How Should In-House Counsel Review AI Vendor Terms?

As AI adoption accelerates, reviewing vendor agreements is no longer just about standard commercial terms. It’s about understanding how data and models are governed, and how risks are allocated. In this episode, Rikka founder Charlyn Ho shares practical guidance for in-house counsel on what to watch for in AI vendor contracts., including data collection provisions, liability and indemnification for misuse or inaccuracies, and intellectual property protections.

Transcript

So how should in house counsel review AI vendor terms?

When you review AI company terms such as OpenAI’s, Claude’s, or Geminis, you should focus on several key areas, which are similar to the issues involved with any commercial agreement.

However, given the vast amounts of data processed by AI, having an eye towards the data related provisions andAI vendor agreements is essential.

Moreover, AI introduces unique risks requiring organizations to focus on both data and model attributes.

This means understanding the quality, ownership, and traceability of datasets as well as examining the model itself, its learning method, autonomy level, and potential biases.

In this video, we provide you with some high level tips on how to review AI vendor terms.

First, you should carefully review the terms surrounding the data, especially concerning the collection, storage, and use of any data that the AI vendor is inputting as well as any ownership issues.

Second, you should review the liability clauses and indemnification terms, paying close attention to how risks such as the misuse of AI or inaccuracies are allocated.

Third, you should carefully assess the intellectual property provisions ensuring your organization retains ownership over any input and output.

In addition, depending on your company’s specific use case for generative AI, you may wish to purchase the enterprise version of these AI tools.

The contractual terms governing enterprise versions of AI products often provide more favorable protections forcompanies.

For example, by not training the model on the data inputted by the company, offering more stringent confidentiality protections and potentially indemnification for IP infringement.

Reviewing AI vendor terms does not need to be radically different from how you customarily review vendor terms and manage third party risk.

Many of the same issues will be relevant to managing vendor contracting risk without AI.

However, given the unique features of AI such as its ability to learn from and process vast amounts of data, you should have a solid foundation in understanding how AI works so you can appropriately spot the legal issues that are common to vendors generally, but also those that are unique to AI.

Outside of just reviewing the vendor contract itself, it is critical that you conduct robust due diligence on AI vendors, including evaluating the vendor’s AI governance framework.

You need to ensure that the vendor is compliant with global AI regulations such as the EU AI Act to the extent applicable or other US state and federal laws, even if your organization isn’t directly developing the model.

But AI governance isn’t just about internal practices.

Evaluating a vendor’s governance framework provides insight into the ethical and compliance dimensions of their AI practices, which is vital for mitigating legal risks.

Further, regularly monitoring vendor and performance and reassessing contracts over time helps mitigate evolving risks.

Taking these steps builds trust and transparency in your vendor ecosystem.

A holistic approach to third party AI risk management isn’t just about compliance. It’s also about creating a foundation for responsible AI use that drives sustainable business growth.

Thanks for watching. Make sure to like and subscribe for more insights into navigating AI governance for lawyers. And feel free to leave your questions in the comments below. See you next time.