Key points

• Off-the-shelf AI agreements often leave the customer with the risks that matter most: data use, output ownership, accuracy, change control and intellectual property claims.
• Ten terms deserve attention in nearly every negotiation, from data rights to exit, and many can be agreed without losing the commercial deal.
• Which terms matter most depends on the use case. A tool that drafts internal documents needs different protection than one that makes decisions about customers or employees.
• Regulation is now shaping the contract. The EU AI Act, state AI laws and privacy rules require information and cooperation from vendors that the customer must secure in writing.
• Procurement and legal teams should agree their negotiating priorities and fallback positions before the first draft arrives.

Why AI contracts differ

Buying an AI tool resembles buying other software in many respects, but four differences change the negotiation. The system's behavior is probabilistic, so it can be wrong in ways that testing does not fully predict. Its behavior can change when the underlying model changes, often without the customer's involvement. It frequently learns from or processes the customer's data. And it is increasingly regulated, with duties that depend on information only the vendor holds. Standard terms were mostly written before these differences were widely understood, and they tend to favor the vendor accordingly.

Ten terms to negotiate

The following ten terms recur in the agreements our Technology Transactions practice negotiates. They are listed roughly in the order most buyers find them contentious.

1. Customer data and training. State that the customer's inputs, outputs and fine-tuning data are not used to train or improve the vendor's models, or any other customer's, unless the customer expressly opts in. Cover derived data and embeddings, not just raw inputs.
2. Output ownership and use. Confirm the customer owns, or has a perpetual license to use, outputs for its business purposes, and that the vendor claims no rights beyond providing the service. Be realistic about copyright in AI-generated material, which may be limited under US law.
3. Intellectual property indemnity. Seek an indemnity for claims that the service or its outputs infringe third-party rights, covering training-data claims as well as output claims. Check the exclusions, especially for modified, fine-tuned or prompted use.
4. Accuracy and performance. Avoid a blanket disclaimer of accuracy where the tool drives consequential decisions. Seek defined performance measures, testing obligations and remedies, including the right to suspend or terminate for persistent failure.
5. Change control. Require advance notice of material changes to the underlying model, features and sub-processors, and a right to stay on a prior version for a defined period or to terminate without penalty.
6. Regulatory cooperation. Obtain commitments to provide the documentation, transparency information and assistance the customer needs to meet the EU AI Act, state AI laws and privacy law, and to support bias audits and impact assessments.
7. Security and confidentiality. Specify security standards, certifications, breach notice timing and restrictions on human review of the customer's content by vendor personnel. Address prompt-injection and data leakage risks for agentic tools.
8. Sub-processors and model providers. Identify the third-party models the service depends on and require flow-down of key protections. The vendor should remain responsible for its suppliers, and the customer should be told if the model provider changes.
9. Liability allocation. Negotiate caps that reflect realistic exposure, with higher limits or exclusions from the cap for data breach, confidentiality, indemnities and the vendor's gross negligence. Treat regulatory fines and remediation costs explicitly.
10. Exit and portability. Secure the return or deletion of data, reasonable transition assistance, access to logs and configuration, and continuity if the vendor is acquired or ceases operations. Consider escrow arrangements for critical systems.

Matching terms to the use case

Not every tool justifies a full negotiation. A drafting assistant used by a small team on non-sensitive material may need strong data-use and confidentiality terms but can accept looser performance commitments. A system that screens job candidates, scores credit applications or interacts directly with customers carries regulatory, discrimination and consumer protection exposure, and warrants robust accuracy, audit and indemnity terms. Our note on agentic customer service addresses one such case in detail.

A short risk-tiering process before procurement helps. Classify the intended use, the data involved and the people affected, and apply a standard set of required terms to each tier. This saves time and gives business teams clarity about what legal needs.

Process points that save time

Ask the vendor early for its standard security documentation, model documentation and compliance statements, and for a list of its sub-processors. Establish who inside the company owns the decision to accept residual risk. Keep a record of negotiated positions so that later deals start from a stronger baseline. And agree a governance mechanism after signature, because AI services change, and a contract that is never revisited will not keep pace.

Where a vendor will not move on a key term, consider technical mitigations, such as restricting the data sent to the tool, adding human review or limiting use cases, rather than accepting the risk silently.

Getting help

Corvane Ryle advises customers and vendors on AI procurement, from model licensing to enterprise deployments. Kenji Watanabe-Price in San Francisco and Daniel Achterberg, who leads our Artificial Intelligence practice, can walk through current market positions and benchmark your draft against recent deals.