The way AI is addressed in commercial contracts is evolving rapidly. No longer confined to specialist technology agreements, AI is increasingly embedded in everyday products and services, pulling AI-related issues into a much wider range of commercial contracts. Businesses need to understand where AI is being used, what role it plays, what data it touches and how the resulting risks are allocated. This blog considers how existing contractual protections are changing, where dedicated AI clauses may be needed, and the key issues to watch for when negotiating AI-related provisions.
How is AI changing traditional contractual protections?
In many situations, the biggest change is not the introduction of a new AI clause, but the reshaping of existing provisions covering areas such as data, intellectual property, warranties and indemnities. These traditional clauses were not necessarily drafted with AI in mind and, as such, businesses should consider whether they adequately address the new risks and uncertainties that AI can create. So, what traditional clauses are under pressure?
1. Data and Customer Information
One of the key questions for customers is what happens to their data once AI enters the picture: how it may be used, who can access it, and whether it could end up enhancing or training the underlying AI system. In practice, these traditional data clauses are now showing up with tighter drafting around permitted purposes.
2. Protection of Proprietary Material and Non-training Clauses
As AI forms part of more services, customers are justifiably concerned that data they submit to suppliers could be used to train an underlying model, potentially embedding their proprietary information, know-how or commercially sensitive data into tools made available to a wider customer base. Traditional data clauses are no longer sufficient. Businesses now need to consider "non-training" wording that prevents a supplier from using customer data to train or improve an AI model, and that stops competitors on the same model from indirectly benefiting from a client’s proprietary information.
3. Intellectual Property
Ownership has become far more complicated in an AI context: what intellectual property rights exist in the underlying model, what rights attach to AI-generated outputs, and who bears the risk if those outputs infringe third-party rights. Existing definitions may need tailoring to reflect this broader range of IP issues.
4. Warranties
As AI takes on a greater role in service delivery, customers want clearer assurances about how it is used, what testing has been carried out, and whether appropriate human oversight is in place. Suppliers, however, are often unwilling to give substantial warranties over AI outputs. Where a warranty might once simply have promised services performed with reasonable care and skill, customers are now pushing for specific commitments, such as human review before use or testing for bias.
5. Indemnities and Liability
AI can make it harder to pin down responsibility when something goes wrong. Many suppliers accept responsibility for the services they provide but are far less willing to assume open-ended responsibility for every AI-generated output. The focus is increasingly on where that risk should properly sit, and whether existing indemnity and liability provisions still hold up.
The Rise of Dedicated AI Clauses
While many AI risks can be addressed by adapting existing provisions, some issues call for more specific protections. We are seeing a growing trend of dedicated AI clauses that deal directly with how AI may be used and what that use entails.
Entirely new contractual concepts, such as AI Technology, AI Inputs and Outputs, and Permitted AI Use, are beginning to appear in contracts. AI is no longer addressed in general terms: contracts may now require a supplier to disclose when AI is being used, explain how, and maintain appropriate governance and oversight, with some going as far as requiring consent before a supplier can use AI at all. The aim is to make AI use and its outputs more transparent and to have both parties address it expressly, rather than relying on traditional provisions to do the job.
What are the warning signs when negotiating AI provisions?
As AI becomes a routine feature of commercial contracts, businesses should look beyond whether AI is mentioned at all and focus on how the associated risks are actually allocated. Some key areas of negotiation and scrutiny are considered below.
1. Insufficient Protections for Customer Data
A key area of concern is whether the contract provides meaningful protection for customer data and proprietary information. Treat any reluctance to agree clear restrictions on the use of customer data, particularly for training the AI system, as a red flag worth probing.
2. Lack of Transparency
Customers want visibility over when AI is being used, how, and whether outputs undergo appropriate human review. Treat any unwillingness to be transparent as a signal that risk will be difficult to assess and manage.
3. Hidden Third-party Terms
Many AI-enabled solutions rely on third-party models and providers. A red flag to note is whether the customer understands the relevant third-party AI terms, acceptable use policies or other requirements that sit behind the service. This can arise where a supplier’s terms simply state that use of an AI feature is subject to the AI provider’s terms at a specified URL, even though the customer may not have reviewed those terms and they may be updated without notice.
4. Unclear Accountability
Customers increasingly want clarity on who is ultimately responsible for AI outputs forming part of the service: has human oversight been agreed, has ownership of outputs been established, and is responsibility for errors clearly allocated between the parties? If a supplier cannot explain its use of AI and its outputs, it may be worth negotiating bespoke audit rights so that usage can be properly reviewed.
5. Static Terms for a Moving Target
AI models are typically updated, retrained or replaced over time, often without the customer's knowledge. A contract that fixes assumptions about how the AI works at signature can quickly fall out of step with how it actually operates months later. Watch for whether the contract addresses what happens when the underlying model changes materially, whether the customer is notified, and whether existing protections and warranties still apply to the updated version.
Practical Steps for Businesses
1. Understand how AI is being used
Before drafting or negotiating a contract, establish the scope of AI use within the service and the role it plays: what the AI does, what information it receives, which third parties are involved, and where human review sits.
2. Protect your data and maintain oversight
Look at how the contract protects customer data and secures explainability, audit rights and accountability where AI forms part of the service. Go beyond the dedicated AI clauses and consider data, intellectual property and risk allocation more broadly.
3. Review wider AI governance
Contractual protections should form part of a wider approach to AI due diligence, procurement and internal governance, tailored to the business and the proposed use of AI.
Ultimately, the aim is proportionate safeguards that provide adequate transparency, control and accountability. AI will keep moving faster than the contracts written to govern it, so the businesses that treat their agreements as living documents capable of adaptation, not one-off checkboxes, will be the ones best placed to manage the risk.
If you would like to discuss any of the issues covered in this article, or would like support reviewing your contracts, procurement processes or wider approach to AI governance, please contact any of the authors.
