What AI terms should we require from vendors? — CLO AI Chambers

When it comes up

When any team buys an AI product, when an existing vendor adds AI features to a product you already use, or at renewal.

Your options

Accept the vendor's standard AI terms

Fits when: Low-risk uses with public or internal data, and vendors whose standard terms already exclude training and offer indemnities.

Watch out: Standard terms change; check the version and your product tier.

Standard AI addendum for every AI purchase

Fits when: Most companies: one addendum covering data use, training, retention, output IP, indemnity, security and model changes.

Watch out: Large vendors may refuse addenda; be ready to map their terms against yours instead.

Risk-tiered negotiation

Fits when: High-volume buyers: light checks for low-risk uses, full negotiation for sensitive data or decisions about people.

Watch out: Needs a reliable triage step so high-risk deals don't slip into the light lane.

How to decide

Triage the use (data sensitivity, decisions about people, regulatory exposure).
Compare the vendor paper to your clause library: preferred, fallback, walk-away or missing for each clause.
Weight by risk: data use and training, confidentiality, output IP and indemnity usually weigh most.
Escalate by rule: any high-risk clause at walk-away or missing goes to the General Counsel.
Record outcomes to improve the next negotiation.

Trade-offs

Pushing for every clause slows deals and can lose access to leading tools; accepting weak terms moves data and IP risk onto you. Risk-tiering keeps legal effort where it matters.

Real examples

Microsoft's Copilot Copyright Commitment (September 2023) promised to defend paying commercial customers against copyright claims over Copilot output and pay adverse judgments, if they used the built-in guardrails and content filters. Source: Microsoft On the Issues — Microsoft announces new Copilot Copyright Commitment for customers (7 September 2023) ↗
Google Cloud announced in October 2023 a two-part generative AI indemnity covering its use of training data and the generated output of certain services. Source: Google Cloud — Protecting customers with generative AI indemnification (12 October 2023) ↗
The EU's public procurement Community of Practice published updated Model Contractual Clauses for AI (MCC-AI) in March 2025, aligned with the EU AI Act, as non-binding templates for public buyers. Source: European Commission Public Buyers Community — Model Contractual Clauses for AI procurement (MCC-AI, updated March 2025) ↗ · Covington Inside Privacy — EU's Community of Practice publishes updated AI model contractual clauses (April 2025) ↗

What to check first

Does the contract exclude training on your inputs and outputs?
What are the retention, deletion and human-access terms?
Who owns outputs, and is there an IP indemnity that covers your actual use?
What notice do you get of model changes, sub-processor changes and security incidents?

Learn and use

Sources

Last reviewed 2026-10-01.