An AI contract is an ordinary software contract with seven extra clauses that can hurt you. You still need a legal review. This page is the quick pass a business owner can do first, to find those seven clauses in the order they tend to cause trouble.
The seven clauses
Here’s what to look for in each, and what good and bad versions look like.
1. Training rights. Find the sentence about using your data to improve or train services. The good version excludes your content from model training by default on your tier. The bad version is broad, buried, or “available on request”. This clause alone separates business-grade from consumer-grade products, whatever the pricing page says.
2. Processing location and transfers. Where is data processed, where are the backups, and which safeguard covers any transfer outside the UK or EU? Vague geography here becomes your DPIA problem later. The DPIA starter has the matching prompts.
3. Retention and deletion. How long prompts, outputs and files are kept, whether you can change that, and what deletion really deletes. Several products keep everything indefinitely by default, and for client material that’s a decision you should make, not inherit.
4. Model change. AI products run on models the vendor doesn’t control. The honest clause admits the model will change and commits to notice, versioning or testing. If the contract says nothing, the product you evaluated can change into a different product, without warning. Ask the vendor questions that go with it.
5. Cost mechanics. What’s metered, what caps exist, and what happens at the cap: a hard stop, throttling, or quiet overage billing? Usage-priced AI tends to get expensive exactly when it works, and the contract decides whether that cost has a ceiling.
6. Liability for output. Expect output provided as-is and tight caps, which is market standard. What you’re reading for is anything that forbids or undermines your own review process, and any indemnity that quietly leaves the AI features out of cover.
7. Exit. Data export in a usable format, deletion confirmed, logs of agentic actions included, and the freedom to leave at renewal. A product you can’t leave is priced wrong at any price.
Reading order for a busy signer
If you only have ten minutes, read these four, in this order:
- Training rights: the deal-breaker, first
- Retention: what’s kept, and who decided
- Cost mechanics: what the bill does at the cap
- Exit: what leaving costs and what you get back
Those four catch most regrets. Send the other three to your legal reviewer with this page attached.
One rule outranks every clause: the contract records the relationship, it doesn’t make the vendor trustworthy. A vendor who answered the due-diligence questions badly doesn’t become safe because the paperwork is tidy. The questions to ask in an AI demo are where you find that out.