AI governance
What your AI vendor contract is probably missing
Most AI agreements are recycled SaaS templates. That structure assumes software which does what it is told, performs consistently, and does not learn from your data. None of the three holds.
The gap in an AI vendor contract usually becomes visible only after something has gone wrong, which is the worst moment to discover that the agreement never contemplated it.
A standard software contract was drafted for a deterministic product. AI systems produce probabilistic outputs, degrade over time with no change to the code, learn from the data you put into them, and raise provenance questions about what they were trained on long before you met them.
Where the template stops short
| Assumption in a SaaS template | What an AI system actually does |
|---|---|
| Output is deterministic and reproducible | Output is probabilistic and may differ across identical inputs |
| Performance is stable until the code changes | Performance drifts in production with no code change at all |
| Your data is processed, not absorbed | Your data may improve the model, and the contract may be silent on who owns that |
| Provenance is the vendor's own IP question | Training-data provenance becomes your exposure once you deploy the output |
Clauses worth insisting on
- A performance floor expressed operationally rather than as an uptime percentage: what the system must still be able to do, measured how.
- A drift and re-baselining obligation, with a defined trigger and a stated view on who bears the cost.
- Explicit terms on training rights over your data, including whether opt-out exists and what it costs.
- An exit path returning your data in a usable form, with its schema, rather than an export nobody can read.
- Audit access sufficient to answer a regulator, specified before you need it.
Regulation is still catching up with practice, which means the contract is currently doing work the law has not yet been asked to do. That is an argument for drafting carefully now, not for waiting.