アプリケーションガイド
AI Contract Terms: Data Use, Indemnity and SLAs
AI contract terms are the clauses in an AI vendor agreement that decide four things: what the vendor may do with your data, who pays if model output infringes someone's rights, how reliable the service has to be, and how much the vendor owes you when something goes wrong.
このページでは4 分で読めます
概要
They matter because standard click-through terms are written to protect the vendor, and the default settings on data use and liability are often where most of your risk sits.
ディープダイブ
Four groups of clauses do most of the work in an AI contract. The first is data use. Look for explicit language on four points: whether your inputs (prompts and files) and outputs can be used to train or improve the vendor's models, how long they are kept, whether vendor staff can review them for abuse monitoring, and which subprocessors handle them. Many major vendors now say that business and API customer data is not used for training by default. OpenAI, for example, has said this for API data since 2023. Consumer tiers of the same products often have different defaults, and wording like 'to improve our services' can be broad. Get the commitment in the signed agreement, not only in a web FAQ that can change. The second is IP indemnity. In 2023 several large providers, including Microsoft (the Copilot Copyright Commitment), Google and OpenAI (Copyright Shield), announced they would defend some paying customers against copyright claims over generated output. The promises come with conditions: the customer usually has to keep the vendor's safety filters on, must not deliberately prompt for infringing material, and must be on an eligible plan. An indemnity is only as useful as its exclusions allow. The third is the service level agreement (SLA). A 99.9% monthly uptime SLA still allows about 43 minutes of downtime a month. Read how uptime is measured, whether slow responses or high error rates count as downtime, and what the remedy is. Most SLAs pay service credits, not cash. The fourth is limitation of liability. Caps are usually tied to the fees paid over a period, often 12 months. Buyers often negotiate higher 'super caps' for data breaches, confidentiality breaches and indemnity obligations. A common misconception is that a vendor's marketing page is binding. What governs is the signed contract plus any documents it incorporates by reference.
戦略的影響
ビルドの選択
AI が実際の成果を向上させるかどうかは、アプリケーション レベルの設計によって決まります。
チームとワークフロー
ワークフローを適切に統合すると、ユーザーが信頼できる生産性が向上します。
リスクと安全性
適切な範囲のユースケースにより、変更の疲労と実装のリスクが軽減されます。
The Future of AI Contract Terms: Data Use, Indemnity and SLAs
AI contract terms are still settling. As laws such as the EU AI Act phase in obligations for providers and deployers, buyers will probably see more clauses that split compliance duties, documentation and incident reporting between the two parties. Indemnity offers may widen or narrow as courts resolve copyright cases over training data and outputs. Agentic systems, which take actions rather than only produce text, raise new questions about who is liable for a mistaken transaction. Standard templates from industry groups and public-sector buyers are likely to mature, which should make negotiation easier for smaller organizations with little bargaining power.
現実世界の実装
A hospital buying an AI transcription tool negotiates a clause saying patient audio and transcripts will not be used to train or improve the vendor's models and will be deleted within 30 days of the contract ending. It signs a HIPAA business associate agreement alongside it.
A marketing agency using an image generator checks two things: whether the vendor's IP indemnity covers only paid enterprise plans, and whether the indemnity is voided if staff switch off the vendor's content filters.
A customer support team that relies on an LLM API negotiates a 99.9% monthly uptime SLA with service credits. It then notices the credits are capped at 10% of monthly fees, so it also asks for the right to terminate after repeated breaches.
A bank's legal team pushes the liability cap for data breaches above the standard '12 months of fees', because possible regulatory fines are far larger than the contract value.
リスクとガードレール
壊れたプロセスを自動化すると、既存の問題がさらに拡大する可能性があります。
チームが過剰に自動化し、必要な人間の判断を排除してしまう可能性があります。
出力が継続的に評価されないと、品質が変動する可能性があります。
実装ロードマップ
現在のワークフローをマッピングし、最も摩擦が大きいステップを特定します。
完全自動化の前に人間によるチェックポイントを定義します。
プロンプト、エスカレーション パス、品質基準についてユーザーをトレーニングします。
タスクレベルの結果を追跡して、持続的な価値を確認します。
探検を続けましょう
Free newsletter
Get the daily AI briefing
Three verified AI stories every weekday morning, written in plain English. Free forever, no ads.
One email each weekday. Unsubscribe in one click. We never sell or share your address.
Test yourself
Take the AI Contract Terms: Data Use, Indemnity and SLAs quiz
Instant feedback on every answer, and a shareable certificate with a verifiable ID once you pass a course.
Support free AI education. AI Understanding is a 501(c)(3) nonprofit — no ads, no paywall, ever. Make a donation
よくある質問
What is AI Contract Terms: Data Use, Indemnity and SLAs?
AI contract terms are the clauses in an AI vendor agreement that decide four things: what the vendor may do with your data, who pays if model output infringes someone's rights, how reliable the service has to be, and how much the vendor owes you when something goes wrong. They matter because standard click-through terms are written to protect the vendor, and the default settings on data use and liability are often where most of your risk sits.
About how much monthly downtime does a 99.9% monthly uptime SLA still allow?
0.1% of a 30-day month (about 43,200 minutes) is roughly 43 minutes. A high-sounding percentage can still allow meaningful outages.
What remedy do most SLAs provide when the vendor misses its uptime target?
SLAs usually pay service credits, which are often capped. That is why buyers sometimes also negotiate a right to terminate after repeated breaches.
Which condition is commonly attached to vendor IP indemnities for generated output?
Indemnities such as Microsoft's Copilot Copyright Commitment and OpenAI's Copyright Shield usually require customers to keep safety features on, avoid deliberately infringing prompts, and use qualifying paid plans.
Why should a no-training commitment be in the signed agreement rather than relying on a vendor's web FAQ?
The signed contract and the documents it incorporates are what govern. A marketing page or FAQ can be edited at any time and may carry no contractual weight.
A vendor says it does not train on your data but keeps it for about 30 days. What explains this?
Training and retention are separate questions. A vendor may store inputs for a limited time for abuse monitoring even when it does not train on them. Some offer zero-data-retention arrangements.
学び続ける
関連ガイド
このトピックのために選ばれたその他のガイド