AI Vendor Addendum: Clauses to Add to Any AI Tool Contract (2026)

Why you need an AI addendum Most AI tools are sold on a standard software contract that was written for ordinary SaaS. It rarely says anything about how your data is used to train models, who owns what the tool generates, what happens when the model changes under you, or who pays if an output infringes someone's copyright or causes harm. An AI addendum is a short set of clauses you attach to the existing contract to close those gaps. It does not replace the master agreement; it adds the terms an AI tool specifically needs. Be honest with yourself about what a contract can and cannot do. Contract clauses allocate risk, create obligations and give you remedies if things go wrong. They do not make a model accurate, stop it hallucinating, or guarantee it will never be trained on your data; they make the vendor promise those things and give you a claim if the promise is broken. The value is in the promise, the transparency it forces, and the remedy, not in any magic in the words. This page is general information, not legal advice, and the right clauses depend on how critical the tool is and what data it touches, so have a qualified professional adapt them. ## The clauses to add 1. Data use and no-training-without-consent. State that the vendor will not use your data, inputs or outputs to train, fine-tune or improve its own or any third party's models unless you have opted in, and that any permitted use is limited and described. This is the single most important clause for most buyers. 2. Confidentiality extended to prompts and outputs. Ordinary confidentiality clauses often predate AI. Say expressly that prompts, inputs, outputs and any embeddings or logs derived from your data are your confidential information. 3. Ownership of outputs. State who owns what the tool generates. Most buyers want to own or have a broad licence to the outputs they create. Note the honest limit: the law on whether purely AI-generated material attracts copyright at all is unsettled in several countries, so the clause allocates rights as between you and the vendor and cannot conjure a copyright that the law does not grant. 4. IP infringement indemnity. Require the vendor to indemnify you if an output or the tool itself infringes a third party's intellectual property, subject to sensible conditions. Check the cap and any carve-outs, because some vendors limit this heavily. 5. Accuracy, human oversight and no-reliance. Get the vendor to describe the tool's intended use and known limitations, and record that you will keep appropriate human review for important decisions. A contract cannot make the model correct, so the realistic control is transparency about limits plus your own oversight. 6. Model changes and version transparency. AI tools change silently. Require notice of material model changes, the ability to test before a change affects production, and a way to pin or roll back a version for a reasonable period where that matters. 7. Security and sub-processors. Set security standards, breach-notification timelines, and the right to a current list of sub-processors (including which foundation-model providers sit behind the tool) with notice of changes. 8. Regulatory roles and cooperation. Where laws such as the EU AI Act or data-protection law assign roles and duties, require the vendor to tell you which role it plays, to provide the information you need to meet your own obligations, and to cooperate with audits or assessments. 9. Audit, logs and explainability support. Require access to logs of how your account used the tool and reasonable support if you must explain or investigate an output, for a regulator or an affected person. 10. Exit, data return and deletion. On termination, require return of your data in a usable format, deletion of your data and any derived artefacts within a set period, and written confirmation. Say what happens to anything the vendor was permitted to retain. ## What contract controls cannot do It is worth being blunt, because over-promising here causes real harm later: - A clause cannot stop a model hallucinating or make its output accurate. It can require disclosure of limitations and preserve your remedy if the vendor misrepresented the tool.

• A clause cannot guarantee an output is free of third-party IP. It can shift the financial risk to the vendor through an indemnity, within the cap.
• A clause cannot create copyright in AI output where the law does not recognise it. It can only allocate whatever rights exist between the parties.
• A clause cannot prevent a sub-processor from being breached. It can set standards, require notice, and give you a remedy. Reading the contract as risk allocation, not as a technical safeguard, keeps your expectations honest and your governance real. ## Where the addendum sits and order of precedence An addendum only works if it clearly overrides the parts of the master agreement it is meant to fix. Add an order-of-precedence line stating that, for the AI tool, the addendum prevails over any conflicting term in the master agreement, the vendor's standard terms, any click-through acceptable-use policy, and any online documentation incorporated by reference. AI vendors often update online policies unilaterally, so pin the version that applies or require notice of changes that reduce your rights. Make sure the addendum is signed by someone with authority on both sides and is attached to, not just referenced by, the contract, so there is no argument later about whether it forms part of the deal. ## Questions to ask the vendor before you sign - Do you train on our data by default, and can we turn that off in writing?
• Which foundation-model providers and sub-processors sit behind the tool, and where is data processed?
• How and when will you tell us about model changes, and can we test first?
• What is your IP infringement indemnity, what is the cap, and what is carved out?
• What logs can we access, and how will you support us if we must explain an output?
• On exit, how and when do you return and delete our data, and will you confirm it? ## Keeping AI clauses consistent across every contract Once you have a good AI addendum, the real work is making sure it actually lands in every AI tool contract, that the data-use and indemnity terms do not drift from one vendor to the next, and that you can find which version each supplier signed when a model change or an incident forces you to check. Drafting from a clean clause set, spotting where a vendor has watered down an indemnity or a deletion promise, editing a clause in plain language across a batch of contracts, and holding every version with its date can live in one AI workspace tuned to how your company contracts. Adira is built around that single-workspace idea for business contracts. For a single tool the clause set above is enough; the point worth keeping is that contract controls only protect you if they are applied consistently and kept in one place.