9 Provisions Executives Should Read Twice in Any AI Vendor Contract

Key Takeaways

• The training-data clause determines whether company confidential material can be used to improve a vendor’s model, making it the single highest-stakes provision in the agreement.
• Output ownership is frequently left ambiguous or granted as a license rather than transferred, which matters when the output becomes a product.
• Vendors can change the underlying model during a contract term, altering performance without any contractual breach unless the agreement addresses it.
• Liability caps in AI agreements are typically set at twelve months of fees, an amount unrelated to the actual exposure from a data or IP incident.
• Exit terms decide whether a company can leave, and they are far easier to negotiate before signing than at renewal.

AI vendor agreements arrive looking like ordinary software contracts. The structure is familiar, the clause headings are familiar, and that familiarity is the problem — the standard shape carries a materially different risk profile when the product is a model rather than a database.

The nine provisions below are where that difference concentrates. None of them require legal training to evaluate; they require someone senior to ask what the clause actually permits.

1. What happens to the data we put in?

Find the clause governing training data and input usage, and read it before anything else. It determines whether prompts, uploaded documents, and generated outputs can be used to train or improve the vendor’s models.

The distinction to insist on is between processing your data to deliver the service and retaining it to improve the product. The first is unavoidable; the second is a choice, and it is frequently the default in standard terms.

Ask three questions with specific answers required. Is input used for training by default? If there is an opt-out, is it contractual or a toggle in a settings panel that a future update could reset? And does the commitment extend to the vendor’s own upstream model providers?

2. Who owns the output?

Get output ownership stated explicitly, because default positions vary widely and silence is common. Some vendors assign ownership to the customer, some grant a broad license instead, and some leave the question unaddressed entirely.

The difference becomes concrete the moment output enters a commercial product — generated code shipped in software, generated copy in a campaign, generated analysis in a client deliverable. A license is not ownership, and the gap surfaces during due diligence rather than during use.

Where the vendor will not assign ownership, the fallback worth negotiating is a perpetual, irrevocable, sublicensable license that survives termination. That preserves the ability to keep using what has already been produced.

3. Is there a real IP indemnity, and what voids it?

An intellectual-property indemnity covers the customer if a third party claims the tool’s output infringes their rights. Several major vendors now offer one, which makes its absence a reasonable question to raise.

Read the conditions more carefully than the promise. Indemnities are commonly voided by disabling safety filters, modifying outputs, using the tool outside documented use cases, or failing to notify the vendor promptly of a claim.

Then check the cap. An indemnity limited to fees paid is a gesture rather than protection when the exposure is a product built on infringing output.

4. Who else touches the data?

Request the current subprocessor list and the terms governing changes to it. AI vendors routinely route workloads through model providers, cloud infrastructure, and specialist services the customer never evaluated.

The chain is where compliance commitments are actually tested. A vendor’s data-residency assurance means little if an upstream model provider processes the same request in another jurisdiction.

Negotiate for advance notice of subprocessor changes and a right to object. Without it, the vendor can change the entity handling your data mid-term with no notification obligation at all.

5. Where does the data live, and can we actually delete it?

Data residency and deletion clauses need specifics: which jurisdictions, what retention period, what the deletion process is, and how deletion is evidenced. “Industry standard practices” is not a commitment.

Deletion deserves particular attention with AI systems. Removing a document from storage is straightforward; removing its influence from a model that has already trained on it generally is not, which is another reason the training-data clause carries so much weight.

Ask for deletion certification on termination within a defined number of days, covering backups and subprocessors as well as primary systems.

6. What happens when the model changes?

This is the provision most often missing, and the one most specific to AI. Vendors deprecate model versions, adjust safety layers, and re-tune behavior — all of which can change output quality without breaching a conventional uptime commitment.

A workflow validated against one model version can behave differently after an update the customer never approved. Traditional service-level agreements measure availability, not consistency, so a tool can be fully available and materially worse.

Negotiate for notice of material model changes, access to a pinned version for a transition period, and the right to terminate without penalty if performance degrades against agreed criteria. Vendors resist this, which is a reasonable signal of how much it is worth.

7. What can we verify, and what must we take on trust?

Establish what the vendor will show you. Current security certifications, penetration test summaries, incident history, and any published model evaluations are the reasonable baseline.

For regulated industries, push further: audit rights, documentation sufficient to satisfy your own regulator, and cooperation obligations during a regulatory inquiry. Emerging AI regulation increasingly places documentation duties on the deploying organization, not only the developer, and a contract that leaves the customer unable to produce evidence is a live compliance problem.

Where full audit rights are refused, a right to receive third-party audit reports annually is a workable middle position.

8. Is the liability cap connected to the actual exposure?

Standard software agreements cap liability at twelve months of fees. That convention was set for tools where the worst realistic outcome was downtime, and it transfers poorly to systems processing confidential material at scale.

Compare the cap against a plausible incident: a confidentiality breach involving customer data, or an IP claim on shipped output. If the cap is a small fraction of that exposure, the agreement is allocating the risk to you.

The practical negotiation is not usually an unlimited cap but carve-outs — separate, higher limits for confidentiality breaches, data protection violations, and IP indemnity claims. That structure is common enough to ask for directly.

9. Can we leave?

Exit terms determine whether a vendor relationship is a decision or a dependency. Read them at signature, when you have leverage, rather than at renewal, when you do not.

Four things need to be explicit: notice period for termination, whether termination for convenience exists, what data you get back and in what format, and how long you retain access during transition.

Prefer a shorter initial term than the vendor proposes. Capability, pricing, and regulation are all moving quickly, and a twelve-month term with renewal options costs slightly more per month while preserving the option to reprice or switch — which is where the leverage for every other clause on this list comes from. It is the same discipline that governs any large commitment, where the question is whether the return actually fits the shape of the business.

How should an executive team run an AI contract review?

Assign the nine provisions above to named reviewers before legal begins redlining, and require a written position on each. Legal can tell you what a clause says; only the business can say whether the risk it allocates is acceptable.

Treat the review as a governance artifact rather than a procurement step. The same nine answers form the basis of what the board and, increasingly, regulators will ask about how the company adopted the tool — and the budget conversation that funds it deserves the same explicitness, as any CEO working through the assumptions inside next year’s plan will recognize.

Frequently Asked Questions

What is the most important clause in an AI vendor contract?

The training-data and input-usage clause. It determines whether your company's prompts, documents, and outputs can be used to improve the vendor's models, and therefore whether your confidential material leaves your control. Everything else in the agreement is easier to renegotiate later than this.

Who owns the output generated by an AI tool?

It depends entirely on the contract, and default terms vary widely between vendors. Some assign output ownership to the customer, some grant a license rather than ownership, and some remain silent, which creates ambiguity precisely where a business needs certainty. Get it stated explicitly.

Should an AI vendor contract include an indemnity?

Yes, and specifically an intellectual-property indemnity covering claims that the tool's output infringes a third party's rights. Many major vendors now offer this, but it is frequently capped, conditioned on using default safety settings, and excluded if the customer modifies prompts or outputs.

How long should an initial AI vendor contract run?

Shorter than the vendor proposes. The capability, pricing, and regulatory landscape are all moving fast enough that a three-year commitment locks a company into current-generation assumptions. A twelve-month initial term with renewal options preserves the ability to reprice or switch.

What should executives ask about a vendor's subprocessors?

Ask for the current subprocessor list, the notice period before it changes, and whether you can object. AI vendors frequently route workloads through model providers and infrastructure partners the customer never evaluated, and that chain is where data residency and compliance commitments actually get tested.

About the Author

Joey Frame — Business & AI Regulation, executivecentralweekly.com

Joey Frame writes and researches for Executive Central Weekly, covering business leadership, strategy, and the regulation now reshaping enterprise technology decisions. His reporting focuses on the governance questions executives face when adopting new systems.

More articles by Joey Frame