AI Contract Language: Protecting Your Org When Vendors Use AI

There are several categories of AI-specific contract provisions every agreement should include.

Transparency and Accountability

Contracts should require vendors to maintain audit trails and provide transparency mechanisms that explain how their AI operates and makes decisions. Accountability provisions should clearly define what happens when the AI model fails to perform as expected, including who is responsible for investigating, remediating, and notifying affected parties.

Security and Liability

Vendors must have contractual obligations to protect AI systems and associated data from cyberattacks and unauthorized access. Liability provisions should specify who bears responsibility for harms arising from AI bias, errors, or unintended outputs. Risk management plan requirements, including which frameworks the vendor uses and how they respond to AI-related incidents, should be specified.

AI Role and Scope

Every AI agreement should explicitly define what the AI system is authorized to do and, critically, what it is prohibited from doing. Human oversight responsibilities should be clearly distinguished from AI-automated processes.

Data Use and Privacy

Contracts should specify how sensitive data may be used for AI training, modification, or inference. Data retention and deletion timelines should be established. Confidentiality provisions should explicitly address AI inputs and outputs.

Intellectual Property

Who owns the AI system? Who owns the data used to train it? Who owns the content or work product the AI generates? Who owns the prompts submitted to the AI? These questions have significant business and legal implications and should be resolved in the contract, not after a dispute arises.

Other Essential Clauses

Performance standards and service level agreements specific to AI systems. Compliance obligations covering current and anticipated future AI regulations. Incident notification requirements. Change control processes for AI system updates. Force majeure provisions.

Coming up next: Continuous monitoring for AI vendors: going beyond annual questionnaires.