--- title: "AI Clauses in Vendor Contracts | Pitch" description: "Which clauses to expect and negotiate when you buy or supply AI: AI Act allocation, data use, output ownership, IP indemnity, liability and change control." url: https://www.pitch.law/academy/ai-clauses-in-vendor-contracts --- [pitch](https://www.pitch.law/) [Academy](https://www.pitch.law/academy) [Legal Aspects of Artificial Intelligence](https://www.pitch.law/academy/topics/legal-aspects-of-artificial-intelligence) # AI Clauses in Vendor Contracts Which clauses to expect and negotiate when you buy or supply AI: AI Act allocation, data use, output ownership, IP indemnity, liability and change control. - By By Bart Lieben, Attorney-at-Law - Published 25 February 2026 ## The legal framework A standard software licence or SaaS agreement rarely deals with the questions AI raises. The law gives some starting points, but much is left to contract. ### The AI Act value chain Regulation (EU) 2024/1689 assigns duties by role. Providers of high-risk systems must supply instructions for use (Article 13), logging capabilities (Article 12) and technical documentation (Article 11). Deployers must follow those instructions, keep logs for at least six months and ensure oversight (Article 26). Article 25(4) requires a provider of a high-risk system and a third party that supplies tools, services, components or processes used in it to specify, in a written agreement, the information, capabilities, technical access and assistance needed for the provider to comply. A customer can also become a provider if it puts its name on a high-risk system, substantially modifies it or changes its intended purpose (Article 25(1)). The contract should state who is who. See [provider or deployer](https://www.pitch.law/academy/provider-vs-deployer-ai-act). ### General-purpose AI models Providers of general-purpose AI models must, since 2 August 2025, keep technical documentation, give downstream providers information to comply, adopt a copyright policy and publish a summary of training content (Article 53). Customers building on such a model can request this information. ### Data protection If the vendor processes personal data, an Article 28 GDPR processing agreement is required. Vendors that train their own models on customer data may act as controllers for that purpose, which needs its own basis. See [the AI Act and the GDPR](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap). ### Liability law The new Product Liability Directive (EU) 2024/2853 extends strict liability for defective products to software, including AI, for products placed on the market after 9 December 2026. It does not cover purely business damage, and contract remains the main tool between businesses. ## In practice ### Clauses a customer should look for 1. **Compliance and classification.** The vendor states whether the system is high-risk or a general-purpose model, confirms its own AI Act steps, and notifies changes that alter this. 2. **Customer data and training.** Whether inputs, outputs and usage data may train or improve models. The default should be no, with any opt-in narrow and revocable. 3. **Output ownership and IP.** Fully AI-generated output may lack copyright protection, so the contract should give the customer all rights the vendor can grant and the practical exclusivity it can, and include an indemnity for third-party IP claims. See [AI and intellectual property](https://www.pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure). 4. **Performance and accuracy.** Descriptions of intended use and known limitations, error and hallucination handling, and service levels that fit probabilistic systems. 5. **Transparency and audit.** Documentation, log access, incident notification and assistance with the customer's DPIA or impact assessment. 6. **Change control.** Notice before material model changes, retention of older versions where results must be reproducible, and the right to terminate if the change affects compliance. 7. **Liability.** Caps and exclusions sized for the risk, with carve-outs for data protection breaches, confidentiality and IP indemnities. 8. **Sub-processors and location.** Which model providers and hosts are used, and where data goes. 9. **Exit.** Return and deletion of data, including from fine-tuned models where relevant. ### Example A Mechelen accounting firm buys an AI document-analysis tool. The vendor's standard terms allow it to use customer content to improve its services and exclude liability for inaccurate output. The firm negotiates a ban on training with its client data, a commitment to notify model changes, a cap with a carve-out for confidentiality breaches, and an IP indemnity. It also records the vendor's duties and its own, such as human review of outputs, so that both are followed. ## Frequently asked questions ### Do we need AI clauses if the tool is not high-risk? Yes. Data use, output ownership and liability matter regardless of the risk class. ### Can a vendor refuse to share technical documentation? For high-risk systems, the AI Act requires providers to give deployers the information needed to use the system correctly. For other systems, it depends on what you negotiate. ### Who owns what an AI tool generates? There is no automatic answer. Without human creative input, there may be no copyright. Contract allocates what rights exist and promises about non-infringement. ### What if we supply AI to our own customers? Then you are the vendor, and these clauses apply the other way. Check what your upstream providers promise you before you promise your customers. ## How this connects Vendor AI terms are part of [commercial contracts and transactions](https://www.pitch.law/solutions/commercial-contracts-transactions). [Our contract review](https://www.pitch.law/technologies/clause-library-risk-review) checks incoming terms against a playbook that an attorney approves, [the Document Studio](https://www.pitch.law/technologies/contract-studio) prepares your own terms, and the [rights and obligations register](https://www.pitch.law/technologies/contract-obligations) follows the duties once the contract is signed. ## In short - AI Act allocation of duties between vendor and customer - Rules on use of your data for training - Output ownership and IP indemnities - Liability, change control and exit ## Related solutions - [Solutions](https://www.pitch.law/solutions/commercial-contracts-transactions) ### [Commercial Contracts & Transactions](https://www.pitch.law/solutions/commercial-contracts-transactions) [Supply, distribution, services, SaaS and procurement contracts, and the deals around them, drafted and reviewed with the IP, data and tax angles in view.](https://www.pitch.law/solutions/commercial-contracts-transactions) ## Technology we use - [Technology](https://www.pitch.law/technologies/contract-studio) ### [Document Studio](https://www.pitch.law/technologies/contract-studio) [Our Document Studio drafts and analyses legal documents in a secure, on-premise environment, and keeps the documents behind your matters up to date as new data comes in and procedural steps fall due.](https://www.pitch.law/technologies/contract-studio) - [Technology](https://www.pitch.law/technologies/clause-library-risk-review) ### [Contract Review](https://www.pitch.law/technologies/clause-library-risk-review) [Send us the contract the other side drafted and we check it clause by clause against our playbook, with a risk ranking an attorney has verified.](https://www.pitch.law/technologies/clause-library-risk-review) - [Technology](https://www.pitch.law/technologies/contract-obligations) ### [Contract Management: Rights and Obligations](https://www.pitch.law/technologies/contract-obligations) [Once a contract is final, we pull out each party's duties and rights with the clause they come from, have a person confirm them, and follow them with reminders.](https://www.pitch.law/technologies/contract-obligations) ## More in Legal Aspects of Artificial Intelligence - ### [AI Act Timeline: What Applies When](https://www.pitch.law/academy/ai-act-compliance-timeline) [The application dates of the AI Act as of October 2026, including the postponement of the high-risk rules adopted in 2026.](https://www.pitch.law/academy/ai-act-compliance-timeline) - ### [AI Act Meets GDPR: Where the Two Frameworks Overlap](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) [How the AI Act and the GDPR apply side by side to the same AI system: roles, impact assessments, automated decisions, transparency, data quality and special categories.](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) - ### [AI Act Risk Classification](https://www.pitch.law/academy/ai-act-risk-classification-explained) [How to tell whether an AI system is prohibited, high-risk, subject to transparency duties or free of specific obligations under the AI Act.](https://www.pitch.law/academy/ai-act-risk-classification-explained) - ### [AI in HR and Recruitment](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) [Which AI tools in recruitment and people management are prohibited or high-risk under the AI Act, what employers must do, and how national labour law and the GDPR add to it.](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) - ### [AI and Intellectual Property: Training Data, Copyright and Disclosure](https://www.pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure) [How EU copyright law and the AI Act treat training data, rights holders' opt-outs, training summaries, and the protection of AI-generated output and inventions.](https://www.pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure) - ### [The AI Literacy Obligation](https://www.pitch.law/academy/ai-literacy-obligation-businesses-overlooking) [Article 4 of the AI Act has applied since February 2025 to every company using AI. What it requires, how the 2026 amendment changed it and what to document.](https://www.pitch.law/academy/ai-literacy-obligation-businesses-overlooking) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)