As artificial intelligence becomes increasingly integrated into business operations, companies must carefully evaluate vendor contracts involving AI technologies. More and more vendors are promising the moon when it comes to AI or AI-enhanced services, so here are some key issues to take into account when reviewing these types of contracts:
Definition and Scope of AI
It’s crucial to clearly define what constitutes “AI” for the purposes of the contract. Consider us-ing a broad definition to capture various AI processes and applications, including machine learning, algorithmic decision-making and predictive analytics. This comprehensive approach ensures the contract remains relevant as AI technologies continue to advance.
Due Diligence and Transparency
Before entering into an AI vendor contract, conduct thorough due diligence on both the vendor and the AI system itself. Key areas to investigate include:
- The vendor’s reputation, past performance and any potential legal issues
- The AI model’s provenance, architecture, training data sources and potential biases
- The vendor’s quality control processes and bias mitigation strategies
Transparency about when AI is being used can be critical. Many regulations and formative regulations require informing the end user that they are dealing with AI, not a real person. Consider including contractual provisions that require:
- Disclosure of AI usage in consumer-facing services or products
- Prompt notification of any issues with the AI system, such as downtime and lawsuits that could affect the provision of AI services
- Protocols for issue remediation and potential service suspension
Data Handling, Intellectual Property and Confidentiality
Data is the lifeblood of AI systems, making it critical to address data handling and intellectual property rights in the contract. Clearly delineate ownership and usage rights for:
- Input data provided by the company – the copyright in input data should be owned by the company
- Outputs generated by the AI system – again, preferably any copyright in the output data should be owned by the company
- Is the AI vendor using your company’s data to train its model? Is that an issue from a da-ta privacy or HIPAA perspective?
- Are there confidentiality provisions protecting the input and output data?
Additionally, ensure the contract addresses data-security measures, including encryption proto-cols and data breach notification procedures. Compliance with applicable privacy laws and reg-ulations should be explicitly required.
Intellectual property considerations extend beyond data. Negotiate appropriate indemnification for potential IP infringement claims, and consider licensing arrangements for continued use of AI-generated content after contract termination if those rights are granted upfront.
Performance Standards and Accountability
Establish clear metrics for AI performance, including accuracy, reliability and absence of bias. Consider incorporating service level agreements (SLAs) with specific performance targets, and the ability to terminate the contract if performance targets aren’t met. The contract may also need to address the AI system’s ability to scale with increased demand.
To ensure ongoing accountability, try to include provisions for regular audits or assessments of the AI system and monitoring for bias throughout the AI’s evolution.
Regulatory Compliance and Risk Allocation
The contract should clearly allocate responsibility for ensuring the AI tool complies with applicable laws. This is particularly important given the rapidly changing regulatory landscape sur-rounding AI, especially given the strong likelihood that AI regulations are likely to emerge on a state-by-state, or even municipality-by municipality basis. Colorado was the first state in the United States to pass a comprehensive AI law. Include provisions that allow for adaptation to new AI regulations as they emerge.
Carefully define each party’s responsibilities, including indemnification and limitations of liability. Address potential risks such as AI errors, biases, or unintended consequences. Consider expanded indemnification clauses to cover AI-specific risks that may not be adequately ad-dressed by standard contract language.
As the AI landscape continues to evolve, it’s crucial to work closely with legal counsel to ensure contracts remain up-to-date and aligned with best practices. By carefully considering these elements, companies can better protect their interests and mitigate risks when engaging AI vendors.
If you have questions or concerns about AI contracts or AI-related matters, please reach out to attorney Brendan M. Palfreyman at (315) 214-2161 and bpalfreyman@HarrisBeach.com, or the Harris Beach attorney with whom you most frequently work.
This alert is not a substitute for advice of counsel on specific legal issues.
Harris Beach has offices throughout New York state, including Albany, Buffalo, Ithaca, Long Island, New York City, Rochester, Saratoga Springs, Syracuse and White Plains, as well as Washington D.C., New Haven, Connecticut and Newark, New Jersey.
