AI Clauses in Contracts: Governing AI Use With Vendors (2026)

Why you need AI clauses with vendors When a vendor uses artificial intelligence to deliver a service, or sells you an AI system, ordinary contract terms often do not cover the new risks: what data trains the model, who owns the outputs, how accurate and explainable the system is, whether humans stay in the loop, and who is liable when the AI gets something wrong. AI clauses govern those points. They are increasingly expected as regulators and standards bodies publish model terms. Two public resources help: - EU Model Contractual Clauses for AI procurement (MCC-AI). The European Commission first released them in September 2023 and published an AI-Act-aligned update on 5 March 2025, with a full version for high-risk AI systems and a light version for non-high-risk systems, plus commentary. They cover supplier obligations such as transparency, risk management, data governance, human oversight and cybersecurity, and they deliberately leave out IP, acceptance, payment, delivery, governing law and liability, so they attach as a schedule to an agreement that handles those. They target public buyers but are useful to private firms too.

• SCL AI Contractual Clauses (UK). The Society for Computers and Law published AI clauses in October 2023, with a version dated 13 October 2024. They offer both pro-supplier and pro-customer wording with drafting notes, cover both off-the-shelf and bespoke AI, and assume English law and two commercial parties. The EU AI Act was adopted in 2024 and phases in obligations by risk category. A warning from practitioners: do not copy AI Act obligations straight into a contract. Indiscriminate copy-pasting can be premature and miss the specifics of your use case. Last verified October 2026. This article is general guidance, not legal advice. Tailor AI clauses to the system, the use case and the applicable law with qualified counsel. ## The AI clauses to include 1. Disclosure of AI use. The vendor discloses where and how AI is used to deliver the service, and notifies you of material changes.

2. Training data and IP. Address what data trains or fine-tunes the model, that the vendor has the rights to use it, who owns prompts, inputs and outputs, and your licence to use outputs.
3. No training on your data. Where you need it, the vendor agrees not to use your data or confidential information to train its models, except as expressly permitted.
4. Accuracy, testing and human oversight. Set expectations for performance and testing, and require meaningful human oversight for consequential decisions, so a person can review or override the AI.
5. Transparency and documentation. The vendor provides technical documentation, user instructions, logging and record-keeping sufficient for you to understand, monitor and, where needed, override the system.
6. Data governance and security. Data-protection terms (including GDPR or DPDP processor terms where relevant) and security obligations for the AI system.
7. Regulatory compliance. The vendor complies with applicable AI law, including the EU AI Act where it applies, calibrated to the system's risk category rather than a blanket copy of the statute.
8. Bias, safety and prohibited uses. Commitments on avoiding prohibited practices and on reasonable steps to address bias and safety for the use case.
9. Liability and indemnity. Allocate responsibility for AI errors, IP infringement by outputs, and third-party claims, with sensible caps.
10. Audit and exit. Audit or assessment rights, and return or deletion of data and any model artefacts on exit. ## Sample clause wording ``` AI GOVERNANCE (a) Disclosure. The Vendor will disclose where and how AI is used to provide the Services and notify the Client of material changes. (b) Data and IP. The Vendor warrants it has the rights to any data used to train or operate the AI. As between the parties, [outputs] are owned by [party], and the Client's inputs remain the Client's. (c) No training. The Vendor will not use the Client's data or confidential information to train or improve its models except as expressly agreed. (d) Oversight. The Vendor will enable meaningful human oversight of consequential outputs, so a person can review or override them, and will provide documentation, instructions and logging sufficient to monitor the system. (e) Compliance. The Vendor will comply with applicable AI laws, including the EU AI Act to the extent it applies, calibrated to the system's risk category. (f) Liability. The parties allocate liability for AI errors, output IP infringement and related third-party claims as set out in [clause], with the agreed caps. (g) Audit and exit. The Client may assess compliance on reasonable notice, and on termination the Vendor returns or deletes the Client's data and any Client-specific model artefacts.

- Leaving training data and output ownership unresolved, which causes IP disputes.
- Assuming your data is safe from model training. If it matters, say so expressly.
- Forgetting human oversight for consequential decisions.
- Treating a model clause set as a complete contract. The EU MCC-AI deliberately leaves out IP, payment and liability, so those must be in the main agreement. ## A note on jurisdiction AI contract requirements vary by jurisdiction and are evolving. The EU AI Act applies by risk category and reaches providers and deployers connected to the EU; the UK has a more principles-based approach and resources such as the SCL clauses; other countries are at different stages. Where personal data is involved, GDPR or India's DPDP Act adds processor obligations. Treat "depends on the applicable AI and data-protection regime" as the honest default and calibrate the clauses. Last verified October 2026. ## Where a contract workspace helps Drafting AI clauses is one job. Keeping them consistent and current is another: the same disclosure, no-training and oversight terms across every vendor that uses AI, checking each incoming draft for a missing output-ownership or liability term, and tracking which systems are high-risk under the AI Act. Drafting AI governance clauses and then keeping the same disclosure, no-training and oversight terms across every vendor that uses AI can sit in one AI workspace tuned to your risk appetite. [Adira](https://adiralaw.com) is built around exactly this: it drafts AI terms from a template, models the agreement as linked clauses so it flags a missing no-training or oversight term, lets you edit in plain language (for example, adding a no-training-on-our-data clause to every AI vendor contract), and tracks obligations and key dates. This guide alone is enough to brief your drafting; a workspace simply joins drafting, review and tracking into one connected job.