AI contracts are ordinary software contracts with seven live wires added. Legal review still matters; this page is the businessperson’s pass that finds the wires first, in the order they bite.
The seven clauses
1. Training rights. Find the sentence about using your data to improve or train services. The good version excludes your content from model training by default on your tier; the bad version is broad, buried, or “available on request”. This clause alone separates business-grade from consumer-grade offerings, whatever the pricing page says.
2. Processing location and transfers. Where is data processed, where are backups, and which safeguard covers any transfer outside the UK or EU. Vague geography here becomes your DPIA problem later; the DPIA starter has the matching prompts.
3. Retention and deletion. How long prompts, outputs and files persist, whether you can set it, and what deletion actually deletes. Several products keep everything indefinitely by default, which for client material is a decision you should make, not inherit.
4. Model change. AI products ride models they do not control. The honest clause admits change and commits to notice, versioning or testing; silence means the product you evaluated can differ from the product you run, without warning. Ask the vendor questions that go with it.
5. Cost mechanics. What is metered, what caps exist, and what happens at the cap: hard stop, throttle, or silent overage billing. Usage-priced AI can fail by succeeding, and the contract decides whether that failure is bounded.
6. Liability for output. Expect as-is output and tight caps; that is market standard. What you are reading for is anything that forbids or undermines your own review discipline, and any indemnity that quietly excludes the AI features from cover.
7. Exit. Data export in a usable format, deletion confirmed, logs of agentic actions included, and freedom to leave at renewal. A product you cannot leave is priced wrong at any price.
Reading order for a busy signer
Ten minutes, in this order:
- Training rights: the deal-breaker, first
- Retention: what persists, and who decided
- Cost mechanics: what the bill does at the cap
- Exit: what leaving costs and returns
Those four catch the majority of regrets; the remaining three go to your legal reviewer with this page attached.
The meta-rule that outranks every clause: the contract records the relationship, it does not create trustworthiness. A vendor who answered the due-diligence questions badly does not become safe because the paperwork is tidy.
Where I fit in
Contract reading is part of how I run my own stack, where every provider sits behind exactly these checks before an estate credential goes near it, and it is part of any Automation Audit touching tools you already pay for. If a renewal is on your desk and the AI clauses read like fog, that is a one-call question: bring the contract.