AI vendor contract checklist: IP, data, liability and exit terms

Language mentioning AI appeared in 53 per cent of cloud service agreements signed in the year ending June 2026, up from 47 per cent in 2025 and 38 per cent in 2024. About one in five contracts now negotiate AI-specific edits to standard terms, up from under 4 per cent in 2024. Fashion executives buying demand forecasting, virtual try-on, personalisation or supply-chain tools need to address intellectual property ownership, data use, indemnity scope, residency, liability caps, performance commitments, termination and portability before signing.

The integration of AI into commercial products and enterprise software agreements has forced a rethinking of longstanding contract frameworks. The better approach for both buy-side and sell-side is to integrate AI risk into the substance of the contract, including in the IP provisions, the liability framework, the data governance terms, the compliance allocation, and the service-level commitments.

Who owns training data and model outputs?

Parties must allocate ownership of AI outputs, a complex question given that purely AI-generated content may lack copyright protection. Agreements should include explicit ownership clauses specifying which party owns outputs, including any derivative works. Guidance from the U.S. Copyright Office and recent cases indicate that purely AI-generated works lacking meaningful human input are not eligible for copyright registration, and that prompts alone are generally insufficient to qualify as authorship.

Under the paid and business terms of OpenAI, Anthropic, Google, Microsoft, and AWS, you own the outputs or the vendor declines to claim them. A hosted vendor doesn't hand over the base model, and a model you fine-tune on OpenAI's or Anthropic's hosted infrastructure comes back as a vendor-hosted endpoint rather than portable weights. When customer data is used to fine-tune or improve a vendor's model, parties must determine whether the vendor may use those improvements for other customers or whether the customer retains proprietary rights.

The contract should define training data as distinct from customer data and clarify whether the vendor may use inputs or outputs to train foundation models. Drafted when "improve the product" meant fixing bugs and adding features, that same wording in 2026 covers training a foundation model on customer inputs. The defensible contract standard for AI-enabled SaaS in 2026 has five components, starting with training off by default: the contract prohibits use of customer data for training, fine-tuning, reinforcement learning, or benchmarking any AI model without prior written consent from a named customer signatory.

What IP indemnity protections should buyers demand?

AI indemnities routinely promise to defend claims that the Services or the Software infringe, which leaves output claims outside the promise. An indemnity written against the "Services" or the "Software" that never mentions output leaves the claim you are most likely to face outside the promise. Buyers should seek broad indemnities covering use of the AI system and outputs, any third-party IP infringement claims arising from the use of outputs or training data, and any breaches of data protection rights or confidentiality.

Enterprise AI indemnity is the most fluid contract clause category in 2026. 47 per cent include AI indemnity within the general liability cap, 31 per cent use a dedicated super cap at 2x to 3x, 22 per cent include uncapped IP indemnity. An AI clause makes you answer for how an AI vendor trained its model, which you cannot check. Paired with an unlimited indemnity, this is the clause that can hurt a small business most. Customers should carefully evaluate vendor representations regarding training data provenance and compliance with intellectual property laws.

Where must data be stored and processed?

The EU doesn't mandate physical data localisation. EU AI Act (fully applicable August 2026) high-risk AI systems require documented data governance, bias detection and correction, and datasets that reflect the specific characteristics of the deployment environment. The Act does not impose EU data residency, but keeping processing in Europe makes the governance and audit trail simpler to evidence. The EU AI Act's GPAI obligations took effect in August 2025. They do not impose data residency, but they do raise the bar on transparency and training-data documentation, which is easier to evidence when processing stays in Europe.

Mistral (French, EU-native, all data EU), Aleph Alpha (German, EU-only), Anthropic Claude via AWS-EU region (with Enterprise contract), OpenAI Enterprise with Frankfurt region (available since 2024), Google Vertex AI with europe-west region (Belgium/Frankfurt), and Microsoft Azure OpenAI Service with West-Europe region offer EU data residency options. OpenAI residency price uplift is 10 per cent for eligible models released on or after 5 March 2026. Residency endpoints carry a 10 per cent uplift for eligible models released on or after 5 March 2026.

Check Data Processing Agreements for AI-specific clauses. Many DPAs were written before generative AI and don't address training data or inference residency. Fashion firms handling personal data should specify the data centre region, processing location for inference, storage for backups and whether sub-processors have equivalent residency commitments.

How are liability caps and disclaimers structured?

Standard SaaS agreements for AI products frequently include broad disclaimers discarding any warranty as to accuracy or fitness for purpose. Where AI is embedded in core business processes and outcomes matter, buyers are increasingly unwilling to accept a warranty-free posture. More deals include commitments around performance benchmarks, accuracy thresholds, and obligations to remediate when outputs fall short.

Vendors are mostly focused on defending against liability for AI outputs. In contracts, this shows up as new "AI configuration and liability" language like the customer controls how the AI behaves, so the customer is responsible for its outputs, and the vendor does not guarantee AI-generated results are accurate. Consultant shall have no liability for any decision made or action taken by Client (or any third party) in reliance on AI output.

Exclusions and caps on liability should not unlawfully exclude liability for personal injury, fraud, or wilful misconduct. Requirements to maintain professional indemnity or cyber insurance covering AI-related risks and third-party claims. Buyers should adjust liability caps for AI-specific harms, carve out certain categories (e.g., data breaches, IP infringement, wilful misconduct, regulatory fines) from limitations on liability or disclaimers, and align indemnity obligations with where the risk is actually created.

What performance SLAs should contracts include?

2026 SLA benchmarks include uptime SLA at 99.5 per cent to 99.99 per cent, response time under 500ms to 5 seconds, incident response 1-4 hour SLA, and model accuracy rarely offered. Sophisticated buyers push for service-oriented terms: defined service descriptions, performance-based warranties, governance and audit rights, and outcome-tied liability structures.

Fashion firms should negotiate uptime commitments with service credits, response time targets for API calls, defined incident response windows by severity, and where possible minimum accuracy thresholds for critical use cases like demand forecasting or size recommendations. A well-drafted AI agreement reflects the specific use case and the actual risk profile of the deal. The contract should define what constitutes an outage, how downtime is measured, credit calculation methods and any exclusions.

What termination and data portability rights are required?

From 12 September 2025, SaaS providers must allow customers to initiate the switching process with a maximum notice period of two months. This will have a similar effect to permitting early termination for convenience. In effect, the Data Act gives all cloud customers a right to end their contract at any time, regardless of the duration of the contract. Users must be allowed to terminate SaaS contracts with no more than two months' notice. Providers may not charge for data transfer or impose restrictive migration procedures.

Negotiate Data Exit Terms Upfront: specify that upon termination for any reason, the vendor must provide a complete export of your data in a standard format (e.g., CSV or JSON) at no additional cost within 30 days. Without explicit language on data portability, export format, and post-termination retention window, customers have no contractual right to their data after cancellation, a GDPR Article 28(3)(g) requirement and a standard enterprise redline. The subscription agreement should specify data portability rights, export formats, and a post-termination retention window, typically 30 to 90 days. GDPR Article 28(3)(g) requires processors to delete or return all personal data after services end. For AI-enabled SaaS, the contract must separately require deletion of model weights, embeddings, or derived artifacts trained on customer data.

The contract should list data formats (CSV, JSON, Parquet), specify whether API access continues for a transition period, clarify the timeline for deletion confirmation, and address what happens to fine-tuned models, embeddings or AI-generated insights derived from customer data. Contract gap analysis shows 30 per cent of enterprise AI contracts missing data portability on exit clauses.

Negotiation checklist

• Define training data separately from customer data; require opt-in consent before either is used to train or fine-tune models
• Secure explicit assignment of all output ownership rights the vendor holds, plus a licence to anything it cannot assign
• Demand IP indemnity covering outputs and training data, not just the software or service; clarify cap structure
• Specify data centre region, inference processing location, backup storage and sub-processor residency commitments
• Negotiate uptime SLA (99.9 per cent minimum), response time targets, incident response windows and, where feasible, accuracy thresholds
• Include termination rights with maximum two-month notice, data export in standard formats at no cost within 30 days
• Require deletion of model weights, embeddings and derived artifacts trained on customer data upon termination
• Carve out data breaches, IP infringement, wilful misconduct and regulatory fines from liability caps
• Request 30 to 90-day transition assistance period with continued API access for data extraction

For cases where AI is a central issue, an AI Addendum can be added onto the main contract to cover data usage, intellectual property, training rights, liability, and ethical considerations.