Most organisations use AI through suppliers: a chatbot in a customer service platform, a screening tool in recruitment software, a drafting assistant in an office suite. The legal risk comes with it.
Why the contract matters
Under the EU AI Act, a deployer has its own duties even when it bought the system. It cannot rely only on the vendor’s assurances. Under data protection law, the buyer is usually the controller of the personal data it puts in. In financial services, rules on outsourcing and, in the EU, the digital operational resilience rules (DORA) apply to AI suppliers like any other technology supplier.
The clauses to check
Use of your data. Whether the vendor may train or improve its models on your inputs and outputs. Business tiers usually say no; consumer tiers often say yes.
Confidentiality and location. Where data is stored and processed, for how long, and who can see it.
Intellectual property. Who owns outputs, and whether the vendor indemnifies you against claims that its model or outputs infringe.
Information. The documentation you need to meet your own duties: intended purpose, limitations, testing results.
Change and incidents. Notice before the model changes materially, and prompt notice of incidents.
Audit and exit. The right to ask questions and test, and a clean exit with deletion of your data.
The question is not whether the vendor is reputable. It is whether the contract gives you what you will need when a regulator or a claimant asks.
What to do
Add AI questions to your supplier due diligence. The EU has published model contractual clauses for public buyers of AI, which are a useful checklist for private buyers too.
This article is general information on the law as at November 2026. It is not legal advice and has not been updated since that date. See the terms of use.