AI Clauses in Vendor Contracts

The legal framework

A standard software licence or SaaS agreement rarely deals with the questions AI raises. The law gives some starting points, but much is left to contract.

The AI Act value chain

Regulation (EU) 2024/1689 assigns duties by role. Providers of high-risk systems must supply instructions for use (Article 13), logging capabilities (Article 12) and technical documentation (Article 11). Deployers must follow those instructions, keep logs for at least six months and ensure oversight (Article 26). Article 25(4) requires a provider of a high-risk system and a third party that supplies tools, services, components or processes used in it to specify, in a written agreement, the information, capabilities, technical access and assistance needed for the provider to comply. A customer can also become a provider if it puts its name on a high-risk system, substantially modifies it or changes its intended purpose (Article 25(1)). The contract should state who is who. See provider or deployer.

General-purpose AI models

Providers of general-purpose AI models must, since 2 August 2025, keep technical documentation, give downstream providers information to comply, adopt a copyright policy and publish a summary of training content (Article 53). Customers building on such a model can request this information.

Data protection

If the vendor processes personal data, an Article 28 GDPR processing agreement is required. Vendors that train their own models on customer data may act as controllers for that purpose, which needs its own basis. See the AI Act and the GDPR.

Liability law

The new Product Liability Directive (EU) 2024/2853 extends strict liability for defective products to software, including AI, for products placed on the market after 9 December 2026. It does not cover purely business damage, and contract remains the main tool between businesses.

In practice

Clauses a customer should look for

1. Compliance and classification. The vendor states whether the system is high-risk or a general-purpose model, confirms its own AI Act steps, and notifies changes that alter this.
2. Customer data and training. Whether inputs, outputs and usage data may train or improve models. The default should be no, with any opt-in narrow and revocable.
3. Output ownership and IP. Fully AI-generated output may lack copyright protection, so the contract should give the customer all rights the vendor can grant and the practical exclusivity it can, and include an indemnity for third-party IP claims. See AI and intellectual property.
4. Performance and accuracy. Descriptions of intended use and known limitations, error and hallucination handling, and service levels that fit probabilistic systems.
5. Transparency and audit. Documentation, log access, incident notification and assistance with the customer's DPIA or impact assessment.
6. Change control. Notice before material model changes, retention of older versions where results must be reproducible, and the right to terminate if the change affects compliance.
7. Liability. Caps and exclusions sized for the risk, with carve-outs for data protection breaches, confidentiality and IP indemnities.
8. Sub-processors and location. Which model providers and hosts are used, and where data goes.
9. Exit. Return and deletion of data, including from fine-tuned models where relevant.

Example

A Mechelen accounting firm buys an AI document-analysis tool. The vendor's standard terms allow it to use customer content to improve its services and exclude liability for inaccurate output. The firm negotiates a ban on training with its client data, a commitment to notify model changes, a cap with a carve-out for confidentiality breaches, and an IP indemnity. It also records the vendor's duties and its own, such as human review of outputs, so that both are followed.

Frequently asked questions

Do we need AI clauses if the tool is not high-risk?

Yes. Data use, output ownership and liability matter regardless of the risk class.

Can a vendor refuse to share technical documentation?

For high-risk systems, the AI Act requires providers to give deployers the information needed to use the system correctly. For other systems, it depends on what you negotiate.

Who owns what an AI tool generates?

There is no automatic answer. Without human creative input, there may be no copyright. Contract allocates what rights exist and promises about non-infringement.

What if we supply AI to our own customers?

Then you are the vendor, and these clauses apply the other way. Check what your upstream providers promise you before you promise your customers.

How this connects

Vendor AI terms are part of commercial contracts and transactions. Our contract review checks incoming terms against a playbook that an attorney approves, the Document Studio prepares your own terms, and the rights and obligations register follows the duties once the contract is signed.