The rapid integration of artificial intelligence into enterprise software presents both opportunities and risks for businesses. When vendors introduce AI features to existing products under current contracts, significant legal and practical challenges may arise. Legacy agreements, not originally designed with AI in mind, often lack adequate provisions for data use, intellectual property, termination, and liability, potentially leaving clients exposed once AI is implemented.
Most major software-as-a-service (SaaS) providers have introduced or are rolling out AI-powered features within their existing product suites. These features range from AI-assisted search and summarization tools to automated drafting, predictive analytics, and large language model integrations. Often, these features are activated by default without explicit customer consent and sometimes without advance notification, creating significant contract challenges.
Legacy Contracts and AI
Legacy contracts were not designed for AI, and several critical contract gaps may emerge when a vendor adds an AI feature to an existing agreement. Outdated definitions, inadequate deletion obligations, and broken data flow assumptions are some of the gaps that may arise. For instance, the standard definition of “Customer Data” in an existing SaaS agreement may not capture prompts, outputs, embeddings, or other AI-specific data categories.
The original SaaS contract may assume a relatively straightforward data flow between the client‘s organization and the vendor’s infrastructure. However, AI features may introduce new data complexities, such as sending data to third-party large language model providers or using it to train vendor or third-party models. The details of these data flows may or may not be included in the fine print of the contract.
Another concerning gap is that many AI features are activated by default without express notice from the vendor. This means that a client’s organization may already be feeding sensitive data into an AI tool without anyone having reviewed or approved the terms under which that data will be processed.
Traditional termination provisions address subjects such as material breach and bankruptcy/insolvency, but they do not contemplate AI-specific termination trigger events such as model deprecation/degradation, foundation model substitution, changes in the vendor’s acceptable use policy that restrict use cases, or regulatory prohibitions.
Reviewing Vendor-Proposed AI Addenda
When a vendor proposes an AI addendum to an existing agreement, it is essential to approach the document with diligence, rigor, and scrutiny. Vendor-drafted AI addenda are often designed to expand the vendor’s rights and limit its liabilities, which can directly contradict the protections negotiated in the underlying agreement. The click-through trap is a common issue, where vendors present AI addenda through click-through mechanisms, such as hyperlinked documents or pop-up acceptance screens.
Read Also: Creating a nonprofit corporation in DC
Key risks of click-through AI addenda include contradicting negotiated terms, embedded and hyperlinked terms, and broad license grants. Vendors often seek the right to use customer data (including prompts, outputs, and usage patterns), to train, fine-tune, or ‘improve’ their AI models. This may be framed as improving ‘the Services,’ but it effectively grants the vendor a perpetual right to benefit commercially from your data, including potentially sensitive or proprietary data, without economic benefit to you.
Data use, data privacy, and data security are critical areas of concern in vendor-drafted AI addenda. Vendors often propose de-identification or aggregation as a compromise, but AI systems can re-identify individuals from patterns across datasets, making de-identification less protective than it appears. Contracts should reference an industry standard for de-identification, such as NIST SP 800-188, and include an affirmative covenant by the vendor not to re-identify your data or your users.
Liability and indemnification for AI-generated outputs are also new categories of risk. Vendor-drafted addenda typically seek to limit the vendor’s exposure by disclaiming accuracy, excluding outputs from indemnification, and disclaiming uniqueness. Intellectual property ownership in the AI context is more complex than traditional software licensing, with distinct categories of intellectual property at stake, including inputs, prompts, outputs, and feedback.
Opt-out rights and transparency are essential considerations for clients. They should ask whether the proposed AI features are optional or required to use the updated vendor product and confirm whether toggling off the feature actually stops all data processing associated with it. Advance written notice of any vendor model changes and understanding whether a model swap changes any data-use, training, or processing commitments are also key.
The regulatory environment for AI is evolving rapidly, and vendor-drafted addenda may not adequately address compliance with current and emerging AI-specific regulations. Clients should require the vendor to stay abreast of key regulatory developments during the contract period and allocate regulatory risk between the vendor and customer. The vendor’s AI features can create compliance headaches for the customer, such as bias, discrimination, or failure to meet transparency requirements.
Clients should treat any vendor communication about new AI features-whether a product announcement, a contract amendment, or a click-through addendum-as a trigger to review their existing agreement and take any necessary action to remedy any concerns. This may involve developing their own standard-form AI addendum for use in negotiations, which can establish the client’s baseline expectations and provide a structured framework for evaluating the vendor’s AI capabilities and practices.
Leave a Reply