Buying an AI Tool: A Vendor Contract Risk Checklist

How to use this

Work through the eight terms below before signing an agreement for an AI tool or an AI-enabled service. Each adds something a conventional software contract does not contemplate, because conventional software does not train on what you feed it, does not generate text or decisions you act on, and does not silently change models between Tuesday and Thursday. The vendor’s base paper will usually be a SaaS template lightly dressed for AI; the gaps are predictable, and most of them favor the vendor by default.

Two framing points. First, none of this shifts your own legal duties. If the tool helps make an employment, credit, or other consequential decision, the obligations to verify, to avoid discrimination, and to be able to explain the decision remain yours — “the vendor’s algorithm did it” is not a defense. The contract allocates risk between you and the vendor; it does not absolve you to regulators, employees, or courts. Second, the two terms that move the most risk — whether the vendor trains on your data, and who indemnifies you when an output infringes IP — are precisely the two most often absent from the template. Pin both down in writing.

1. Outputs and intellectual property

Establish who owns what the tool produces, whether you can use it commercially, and whether your prompts and outputs are protected as your confidential information. Ownership of AI outputs is unsettled and varies by jurisdiction and by how the output was generated; do not assume the contract’s allocation matches what the law will recognize.

Output ownership and use rights. Confirm you own, or have a broad perpetual license to, the outputs — and that you may use them for your intended commercial purpose without further permission or royalty.
Your inputs and outputs as confidential. Your prompts, uploaded materials, and the resulting outputs should be treated as your confidential information, not the vendor’s, and not pooled into a shared corpus.
No claim over your content. The vendor should disclaim any ownership interest in the data you supply and in work product you create with the tool.

2. Your data and model training

This is the term most often defaulted against you. Many tools train or improve their models on customer inputs unless you opt out — sometimes that setting is on by default and buried in a referenced policy rather than the signed agreement. Get the answer in the contract, not a webpage the vendor can revise unilaterally.

Training off by default, in writing. The agreement — not a linked policy — should state that your inputs and outputs are not used to train or improve the vendor’s or any third party’s models. If a feature requires it, it should be opt-in and revocable.
Data use, retention, and deletion. Define the permitted purposes, how long data is kept, and how it is deleted. Vague “to provide and improve the service” language is broad enough to cover training; narrow it.
Sub-processors and model providers. Identify downstream AI providers and sub-processors, require notice of changes, and confirm your data terms flow down to them — an output may be generated by a model the vendor does not own.
DPA and security terms. Where personal or regulated data is involved, attach a data processing addendum and concrete security obligations (encryption, access controls, breach-notice timing). Requirements vary sharply by jurisdiction and are in active flux; confirm what currently applies to you.

3. IP-infringement indemnity

An AI output can reproduce protected material, and training data can carry infringement claims. If a third party sues because an output infringed a copyright, trademark, or patent, the question is who defends and pays. Several major vendors now offer some form of output-IP indemnity, but scope, conditions, and caps vary widely — read what is actually promised.

Indemnity for output and training-data IP claims. The vendor should defend and indemnify you against third-party IP claims arising from the model’s outputs and its training data, subject to reasonable conditions.
Carve it out of the liability cap. This indemnity should sit outside any general limitation of liability. An indemnity capped at a few months’ fees is not meaningful protection against an infringement judgment. See Indemnification and Limitation of Liability on how the two interact.
Watch the conditions and exclusions. Indemnities are often conditioned on using the tool as directed, not modifying outputs, and keeping enabled filters on. Confirm the conditions are ones you can actually meet.

4. Accuracy, performance, and human oversight

AI vendors frequently disclaim all reliance — the tool is provided “as is,” outputs “may be inaccurate,” and you bear all consequences. Taken literally, a blanket no-reliance clause guts the value of a tool you are buying precisely to rely on. The goal is not a guarantee of perfection; it is representations and service levels honest enough to mean something, paired with a clear, written allocation of the human-review role.

Realistic representations, not pure as-is. Resist a total disclaimer of reliability. Push for a professional-effort or fitness-for-described-purpose representation, even if accuracy itself cannot be warranted.
Service levels that fit the use. Uptime, latency, and support SLAs with real remedies, scaled to how consequential the tool is to your operations.
Defined human-oversight role. Clarify in writing what review the tool assumes. A disclaimer premised on human review you were never told to perform is a trap; documenting the expected oversight protects both sides. See verification for why review remains the buyer’s duty.

5. Model changes and versioning

The model you evaluated may not be the model you use next quarter. Vendors update, swap, or deprecate underlying models routinely, and behavior can shift materially without any change to the interface. A tool you validated for a sensitive use can quietly become a different tool.

Notice of material model changes. Advance, written notice before a material change to the underlying model or its behavior, so you can re-test before relying on it.
Deprecation and version control. For sensitive uses, the ability to pin a version for a defined period, or a reasonable transition window before a version is retired.

6. Transparency and auditability

For consequential outputs — especially employment, credit, insurance, and other regulated decisions — you may have to explain or defend an output. You cannot do that if the tool is a black box and the contract gives you no right to look inside.

Explainability for consequential outputs. A contractual right to information sufficient to understand and justify outputs that drive material decisions.
Audit and logging. Access to logs and an audit right proportionate to the risk, so you can investigate a disputed decision after the fact.

7. Compliance support for decision tools

If the tool informs hiring, promotion, lending, or other regulated decisions, a growing body of law may require bias auditing, notice, validation, or accommodation — for example, frameworks discussed under NYC Local Law 144, Illinois’s automated-decision and video-interview statutes, the Colorado AI Act, the EU AI Act, and EEOC guidance. These vary by jurisdiction, and their scope, effective dates, and applicability are moving; confirm current status before relying on any of them. The vendor cannot discharge your obligations, but it should hand you the materials and cooperation you need to meet them. See AI in Hiring and Employment.

Bias-audit and validation materials. Access to the vendor’s bias-audit results, validation studies, and methodology for any tool used in employment or other regulated decisions.
Cooperation with your obligations. A commitment to provide notices, disclosures, and records you reasonably need to satisfy applicable law — recognizing the duty stays with you.

8. Exit

Plan the divorce while drafting the marriage. When the relationship ends, you want your data back in a usable form, confirmation it is gone from the vendor’s systems, and no operational hostage situation.

Data return and portability. On termination, return of your data in a standard, usable format within a defined window.
Deletion and certification. Deletion of your data and any fine-tuned artifacts derived from it across the vendor and its sub-processors, with written certification.

Quick reference

Term	The AI-specific risk	Typical ask
Outputs and IP	Unclear ownership; outputs treated as vendor’s	You own or broadly license outputs; inputs and outputs are your confidential information
Data and training	Training on your data, often on by default	Training off in writing; defined retention, deletion, sub-processors, DPA
IP indemnity	Output or training data infringes a third party	Vendor defends and indemnifies; carved out of the liability cap
Accuracy and SLAs	Blanket as-is disclaimer guts the tool’s value	Honest reps and SLAs; human-oversight role defined in writing
Model changes	Tool silently becomes a different tool	Notice of material changes; version pinning or transition window
Transparency	Black box you must explain to a regulator	Explainability and audit rights for consequential outputs
Compliance support	Decision tool triggers your regulatory duties	Bias-audit and validation materials; cooperation with your obligations
Exit	Data stranded or never deleted	Return in usable format; certified deletion across sub-processors

These are starting positions, not rules, and the regulatory items in particular are moving quickly. Confirm scope, effective dates, and applicability against the current law in your jurisdictions and against your own risk tolerance. For the general clauses an AI deal shares with any commercial contract — the cap, termination, dispute resolution — see Contract Risk Review: The Key Terms, Triaged.

The thing behind the thing

Two AI-specific terms move the most risk and are missing from most templates: whether the vendor trains on your data (frequently on by default) and who indemnifies you when an output infringes someone’s IP. Pin both down in the signed agreement — and remember that even a perfect contract does not transfer your duty to verify, to avoid discrimination, and to be able to explain a decision to the people it affects.