As artificial intelligence tools become embedded in everyday business operations, companies across New York and beyond are entering into contracts with AI vendors at an unprecedented pace. From AI-powered customer service platforms to machine learning tools that analyze financial data, the range of AI vendor relationships is vast — and the contractual issues they raise are often poorly understood.
The standard software licensing agreement is not sufficient for AI. AI systems present unique risks around intellectual property ownership, data usage, algorithmic bias, and evolving regulatory requirements. If your business is contracting with an AI vendor, here are five provisions that should be in every agreement.
1. Intellectual Property Ownership and Licensing
One of the most contentious issues in AI contracts is who owns what. When your business provides data to an AI vendor and that vendor uses your data to train or improve its model, the resulting intellectual property rights can be murky. Without clear contractual language, you may find that the vendor has used your proprietary business data to improve a product it then sells to your competitors.
Your contract should clearly define ownership of input data, output data, and any models or derivatives created using your data. It should specify whether the vendor can use your data to train its general model or only for your specific deployment. It should address who owns the outputs generated by the AI system when applied to your data. And it should include restrictions on the vendor’s ability to use your data for the benefit of third parties.
These are not abstract concerns. Disputes over AI-generated intellectual property are already appearing in courts across the country, and clear contractual provisions are the best defense.
2. Liability Allocation for AI Errors and Bias
AI systems make mistakes. They also produce biased outcomes. When those errors or biases cause harm — to your customers, your employees, or third parties — the question of who bears liability is critical.
Many AI vendor contracts attempt to disclaim all liability for the accuracy or fairness of AI outputs. This leaves your business holding the bag when something goes wrong. A well-drafted AI contract should allocate liability based on which party has control over the relevant risk. If the vendor designed and trained the model, the vendor should bear responsibility for defects in the model’s core functionality. If your business customized or deployed the model in a specific way, you may share responsibility for outcomes related to that deployment.
The contract should also address indemnification for claims arising from biased or discriminatory AI outputs, particularly in light of laws like NYC Local Law 144, which holds employers responsible for bias in automated hiring tools regardless of whether those tools were built by a third-party vendor.
3. Data Rights, Security, and Privacy
AI systems are data-hungry. The more data they process, the better they perform — which creates significant tension between the vendor’s desire for broad data access and your business’s need to protect sensitive information.
Your AI vendor contract must address what data the vendor can access, how it will be used, how long it will be retained, and what happens to it when the contract ends. It should specify data security standards the vendor must meet, including encryption, access controls, and breach notification obligations. It should address compliance with applicable privacy laws, including the New York SHIELD Act, GDPR if European data is involved, and any industry-specific regulations.
Critically, the contract should give your business the right to audit the vendor’s data practices and require the vendor to delete or return your data upon termination. Without these provisions, your proprietary and customer data may remain in the vendor’s systems indefinitely, being used in ways you never anticipated or approved.
4. Transparency and Explainability Requirements
Many AI systems operate as “black boxes” — they produce outputs without explaining how they reached their conclusions. For businesses subject to regulatory scrutiny, this opacity is a significant problem. Regulators, courts, and customers increasingly demand that businesses be able to explain how and why AI-driven decisions were made.
Your contract should require the vendor to provide sufficient transparency into how the AI system works. This does not mean disclosing proprietary algorithms, but it does mean providing enough information for your business to understand and explain the basis for AI-driven decisions. The contract should also require the vendor to provide documentation about the training data used, known limitations of the system, and any updates that materially change how the system operates.
As AI regulation expands — both in New York and under the EU AI Act — businesses that cannot explain their AI systems’ decision-making processes face increasing legal exposure.
5. Regulatory Compliance and Future-Proofing
The regulatory landscape for AI is changing rapidly. Laws enacted today may be supplemented or superseded by new requirements tomorrow. A contract that addresses only today’s regulations may leave your business exposed as new rules take effect.
Your AI vendor contract should include provisions that require the vendor to maintain compliance with applicable laws as they evolve. It should include a mechanism for updating the agreement to address new regulatory requirements without renegotiating the entire contract. It should specify which party bears the cost of compliance updates. And it should include termination rights if the vendor’s product cannot be brought into compliance with new legal requirements within a reasonable timeframe.
This forward-looking approach protects your business from being locked into a vendor relationship that becomes a compliance liability.
The Bottom Line
AI vendor contracts are not standard software agreements with a new label. They require specialized attention to intellectual property, liability, data rights, transparency, and regulatory compliance. Businesses that treat AI procurement like any other technology purchase are taking on unnecessary risk.
At Travis & De Blase LLP, our AI Enhanced General Counsel practice works with businesses across New York to negotiate, draft, and review AI vendor contracts that protect their interests and position them for compliance with current and emerging regulations. We bring both litigation strength and business insight to every engagement, ensuring that your contracts work for you — not just for your vendor.
Ready to review your AI vendor contracts? Contact Travis & De Blase LLP today. Call (212) 248-2120 or email info@travisdeblase.com. We are located at 40 Wall Street, Suite 2508, New York, NY 10005.
Related Practice Areas and Resources
For guidance on AI vendor contracts and business agreements, visit our AI Enhanced General Counsel and Business Agreements practice area pages. You can also review our AI Enhanced General Counsel FAQ and Business Agreements FAQ for answers to common questions.