Services contracts for AI Vendors, explained

Are you updating your terms because your company just incorporated AI into your offerings? If so, you might want to know what terms your fellow AI vendors are adding to their contracts.

We compared 50 vendor contracts before and after they incorporated AI into their offerings. Here are our primary takeaways.

Flow-through third party terms

TLDR Vendors must review third-party AI providers' terms closely and pass down any necessary obligations to their customers. Vendors should ask customers to acknowledge and manage the risks associated with AI use.

Building foundational AI models requires time, money, and data. This means only a limited number of companies worldwide build these models. As a result, most vendors use APIs to integrate these models into their products and services then fine-tune the models for specific use cases.

Given this reliance on third-party technology, vendors need to carefully check their contracts with AI providers and flow down on any use restrictions or obligations to their users.. For example, a vendor using OpenAI may require customers to comply with OpenAI’s Usage Policies or Sharing and Publication Policy. Vendors must also avoid providing broader rights, representations, warranties, or indemnities to their customers than those imposed by these external providers.

OpenAI prohibits vendors from using its output to develop competing models.¹ Vendors, in turn, must pass down this restriction to their customers to maintain compliance across the ecosystem. For example, Loom includes a similar clause in its customer agreements, prohibiting the use of Loom AI for creating foundation models or large-scale models that compete with Loom AI: “Customer may not use Loom AI to: (i) develop foundation models or other large scale models that compete with Loom AI. . . .” This approach has become standard practice among vendors.

Some vendors will simply require customers to not “use [vendor services] in a way which would cause [vendor] to breach terms that [vendor] has agreed with OpenAI for this third party AI functionality.”²

These layered contracts pose compliance issues for customers and monitoring difficulties for vendors. Some vendors address this by implementing Acceptable Use Policies.

Enforcement of Acceptable Use Policies

TLDR Vendors should have clear AUPs and incorporate them into their service agreements. Vendors may consider adding measures for proactive enforcement of such policies.

In response to the potential compliance issues and to clarify use restrictions, AI vendor contracts almost always feature Acceptable Use Policies (AUPs). Companies like Airtable, Amplitude, Benchling, and Freshworks have adopted or updated their AUPs to formalize the do's and don'ts in AI usage. AUPs aren’t just static clauses in contracts but are evolving into dynamic frameworks for managing the relationship between AI vendors and their users. The shift towards active enforcement, like content scanning and usage monitoring³, indicates a proactive stance among vendors in ensuring compliance. In the future, content scanning may become the standard for enforcing AUPs, as seen in email services like Shopify.⁴

Navigating Liability for AI Outputs

TLDR Vendors should include strong disclaimers regarding AI outputs. Transparency mechanisms like click-through agreements and safeguards mandating customer acknowledgment of terms can also help mitigate liability risks effectively.

AI outputs can misleadingly present inaccuracies with confidence, unlike traditional software that “fails loudly”, i.e. clearly indicates errors. This issue has become more noticeable, highlighted by incidents such as the ChatGPT lawyer who submitted a legal brief rife with made-up cases and a string of wrongful arrests in Detroit due to errors in AI-generated evidence.

AI providers must proactively include comprehensive disclaimers in customer-facing contracts for several critical reasons:

• AI technology cannot assure absolute factual accuracy and compliance with prevailing laws and industry standards. Thus, disclaimers act as a protective shield.
• AI output quality depends on the training data and prompts from customers, making results unpredictable.
• Liability risks increase when customers use AI outputs in ways not intended by the provider.
• Many products offer AI features, like chatbots, for free or as an optional add-on to enhance customer experiences. Providers usually avoid liability for these non-core functionality and may emphasize that using AI is "optional."⁵

Users bear the final responsibility for interpreting and acting on AI data. Common AI-related disclaimers include the following:

• Customers are expected to acknowledge the risks and limitations of AI, including potential inaccuracies, biases, and offensive outputs.⁶
• Disclaim responsibility for decisions made based on AI outputs.⁷
• Don't guarantee suitability of AI output for a Customer’s use case.⁸
• Encourage human review to verify outputs.⁹

Vendors should disclaim both the accuracy and uniqueness of AI-generated outputs, stating that all outputs are provided "as-is" without accuracy guarantees. These disclaimers protect against the inherent unpredictability of outputs and the possibility of the AI producing similar outputs for different users, a characteristic of how machine learning models operate.¹⁰

At a more general level, vendors should adopt the following practices:

• Make sure customers know when they're dealing with AI instead of a human. Click-through agreements or clear pop-up disclaimers can help with transparency.
• Use technology safeguards to ensure customers read and agree to terms and disclaimers before using AI, like click-through agreements or explicit pop-up notifications.
• Some vendors expect customers to develop internal policies and manage risks associated with AI outputs.¹¹

Protecting Data Ownership and Rights

TLDR Vendors should clarify ownership over AI output, distinguish between non-confidential usage data and confidential customer data, and assert ownership of improved AI models. Non-competitive contractual restrictions can safeguard proprietary technology.

Intellectual property rights may not cover AI outputs, but vendors can meet customer ownership requests by adding a clause that transfers output ownership to the customer.¹² However, vendors should clearly state that they may not hold any rights to the outputs and that other customers may similar outputs could be produced for other customers.¹³

If vendors plan to use AI outputs for their own purposes, they should explicitly define these rights in the contract. Vendors typically retain ownership of "aggregated and anonymized" customer data, clearly specifying the data’s use for improving products and services or for monetizing insights through benchmarking and other means. For instance, companies like Lucid¹⁴ and Lily¹⁵ mention using "statistical data" to enhance services and machine learning. Vendors must also clarify what "anonymization" means—whether the anonymity applies to individual users, the customer organization, or both.¹⁶

Vendors should claim intellectual property rights for enhanced AI models resulting from data processing. Contracts should specify that vendors can use these improved models for any business purpose, clarifying that these models aren't considered part of the customer's confidential information.

In fact, confidentiality and use restriction terms are often more effective in controlling use of AI output, ensuring that customer expectations align with contractual terms. Some vendors classify usage data differently from "Confidential Information", emphasizing its critical role in product development and seeking to protect resulting intellectual property rights. For example, Alation has excluded "Customer Data" from its confidentiality clauses.¹⁷ DataDog makes a distinction between confidential "Customer Data" and non-confidential "Customer Operational Data." Databricks has similarly revised their terms to not classify usage data as "Customer Confidential Information" in their non-disclosure commitments.¹⁸ Like feedback, vendors aim to protect intellectual property rights in enhancements derived from using this data.¹⁹

To protect any product enhancements and improved models, vendors should also update their contracts to add or highlight non-competitive terms. These terms can help prevent customers from developing competing products using the vendor’s services.²⁰ For instance, Databricks removed the ²¹, Datadog²² and Freshworks²³ prohibit the use of their services for competitive intelligence or performance benchmarking purposes, and Loom strictly prohibits developing competing products. Evidently, AI vendors are taking contractual measures to prevent competitors from using their technologies for market insights or rival product development, showing their focus on safeguarding proprietary tech in a competitive market.

Vendors that don't develop or enhance their own AI models might opt for stronger protective measures to set themselves apart from competitors. For instance, Notion commits to not using Customer Data for training machine learning models, offering a clear distinction in its approach to data use and privacy compared to others in the industry.²⁴

Exclude Liability for AI Output

TLDR Contracts should be updated to exclude AI output from indemnification clauses, shifting responsibility to customers for claims arising from their actions. Insurance terms are seldom included in vendor agreements.

Vendor liability and indemnification practices have remained relatively stable, typically limiting liability to 12 months of service fees. However, vendors dealing with data may offer a higher cap—up to twice the 12 months' fees—for breaches related to privacy, security, or confidentiality.

AI introduces complexities to intellectual property rights, such as copyright concerns with AI-generated content. Vendors typically assure their technology doesn't infringe on third-party IP rights and offer indemnification. Yet, this could unintentionally extend to AI outputs, raising liability risks. Consider revising existing contracts to exempt AI outputs from such clauses, and clearly stating in new agreements that risk allocation terms do not apply to AI-generated content.

Customers should indemnify vendors against claims arising from customer content, software misuse, or breaches of contract, including legal infractions, third-party IP conflicts, and misconduct.²⁵

• The customer controls how they use the AI tool, including content creation and software application. If the customer misuses the AI or breaches the terms of service, the vendor should not bear sole responsibility.
• Customers must follow all relevant laws and regulations while using AI tools. If they use the AI for illegal activities or breach data privacy laws, they should fairly face the legal repercussions.
• If a customer's behavior leads to a breach of agreements with third-party providers, resulting in legal action against the AI vendor, the customer should indemnify the AI vendor. The vendor often has limited influence over these third-party interactions.
• Customers hold accountability for the data they input or use with AI tools. Mismanaging personal data or not complying with privacy laws can result in legal liabilities for both the customer and the AI vendor. The customer should indemnify the vendor to recognize the customer's obligation to ensure data privacy.

Insurance claims are rarely seen in vendor agreements.

Compliance with laws

TLDR Vendors should be aware of evolving AI regulations and consider qualifying compliance obligations in contracts to mitigate risks related to legal changes.

While it may be challenging to entirely remove the requirement to comply with applicable laws from customer contracts, vendors should acknowledge that AI is subject to evolving regulations. Emerging laws affecting AI include President Biden's Executive Order on AI, data privacy regulations like GDPR, and sector-specific legislation like HIPAA.

AI providers can reduce contractual risks by specifying compliance with laws and regulations as they stand at the contract's signing or maintaining the option to terminate should legal changes substantially impact the provision of AI solutions or associated costs. Vendors must monitor legal changes closely to ensure continued compliance and prevent breach of contract claims. For instance, Zendesk's contract explicitly mentions the absence of obligation or liability for the company if governmental or regulatory actions limit service access.²⁶

AI force majeure event

TLDR Events beyond a party's reasonable control, like outages at third-party AI providers, may constitute a force majeure event. Vendors should define force majeure events specifically to avoid unintentional termination rights and consider the impact of third-party service provider outages in service level terms.

The dependence on third-party AI providers introduces scenarios "beyond a party's reasonable control," such as outages in upstream AI providers affecting service availability. These incidents may qualify as force majeure events, raising the question of whether they activate termination rights with potential revenue recognition consequences for the vendor.

Buyers often want the right to terminate contracts after prolonged service outages. To prevent accidental termination rights, vendors should narrowly define force majeure events, excluding general scenarios "beyond a party's reasonable control".

Vendors frequently exclude problems due to third-party service providers in their service level agreements. For example, Notion specifies that downtime caused by third-party service failures won't count towards their Availability and Downtime calculations.²⁷ This distinction recognizes the reliance on external services and their possible effect on service performance.

Iterable adopts a similar stance, noting that their AI service is not subject to standard service level agreements and may experience performance downgrades.²⁸ These clauses emphasize the uncertain behavior of AI services, particularly those dependent on third-party providers.

Final thoughts

In conclusion, as companies integrate AI into their offerings, it's crucial to update contractual terms accordingly. At Pincites, we’ve crafted our services agreement to align with these key trends. Our agreement covers essential areas such as customer cooperation, service usage restrictions, and disclaimers for warranties and liabilities, in line with industry standards. Clear specifications on ownership of customer and usage data reflect transparency, with Pincites retaining rights over usage data for insights but not AI training. Overall, our services agreement demonstrates a comprehensive approach to addressing the complexities of AI integration and ensuring compliance and transparency in customer relationships.

Footnotes