A managing director is asked to approve an AI software contract after a short demo. The order form names a price and a number of seats. The terms that decide whether the firm can live with the tool are usually further down, or missing. This page is a buying brief for that moment. It is not legal advice, and it is not a substitute for counsel when the tool will make decisions about people.
The useful questions are ordinary. Who may train on your files? Who owns what the tool writes back? Which person can stop it? How do you leave, and what do you take with you? If those four lines are blank, the demo has not given you a contract you can judge.
Two public texts are worth having open while you read the vendor’s paper. Neither is a certificate you must hold before a small firm buys a writing tool. Both tell you what a serious buyer asks.
What an AI software contract is selling
An AI product usually bundles three different things. A login to a model someone else runs. A right to send the firm’s files to that model. A claim about who may keep those files, and who may keep the text or numbers that come back. The order form prices the login. The other two sit in the terms, the data processing addendum, or nowhere.
The NIST AI Risk Management Framework is written for organisations that design, develop, deploy, or use AI systems. NIST released version 1.0 on 26 January 2023 and describes it as voluntary. The core of the framework, set out in NIST AI 100-1, is four functions: govern, map, measure, and manage. Govern is the cross-cutting one. It is where policies, roles, and the rules for acquiring a system belong. NIST’s own page also says that AI RMF 1.0 is being revised. Treat the four functions as a checklist for the conversation with the vendor, not as a badge the firm must earn before it signs.
Map, in plain language, is the question “what is this system for, and what can it touch?” Measure is “how will we know if it is going wrong?” Manage is “what do we do when it does?” A director does not need the subcategory codes. A director does need the vendor to answer those three sentences in writing.
Who may train on your files
If the tool can see customer names, staff records, unpublished prices, or drafts of advice, it is processing material the firm did not mean to give away. The UK Information Commissioner’s Office guidance on AI and data protection is not a statutory code. The ICO says there is no penalty for skipping a good-practice recommendation if you comply with the law another way. It also says a risk-based approach means two things: assess the risks to the rights and freedoms of individuals, and put proportionate measures in place. The same page says you may have to stop a planned AI project if you cannot sufficiently mitigate those risks. The guidance is under review because of the Data (Use and Access) Act, so check the date on the page before you treat a paragraph as current.
That is a UK data protection text. It is not the law of Mauritius, Kenya, or every other place the firm operates. It is still a clear statement of the questions a buyer should force into the contract when personal data is in scope. Ask, in the contract and not only in a privacy policy:
- What leaves your tenant, and to which country.
- Whether prompts, files, or outputs are used to train a model that other customers then use.
- How long copies are kept after you cancel.
- Who inside the vendor can open a support ticket that contains your content.
A sentence that says “we may use customer data to improve our services” is not an answer. Improvement can mean fixing a bug in your tenant. It can also mean training a general model. Make the vendor pick one, and write the pick into the order.
If staff are already pasting client work into personal chatbot accounts, the contract for a company seat does not undo that habit. Pair the purchase with a house rule for what never gets pasted. The firm’s note on an AI working agreement a small team will use is the operational half of the same decision.
Who owns the output
The second blank line is ownership of what comes back. A summary of a board pack, a first draft of a customer email, a table of invoice exceptions. If the contract is silent, do not assume the firm owns that text. Ask for a clause that the customer owns the outputs it creates from its own inputs, and that the vendor’s right to those outputs is limited to running the service.
Ask the mirror question too. The vendor will want to keep its model, its weights, and its prompts. That is reasonable. What is not reasonable is a licence that lets the vendor reuse your outputs, or your inputs, in a product sold to your competitors. Read the licence grant in both directions.
Outputs can also be wrong. A contract that assigns you the copyright in a hallucinated paragraph does not make the paragraph true, and it may not shift liability for what you send to a customer. The buying question is separate from the editing question. Someone in the firm still reads anything that leaves the building. The page on when to use an AI agent, and when a chat is enough is about that judgement. The contract should not pretend the tool has made it for you.
Which person can stop the tool
Some tools draft. Some tools recommend a decision about a person: a hire, a credit line, a benefit, a grade. Those are different purchases. Regulation (EU) 2024/1689, the EU Artificial Intelligence Act, puts specific duties on deployers of high-risk AI systems in Article 26. The article, on the EUR-Lex text, says deployers shall:
- Use the system in line with the instructions for use.
- Assign human oversight to natural persons who have the competence, training, and authority, and the support, to do it.
- Where they control the input data, keep that data relevant and sufficiently representative for the intended purpose.
- Monitor operation against the instructions, and suspend use if they have reason to consider that the system presents a risk of the kind Article 79(1) describes, telling the provider or distributor and the market surveillance authority without undue delay.
- Keep logs the system generates, where those logs are under their control, for a period appropriate to the purpose, of at least six months, unless other Union or national law provides otherwise.
- Before using a high-risk system at the workplace, inform workers’ representatives and the affected workers.
Read the scope before you treat this as your statute. Article 26 applies to deployers of high-risk AI systems. A writing assistant used inside one office is not automatically in that class. A firm in Mauritius with no EU staff and no EU customers should not invent an EU filing duty. A firm whose tool sorts candidates, scores credit, or otherwise makes decisions about people in the Union should ask counsel whether it is a deployer of a high-risk system, and should not take this article as that advice.
The contract question travels even when the statute does not. Name the person who may switch the tool off. Say which decisions it is not allowed to make alone. Ask the vendor for the instructions for use, and for a log you can export, because a duty to keep logs is useless if the only copy sits in the vendor’s console and dies when you cancel.
Where the tool sits inside the finance function, the same questions apply to numbers rather than to prose. The firm’s guide to AI in the finance function that mid-sized firms actually use is about that operating choice. The contract should say whether the tool may post, approve, or only suggest.
How you leave
Exit is the clause people skip because they are trying to start. Ask for three dates. The date you can export your prompts, files, and outputs in a format a spreadsheet or a text editor can open. The date the vendor deletes its remaining copies, including backups, with a written confirmation. The date named user accounts stop working, including any administrator the vendor created for support.
Ask what happens to logs. If you are the party expected to retain them, the export has to include them. If the vendor retains them for its own security, the contract should say for how long, and that they are not a training set.
Price the exit before you like the demo. A low seat price with a painful export is a dear contract. A renewal that auto-extends unless you give notice ninety days ahead is easy to miss in a firm where one person reads the PDF. Put the notice date in the same calendar as the licence start.
| Question to send the vendor | A usable written answer |
|---|---|
| May you train a model other customers use on our prompts, files, or outputs? | Yes or no, naming the product. “We improve our services” is not an answer. |
| Who owns the outputs we generate from our own inputs? | The customer, with the vendor limited to running the service. |
| Who in our firm can stop the tool, and which decisions must a person make? | A named role, plus a short list of decisions the tool may only suggest. |
| How do we leave, and what is deleted? | An export format, a deletion date, and a confirmation in writing. |
A one-page brief you can send this week
You do not need a framework programme to send the email. Copy the four rows above into a message to the seller. Ask for the data processing terms, the instructions for use, and the deletion clause as attachments, not as links that can change after you sign. Keep the replies with the order form.
Then decide. If the tool only drafts text that a person will edit, and no personal data leaves a company tenant, the NIST checklist and a short house rule may be enough for now. If the tool will decide, rank, or refuse something for a person, stop and get advice on whether a high-risk deployer duty, a data protection impact assessment, or both, applies where you operate. The ICO’s point is practical even outside the UK. If you cannot sufficiently mitigate the risk, you may have to stop the project.
Connect the purchase to the tools the firm already pays for, rather than adding a second pile of accounts. The note on how to connect an AI assistant to tools you already pay for is about that plumbing. Plumbing without the four contract lines is how a useful demo becomes a file you cannot get back.
Sign when the four answers are in the pack, in sentences a director can read without a glossary. If the seller needs a month to write them, that is information. A vendor who cannot say whether your files train someone else’s model is telling you the product is not ready for your customers’ names.
Key takeaways
- Price the login separately from the rights in your files and in the outputs.
- NIST’s AI RMF 1.0 is voluntary, dated 26 January 2023, and under revision. Use govern, map, measure, and manage as questions, not as a certificate.
- The ICO’s AI guidance is not a statutory code. It does say you may have to stop a project you cannot make safe for people.
- Article 26 of Regulation (EU) 2024/1689 binds deployers of high-risk systems, including human oversight and logs kept for at least six months where the deployer controls them. It is not a rule for every chatbot.
- Do not sign while the exit clause is “contact support”.
FAQ
Does every AI subscription need an EU AI Act review?
No. Article 26 applies to deployers of high-risk AI systems under Regulation (EU) 2024/1689. A drafting tool in one office is not automatically in that class. If the tool decides about people, ask counsel before you assume you are outside it.
Do we have to be certified against the NIST AI framework before we buy?
No. NIST describes the AI RMF as voluntary. The four functions are a way to organise the questions you put to the vendor. NIST has also said version 1.0 is being revised.
Is a privacy policy enough on training?
No. Ask for a yes or no in the contract: whether your prompts, files, or outputs train a model other customers use. A sentence about improving services leaves both answers open.
Who should be allowed to turn the tool off?
A named role with the authority to suspend use, not a shared inbox. Article 26 expects that person, where it applies, to have competence, training, and support.
Is this legal advice?
No. It is a buying brief. Data protection law and the EU AI Act depend on where you operate and what the tool does. Have counsel read the paper before you sign a high-risk use.
Sources
- NIST, AI Risk Management Framework. nist.gov/itl/ai-risk-management-framework
- NIST, Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, January 2023. nvlpubs.nist.gov
- Information Commissioner’s Office, “About this guidance”, Guidance on AI and data protection. ico.org.uk
- Regulation (EU) 2024/1689, Article 26, EUR-Lex. eur-lex.europa.eu
This article is general information, not investment advice. See section 4 of our Terms & Conditions.
This is the kind of decision we advise on. If you are weighing it for your own business, see how we work or start a conversation.
