--- title: "AI Clauses in Vendor Contracts: 9 Terms to Negotiate | Pitch" description: "The AI clauses to negotiate when you buy or supply AI: AI Act roles, training on your data, output ownership, IP indemnity, audit and logs, liability." url: https://pitch.law/academy/ai-clauses-in-vendor-contracts --- [pitch](https://pitch.law/) [Academy](https://pitch.law/academy) [Legal Aspects of Artificial Intelligence](https://pitch.law/academy/topics/legal-aspects-of-artificial-intelligence) # AI Clauses in Vendor Contracts: 9 Terms to Negotiate The AI clauses to negotiate when you buy or supply AI: AI Act roles, training on your data, output ownership, IP indemnity, audit and logs, liability. - - By [Bart Lieben](https://pitch.law/team/bart-lieben), Attorney-at-Law - 25 February 2026 - Updated 30-10-2026 ## The legal framework A standard software licence or SaaS agreement rarely deals with the questions AI raises. The law gives some starting points, but much is left to contract. ### The AI Act value chain [Regulation (EU) 2024/1689](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689) assigns duties by role. Providers of high-risk systems must supply instructions for use ([Article 13](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689#art_13)), logging capabilities ([Article 12](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689#art_12)) and technical documentation ([Article 11](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689#art_11)). Deployers must follow those instructions, keep logs for at least six months and ensure oversight ([Article 26](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689#art_26)). [Article 25(4)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689#art_25) requires a provider of a high-risk system and a third party that supplies tools, services, components or processes used in it to specify, in a written agreement, the information, capabilities, technical access and assistance needed for the provider to comply. A customer can also become a provider if it puts its name on a high-risk system, substantially modifies it or changes its intended purpose ([Article 25(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689#art_25)). The contract should state who is who. See [provider or deployer](https://pitch.law/academy/provider-vs-deployer-ai-act). ### General-purpose AI models Providers of general-purpose AI models must, since 2 August 2025, keep technical documentation, give downstream providers information to comply, adopt a copyright policy and publish a summary of training content ([Article 53](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689#art_53)). Customers building on such a model can request this information. ### Data protection If the vendor processes personal data, an [Article 28 GDPR](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_28) processing agreement is required. Vendors that train their own models on customer data may act as controllers for that purpose, which needs its own basis. See [the AI Act and the GDPR](https://pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap). ### Liability law The new [Product Liability Directive (EU) 2024/2853](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024L2853) extends strict liability for defective products to software, including AI, for products placed on the market [after 9 December 2026](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024L2853#art_2). It does not cover [purely business damage](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024L2853#art_6), and contract remains the main tool between businesses. ## In practice ### Clauses a customer should look for 1. **Compliance and classification.** The vendor states whether the system is high-risk or a general-purpose model, confirms its own AI Act steps, and notifies changes that alter this. 2. **Customer data and training.** Whether inputs, outputs and usage data may train or improve models. The default should be no, with any opt-in narrow and revocable. 3. **Output ownership and IP.** Fully AI-generated output may lack copyright protection, so the contract should give the customer all rights the vendor can grant and the practical exclusivity it can, and include an indemnity for third-party IP claims. See [AI and intellectual property](https://pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure). 4. **Performance and accuracy.** Descriptions of intended use and known limitations, error and hallucination handling, and service levels that fit probabilistic systems. 5. **Transparency and audit.** Documentation, log access, incident notification and assistance with the customer's DPIA or impact assessment. 6. **Change control.** Notice before material model changes, retention of older versions where results must be reproducible, and the right to terminate if the change affects compliance. 7. **Liability.** Caps and exclusions sized for the risk, with carve-outs for data protection breaches, confidentiality and IP indemnities. 8. **Sub-processors and location.** Which model providers and hosts are used, and where data goes. 9. **Exit.** Return and deletion of data, including from fine-tuned models where relevant. ### Example A Mechelen accounting firm buys an AI document-analysis tool. The vendor's standard terms allow it to use customer content to improve its services and exclude liability for inaccurate output. The firm negotiates a ban on training with its client data, a commitment to notify model changes, a cap with a carve-out for confidentiality breaches, and an IP indemnity. It also records the vendor's duties and its own, such as human review of outputs, so that both are followed. ## Frequently asked questions ### Do we need AI clauses if the tool is not high-risk? Yes. Data use, output ownership and liability matter regardless of the risk class. ### Can a vendor refuse to share technical documentation? For high-risk systems, the AI Act requires providers to give deployers the information needed to use the system correctly. For other systems, it depends on what you negotiate. ### Who owns what an AI tool generates? There is no automatic answer. Without human creative input, there may be no copyright. Contract allocates what rights exist and promises about non-infringement. ### What if we supply AI to our own customers? Then you are the vendor, and these clauses apply the other way. Check what your upstream providers promise you before you promise your customers. ## How this connects Vendor AI terms are part of [commercial contracts and transactions](https://pitch.law/solutions/commercial-contracts-transactions). We check incoming terms with [Document Studio](https://pitch.law/technologies/contract-studio), our proprietary document analysis and development system, against a playbook that an attorney approves; it also prepares your own terms, and the [rights and obligations register](https://pitch.law/technologies/contract-obligations) follows the duties once the contract is signed. ## In short - AI Act allocation of duties between vendor and customer - Rules on use of your data for training - Output ownership and IP indemnities - Liability, change control and exit ## Related solutions - [Solutions](https://pitch.law/solutions/commercial-contracts-transactions) ### [Commercial Contracts & Transactions](https://pitch.law/solutions/commercial-contracts-transactions) [Supply, distribution, services, SaaS and procurement contracts, and the deals around them, drafted and reviewed with the IP, data and tax angles in view.](https://pitch.law/solutions/commercial-contracts-transactions) ## Technology we use - [Technology](https://pitch.law/technologies/contract-studio) ### [Document Studio](https://pitch.law/technologies/contract-studio) [Our Document Studio drafts and analyses legal documents in a secure, on-premise environment, and keeps the documents behind your matters up to date as new data comes in and procedural steps fall due.](https://pitch.law/technologies/contract-studio) - [Technology](https://pitch.law/technologies/clause-library-risk-review) ### [Contract Review](https://pitch.law/technologies/clause-library-risk-review) [Send us the contract the other side drafted and we check it clause by clause against our playbook, with a risk ranking an attorney has verified.](https://pitch.law/technologies/clause-library-risk-review) - [Technology](https://pitch.law/technologies/contract-obligations) ### [Contract Management: Rights and Obligations](https://pitch.law/technologies/contract-obligations) [Once a contract is final, we pull out each party's duties and rights with the clause they come from, have a person confirm them, and follow them with reminders.](https://pitch.law/technologies/contract-obligations) ## More in Legal Aspects of Artificial Intelligence - ### [EU AI Act Timeline: Every Date from 2024 to 2030](https://pitch.law/academy/ai-act-compliance-timeline) [The AI Act applies in stages from 2 February 2025 to 31 December 2030. Every date, what applies and who it affects, with the 2026 high-risk postponement.](https://pitch.law/academy/ai-act-compliance-timeline) - ### [AI Act Meets GDPR: Where the Two Frameworks Overlap](https://pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) [How the AI Act and the GDPR apply side by side to the same AI system: roles, impact assessments, automated decisions, transparency, data quality and special categories.](https://pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) - ### [AI Act Risk Classification: the Four Risk Levels](https://pitch.law/academy/ai-act-risk-classification-explained) [The AI Act sorts AI into unacceptable (prohibited), high, limited (transparency) and minimal risk. How to tell which level your AI system falls in.](https://pitch.law/academy/ai-act-risk-classification-explained) - ### [AI Act in HR and Recruitment: the High-Risk Rules](https://pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) [Recruitment and HR AI is usually high-risk under the AI Act (from 2 December 2027), and emotion recognition at work is banned. What employers must do.](https://pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) - ### [AI and Intellectual Property: Training Data and Copyright](https://pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure) [How EU copyright law and the AI Act treat training data, rights holders' opt-outs, training summaries, and the protection of AI-generated output and inventions.](https://pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure) - ### [The AI Literacy Obligation](https://pitch.law/academy/ai-literacy-obligation-businesses-overlooking) [Article 4 of the AI Act has applied since February 2025 to every company using AI. What it requires, how the 2026 amendment changed it and what to document.](https://pitch.law/academy/ai-literacy-obligation-businesses-overlooking) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://pitch.law/schedule)