AI vendor contracts and what to check before you commit

5 days ago
3 min read

Introduction

Software contracts are signed quickly because the monthly cost looks small and the alternative is not proceeding. The terms that matter later are rarely about price: they are about what the vendor may do with your data, what happens when you want to leave, and how much the price can rise once your business depends on the product.

These questions are more pointed with newer products than with established software. The market is moving quickly, vendors are young, terms change more often than usual, and the data being processed is frequently your customer records and internal documents rather than something peripheral. A short check before signing prevents the situations that are difficult to unwind afterwards.

1. AI vendor contracts and what to check starts with data rights

The most important clause.

Whether your data may be used to train models, whether it may be shared, and whether you can opt out. This varies enormously between vendors and is frequently buried in a policy referenced by the contract rather than in the contract itself.

2. Establish where the data is processed and stored

A compliance question.

Which country, which subprocessors, and whether that is compatible with your own obligations. Where personal data crosses borders there are specific requirements in many jurisdictions, and the answer needs to be in writing.

3. Check the exit terms before you need them

The clause that traps people.

How you export your data, in what format, within what period, and what happens to it afterwards. A product holding two years of your records with no usable export is a product you cannot leave.

4. Look at how the price can change

Where the surprise arrives.

Notice periods for increases, price changes at renewal, and charges tied to usage that can grow. Usage-based pricing on a product that becomes embedded in a process is where costs escalate without a decision.

5. Read the service commitments and what they are worth

Frequently nothing.

Availability targets, support response times, and the remedy if they are missed. A service credit worth a fraction of a month's fee is not a remedy for a process that stopped working for two days.

6. Find out what happens on a material change to the product

A newer risk.

Features withdrawn, models replaced, behaviour altered. A product that changes underneath a process you have built around it is disruptive, and your rights when that happens are worth knowing.

7. Check the liability position against your exposure

Usually asymmetric.

Liability is normally capped at fees paid, which may be small relative to the harm a failure could cause in your business. That is not necessarily unreasonable, and it should inform how much you rely on the product.

8. Confirm the confidentiality terms cover what you will put in

Read against your actual use.

If you will process client confidential material or personal data, the terms need to reflect that, and your own obligations to your clients may require specific provisions or their consent.

9. Keep the contract term short at first

The practical protection.

Monthly or annual rather than multi-year, at least until the product has proved itself. The discount for a long commitment is rarely worth the loss of the ability to leave in a fast-moving area.

Contract law, data protection requirements and the enforceability of particular clauses vary by jurisdiction, and agreements from vendors in other countries may be governed by law other than your own. For anything significant, this is worth professional review.

Conclusion

Check the data rights, the exit and the price mechanism, because those are where the problems appear.

Establish whether your data may be used for training and whether you can opt out, confirm where it is processed and by which subprocessors, verify that you can export everything in a usable format on exit, look at how and when the price can rise including usage-based charges, read the service commitments and what the remedy is actually worth, understand your position if the product changes materially, check the liability cap against your real exposure, ensure confidentiality terms match what you will process, and keep the initial term short.