Alex is Sprintlaw's co-founder and a legal technology leader. He holds law and media degrees from the University of Sydney and has been recognized by Australasian Lawyer, Lawyers Weekly and the Sydney Young Entrepreneur Awards for his work building Sprintlaw and improving access to business legal support.
Contents
Buying an AI tool for your business is not always as simple as comparing features and signing up.
A tool that starts out helping with emails or meeting notes might eventually have access to customer information, internal documents or important parts of your workflow. Once your team comes to rely on it, changing providers may not be as easy as cancelling a monthly subscription either.
Before agreeing to the vendor’s terms, it is worth checking what will happen to your data, what you can do with the tool’s outputs and who carries the risk if something goes wrong.
There is currently no single comprehensive federal law governing every AI tool or every way a business might use one. Instead, the rules that apply can depend on what the tool does, what information it handles, your industry and where your business operates. Existing federal laws may apply alongside state privacy, consumer protection and AI laws.
That can sound complicated, but the vendor contract is a practical place to start. Here are five key areas to check before signing.
What Are You Actually Buying?
Before getting into the finer legal details, make sure you understand what the vendor has agreed to provide.
An AI tool might begin as a useful extra but quickly become part of your everyday operations. It could connect to your email, customer relationship management system, website or other internal software. Your team may also build new processes around it.
This makes it important to look beyond the product page. Check which features are included in your subscription, how many people can use them and whether there are any usage limits.
You should also check what support the vendor provides. Will someone help if the tool stops working, or will your team be limited to an online help center? If the tool becomes unavailable, does the vendor make any promises about how quickly the service will be restored?
The full agreement may be spread across several documents. An order form might cover the price and subscription period, while separate terms deal with service levels, acceptable use, privacy and data processing. Some of these documents may only appear as links.
Read the documents together and check what happens if they say different things. You should also look for terms allowing the vendor to change its policies, remove important features or significantly alter the service without giving your business reasonable notice.
Contract check: Does the agreement clearly match the product your business thinks it is buying?
What Happens To Your Data?
Once you understand what the tool will do, think carefully about the information it will be able to access.
Will employees enter customer details, financial information, confidential documents or internal business plans? Will the tool connect to your inbox or other business systems? Even a relatively simple tool could receive more sensitive information than you initially expect.
The contract should explain what the vendor can do with that information. In particular, check whether it can use your prompts, uploaded files or outputs to train or improve its AI models.
Do not assume that paying for a tool means your information will automatically remain private. The FTC has specifically warned AI providers that they must follow the privacy and confidentiality commitments they make to customers, including promises about whether customer data will be used for model training.
You should also check whether the vendor shares information with other companies involved in providing the service. These companies may be described as subprocessors or service providers. Check whether the vendor provides a list of them, whether it can add new ones later and whether your business will receive notice of any changes.
Data retention matters too. Find out how long the vendor keeps your information, whether you can ask for it to be deleted and whether copies may remain in backups after your contract ends.
Privacy is only part of the picture. Your business may also upload confidential information that is not personal information, such as pricing strategies, product plans or unpublished content. Check whether the vendor accepts clear confidentiality obligations and whether there are broad exceptions that could weaken those protections.
The contract should also explain the vendor’s approach to security. Depending on the information involved, you may need to check its access controls, security testing, breach notification process and any independent security reports it can provide.
There is no overarching federal privacy law applying to every private-sector business in the US. State laws and federal industry-specific rules may apply, while the FTC can also take action against certain unfair or misleading privacy and security practices.
Contract check: What can the vendor do with the information your business provides?
Who Can Use The Inputs And Outputs?
The contract may say that your business retains ownership of its inputs and receives certain rights to use the outputs. That sounds reassuring, but it is worth reading the details.
Start with the information your business uploads. You may retain ownership while giving the vendor a license to store, copy, analyze and use that material.
Some permission will usually be needed for the tool to work. However, check whether the license also allows the vendor to use your material for model training, product development or other commercial purposes. You should also confirm whether those rights end when the contract does.
When it comes to outputs, check whether your business can use them commercially, change them, publish them or provide them to customers. There may be restrictions based on how the tool was used or which subscription plan you purchased.
However, permission under the vendor’s contract is not the same as copyright protection.
Under the current US Copyright Office position, material generated entirely by AI is not protected by copyright. Human-created parts of a work may still be protected where there has been enough original human authorship.
This means your business may be allowed to use an output without necessarily having exclusive copyright ownership over it. The vendor’s terms may also state that outputs are not unique, which means another customer could receive the same or similar material.
That distinction may matter if your business plans to use an output as a logo, important piece of software, publication, product or other valuable asset.
There is also the risk that an output resembles someone else’s protected material. Check whether the vendor provides any support if a third party claims that an output infringes their intellectual property.
The protection may only apply if your business follows particular rules. The contract may also require you to promise that you have permission to upload every document, image or dataset entered into the tool.
Contract check: Does your business receive the rights it needs over the inputs and outputs?
Who Is Responsible If Something Goes Wrong?
AI tools can make mistakes. They can produce incorrect information, generate unsuitable content or stop working at an inconvenient time.
The vendor’s terms may warn customers not to rely on outputs without reviewing them. At the same time, the contract may require the customer to take responsibility for decisions made using the tool.
This does not automatically mean the terms are unreasonable, but your business should understand how the risk has been divided.
Start by checking the vendor’s warranties. These are the promises it makes about the tool, such as whether it will perform substantially as described, comply with applicable laws or avoid introducing malicious software into your systems.
Next, look at the indemnities. An indemnity generally deals with who must cover certain claims or losses.
For example, the vendor might agree to protect your business from some intellectual property claims. Your business might agree to protect the vendor from claims caused by your misuse of the tool or the materials you upload.
Pay attention to how broad these obligations are and whether they work both ways.
The contract is also likely to limit how much the vendor can be required to pay. Its liability might be capped at the fees your business paid during the previous six or twelve months, even if the actual loss is much higher.
Consider whether that limit makes sense for the role the tool will play. A low cap may be less concerning for software used to summarize internal meetings. It could be more significant if the tool stores sensitive customer information or supports an essential business process.
For a higher-risk tool, check whether confidentiality breaches, security incidents or intellectual property claims have a separate liability limit rather than falling under the ordinary cap.
Using an external vendor also does not necessarily transfer your business’s own legal obligations to that vendor. For example, federal anti-discrimination laws can still apply when an employer uses AI or automated software to assess job applicants and employees.
Extra care may therefore be needed where a tool affects employees, customers or other important decisions. Your business should understand where human review fits into the process and whether errors can be identified and corrected.
Contract check: Does the agreement place responsibility on the party best able to manage the risk?
Can You Leave Without Losing Everything?
An AI tool may suit your business now, but that does not mean it will always be the right choice.
The service could become more expensive, your business might outgrow it or another provider may offer something better. You may also decide that the tool creates more work or risk than expected.
Check the initial contract period and whether the agreement renews automatically. Some contracts require customers to cancel several weeks or months before the renewal date. Missing that deadline could lock the business into another full term.
You should also check whether you can leave early and what it will cost. A vendor may allow termination but still require payment of the remaining subscription fees.
Consider whether your business can end the agreement if the vendor repeatedly fails to provide the service, suffers a serious security incident or breaches an important part of the contract.
Your data should not be overlooked. The agreement should explain whether you can export it, the format it will be provided in and how long you have to retrieve it after termination.
A large download of information is not especially useful if your business cannot open it or transfer it to another system. If the tool will become central to your operations, you may also need practical help moving to a replacement provider.
Check what happens to information left behind as well. The contract should explain when the vendor will delete it, whether copies may remain in backups and which rights or obligations continue after the agreement ends.
Contract check: Can your business leave without losing important data or facing unexpected costs?
Before You Sign
Not every AI subscription needs lengthy negotiations. A low-cost tool used for a minor internal task is unlikely to require the same level of review as a system that handles customer records, affects employees or connects to important parts of your business.
The more sensitive the information, the more important the decisions and the harder the tool would be to replace, the more closely you should review the contract. The level of attention needed depends on the potential impact on your business, not simply the price of the subscription.
Before signing, make sure you understand what the vendor must provide, what happens to your information, how you can use the outputs, who carries the major risks and what happens when you want to leave.
A clear agreement will not remove every risk, but it can help prevent a useful new tool from creating an expensive problem later. If you are unsure about an AI vendor’s terms, a legal expert can review the agreement and help you understand what you are accepting before you sign.
If you would like a consultation on getting your AI vendor contract reviewed, you can reach us at (888) 449-8437 or team@sprintlaw.com for a free, no-obligations chat.
Alex SoloCo-Founder
