case that generated the error.
If your business uses AI tools for legal research, financial analysis, medical decision support, compliance advice, or any high-stakes output, the standard AI vendor disclaimer structure creates serious exposure. Your contract review should assess whether the vendor’s accuracy disclaimers are appropriate for your actual use case and what contractual protections are available if an output causes harm that a reasonable user would not have expected given the vendor’s marketing claims.
4. Confidentiality and Data Processing Provisions
AI vendor contracts frequently include confidentiality provisions, but those provisions often contain significant carve-outs. The vendor may reserve the right to disclose your data to subprocessors, use aggregated data for benchmarking, or share information with affiliated entities for product development.
Your review should assess whether the confidentiality definition covers all categories of sensitive information your team will upload, including work product, client data, and strategic communications. It should identify all subprocessors the vendor uses and whether you have a right to object to new ones. It should also clarify how the vendor handles government requests for your data, since US cloud service providers are subject to FISA Section 702 and may be compelled to disclose content to US intelligence authorities in certain circumstances.
If your vendor is processing personal data on your behalf under your direction, the contract also requires a Data Processing Agreement that complies with applicable privacy laws, including GDPR if European residents’ data is involved. Many AI vendor standard agreements do not include a compliant DPA. Proceeding without one puts you in violation of your own privacy obligations to your customers.
5. Liability Caps Specific to AI Errors
Standard SaaS contracts cap vendor liability at the fees paid in the prior twelve or three months. AI vendor contracts frequently use the same cap structure, but the risk profile of AI-related errors is often higher than general software errors because AI outputs may be used to make consequential decisions.
Your contract review should identify the specific liability cap and assess whether it is proportionate to the actual risk your business faces from AI tool errors given your use case. It should also check whether the cap applies to all claims, including intellectual property infringement claims, or whether IP indemnification is carved out as uncapped or separately limited.
In addition to the liability cap, check whether your contract includes mutual indemnification for third-party IP claims arising from the AI’s outputs and whether the vendor’s indemnification obligations are subject to conditions your business controls. An IP indemnification that requires you to immediately stop using the AI tool upon any IP challenge, for example, creates a de facto shutdown risk that the indemnification does not actually offset.
6. Model Changes and Version Control Rights
AI vendors update their models continuously. A model update that improves general performance may change the specific output characteristics your team relies on, alter the accuracy profile for your use case, or remove features your workflow depends on. Unlike traditional software, AI model changes are not always announced in advance, and the new model’s behavior may differ materially from the version you evaluated and accepted.
Your contract should address whether the vendor can update the model without notice, whether you have a right to continue using a prior model version if an update causes problems for your workflow, what the vendor’s notification obligations are for material model changes, and whether performance benchmarks in the agreement apply to the model version you accepted or to whatever version the vendor deploys at any given time.
This clause matters most for businesses that have embedded AI tool outputs into client-facing workflows or regulated processes. If the model your team evaluated performed at a certain accuracy level for your specific use case, that performance may not survive a model update, and your contract may provide no remedy.
7. Subprocessor Disclosures and Cloud Infrastructure
AI tools typically run on major cloud infrastructure providers, and the vendor may use multiple subprocessors for different functions including model inference, data storage, monitoring, and customer support. Each subprocessor represents a point where your data may be handled by an entity you did not directly contract with.
Your review should verify whether the vendor discloses all subprocessors used to deliver the service, whether they provide advance notice of new subprocessors, what security and contractual obligations those subprocessors are held to, and where your data is geographically stored and processed. Geographic location matters for state and federal law applicability, and for GDPR compliance if your business handles European resident data.
8. Exit Rights and Data Deletion
When you terminate an AI vendor agreement, what happens to your data? The answer has significant implications for your data governance obligations and your ability to comply with data subject deletion requests under laws like the CCPA and GDPR.
Your contract should specify how long the vendor retains your data after termination, what format they provide your data in for export before deletion, what they do with derived data (including any embeddings, fine-tuning weights, or model artifacts created using your data), and what documentation they provide confirming deletion. If the vendor’s standard terms allow retention for extended periods for legal compliance or model improvement purposes, that retention may conflict with your obligations under applicable data privacy laws.
A technology lawyer reviewing your AI vendor contract will check all eight of these provisions, but the exit and deletion clause is often the one that creates the most post-termination disputes. Businesses that do not address it during contract review frequently discover on exit that their data is retained in forms they did not anticipate and cannot easily recover or delete.
Frequently Asked Questions
Does my business need a separate agreement if the AI vendor has standard terms?
Standard AI vendor terms are written to protect the vendor, not your business. Whether you need a separate negotiated agreement depends on how much data you are sharing, how you are using AI outputs, and what risks your use case creates. For high-volume or high-stakes AI use, a reviewed and negotiated agreement is significantly more protective than vendor defaults.
Who owns content created with an AI tool?
IP ownership of AI-generated content depends on your vendor agreement and on applicable copyright law. In the US, the Copyright Office has confirmed that purely AI-generated content without sufficient human authorship is not eligible for copyright protection. However, content that reflects meaningful human creative input alongside AI assistance may be protectable. Your vendor agreement should assign any rights the vendor might claim in AI-generated outputs to your business, and your team’s own contribution to the final output affects the copyright analysis.
What should I check before uploading client data to an AI tool?
Before uploading client data to any AI tool, review your vendor agreement’s data training and confidentiality provisions, your client contracts for data sharing restrictions, your obligations under applicable privacy laws including GDPR, CCPA, and HIPAA if health data is involved, and whether the vendor has executed a Data Processing Agreement covering the categories of data you plan to upload. Many businesses upload client data to AI tools under vendor agreements that permit model training use, which may breach client confidentiality obligations.
Can I negotiate AI vendor contracts?
Enterprise-tier agreements with major AI vendors are frequently negotiable. Even for mid-market businesses, vendors will often agree to data processing addenda, modified data training clauses, and enhanced liability terms. The key is knowing which provisions create material risk for your business before you enter negotiations. Starting from the vendor’s standard terms without legal review means you are negotiating from an uninformed position.
What are the main differences between reviewing a traditional SaaS contract and an AI vendor contract?
Traditional SaaS contracts focus on service availability, data security, and liability for service failures. AI vendor contracts introduce additional considerations including who can train on your data, who owns AI outputs, how the vendor limits liability for AI-generated errors, what happens when the model changes, and how you exit and delete data from a system that may have incorporated your content into derived model artifacts. These issues require different analysis than standard SaaS review.
Conclusion
AI vendor contracts are not standard software agreements, and reviewing them as if they were leaves your business exposed to IP claims, data misuse, uncapped liability, and exit complications that standard SaaS review does not address. Every provision in your AI tool agreement needs analysis against the specific ways your team uses the technology.
If your business is adopting AI tools and needs a technology lawyer to review your vendor agreements, contact Hansen Tong at TOSLawyer.com. A specialist review identifies the provisions that create real risk for your business and gives you a clear picture of what needs to change before you sign.