When your company buys an AI product, standard software terms are not enough. Add an AI addendum (or check the vendor's) covering these topics.
The core terms
- Data use and training: your inputs, outputs and files are your confidential information; no use to train or improve models without your written, specific opt-in.
- Confidentiality and human access: who at the vendor can see your data, when and under what controls.
- Retention and deletion: stated periods, deletion on request and at exit, and notice of legal holds or government demands.
- Output ownership: as between the parties, you own outputs (subject to the vendor's underlying IP), and the vendor claims no rights in them.
- IP indemnity: the vendor defends you against claims that the service, its training data or its outputs infringe third-party rights, with clear conditions.
- Security: certifications, encryption, sub-processor list and change notice, incident notification.
- Model changes: notice of material changes to the model or features that affect quality or compliance.
- Regulatory cooperation: information you need for your own obligations (for example, documentation for EU AI Act high-risk deployers) and audit rights.
- Liability: caps that reflect data and IP risk, with appropriate carve-outs.
Use public model clauses as a reference
The European Commission's public procurement community publishes Model Contractual Clauses for AI (MCC-AI), updated in March 2025 to align with the EU AI Act, in a version for high-risk systems and a lighter one for others. They are written for public buyers and are not binding, but they are a useful checklist of what to ask for, especially for documentation, transparency and data governance.
Negotiate by risk
Not every AI purchase needs every clause. A summarization tool used on public material needs less than a tool that processes privileged documents or makes decisions about people. Use the use-case triage tool to set the risk level, then the clause library for the positions.