Tech & Sourcing @ Morgan Lewis

As companies increasingly incorporate artificial intelligence into their operations, choosing the right AI vendor has become an important company decision. While AI technology can help companies improve efficiency, reduce costs, and streamline operations, working with an AI vendor may raise legal and commercial issues that should be addressed before entering into an agreement.

Companies may want to look beyond a vendor’s technology and consider its experience, data practices, legal compliance, and contractual protections before entering into an agreement.

Vendor Experience and Expertise

Before selecting an AI vendor, key areas to evaluate include the vendor’s experience, qualifications, and track record. For example, does the vendor have a team of qualified engineers, AI specialists, and data scientists capable of developing, maintaining, and supporting technology?

Another diligence focus is the vendor’s litigation history. Companies may want to research whether the vendor has been involved in intellectual property infringement claims, data privacy disputes, or other litigation involving its technology. This information can help identify potential risks and inform negotiations over contractual protections, including indemnification obligations and limitations of liability.

Data Privacy and Security

When selecting a vendor and a particular AI solution, it is important to consider the ways in which an AI vendor collects, uses, stores, and protects data, particularly when the AI technology will process confidential company information, personal information, or other sensitive data.

Additional questions to consider include whether the vendor has the necessary rights to use its AI training data, including any publicly available or scraped datasets, and whether it intends to use customer inputs or AI-generated outputs to train or improve its models. Understanding the source of training data and the vendor’s rights to use it can help assess potential legal risks.

When negotiating an AI vendor agreement, companies may want to consider the following types of provisions, taking into account the applicable data in scope and the functionality of the applicable solution:

• Limiting the vendor’s use of customer data to the purposes authorized under the agreement.
• Restricting the vendor from using confidential or proprietary information to train its AI models without the customer’s consent.
• Requiring appropriate data security measures and notification of security incidents.
• Addressing the return or deletion of customer data upon termination of the agreement.

Quality of Output, Transparency, and Bias

Generative AI models have the potential to produce inaccurate, incomplete, or biased results, which may create legal, financial, or reputational risks depending on how the technology is used. Companies should align with the business stakeholders regarding the expected quality and reliability of AI-generated outputs.

Companies may want to  ask vendors how their AI models are tested and monitored for accuracy, reliability, and bias to understand the model’s limitations and whether the vendor can provide sufficient information about how the technology operates.

Integration, Training, and Support

Even if an AI vendor offers a promising product, companies may wish to consider whether the technology can be effectively integrated into their existing systems and operations.

Companies may benefit from evaluating the vendor’s implementation process, compatibility with existing technology, and ability to provide employee training and ongoing technical support.

Companies may want to consider including provisions that clearly address the parties’ responsibilities during implementation, including timelines, training requirements, maintenance, software updates, and technical support. Another important consideration is whether the vendor will provide assistance if updates to the AI model affect its performance or compatibility with existing systems.

Compliance with Applicable Laws and Regulations

As laws and regulations governing AI continue to develop, it may be helpful to evaluate whether the vendor’s technology and practices comply with applicable legal requirements.

Companies operating internationally may wish to consider AI-specific regulations, such as the European Union’s AI Act,[1] which establishes requirements for certain AI systems and their providers and deployers. These requirements apply on a phased timeline and vary depending on the type of AI system and how it is used.

Companies may find it helpful to ask vendors about their compliance practices and whether they have procedures in place to monitor changes in applicable laws and regulations.

Companies may also want to clarify how responsibility for legal compliance will be allocated between the parties in the AI vendor agreement. For example, companies may seek contractual commitments requiring the vendor to comply with laws applicable to its provision of the technology and to notify the customer of material compliance issues.

Intellectual Property Ownership and Licensing Rights

In addition to evaluating the vendor’s legal compliance, it may be helpful for companies to understand who owns the underlying AI model, the outputs it generates, and any improvements or customizations developed during the relationship.

Ownership of AI-Generated Outputs

Companies may want to determine whether they will own the AI-generated outputs or receive a license to use them. If the company intends to use AI-generated content in its products, services, or other commercial activities, it would be helpful to ensure that the agreement provides sufficient rights for those purposes.

Ownership of Improvements and Customizations

Companies may want to clarify who will own any improvements made to the AI model, particularly when the customer pays for a customized solution.

Vendors will generally seek to retain ownership of the underlying AI model and any improvements, including the right to use those improvements for other customers. Vendors may also seek to treat improved models as their confidential information.

On the other hand, customers that pay for specific customizations may want to negotiate ownership of those developments or, at a minimum, pursue a license that allows continued use of the customized technology.

Feedback Rights

Companies may additionally want to review provisions allowing vendors to use customer feedback to improve their AI products. While these provisions are common, companies may wish to ensure that feedback rights do not inadvertently allow vendors to use or disclose confidential information or proprietary materials.

Clearly addressing these rights in the agreement can help avoid disputes over ownership and future use of the technology.

Contractual Protections and Allocation of Risk

Companies may want to carefully review the representations, warranties, indemnification provisions, disclaimers, and limitations of liability in an AI vendor agreement. These provisions help determine how risks are allocated between the parties if issues arise with the technology.

Representations and Warranties

Companies may seek representations and warranties confirming that the vendor has the necessary rights to provide the AI technology and that the technology, when used as authorized under the agreement, does not infringe third-party intellectual property rights.

Indemnification

Companies may also want to evaluate whether the vendor will indemnify the customer against third-party intellectual property infringement claims arising from the use of the AI technology. Vendors may seek to exclude claims arising from customer-provided data, modifications to the technology, or uses outside the scope of the agreement. Companies could benefit from carefully reviewing these exclusions to understand which risks they may be assuming.

Disclaimers and Limitations of Liability

AI vendors may seek broad disclaimers regarding the accuracy, reliability, or performance of their technology. They may attempt to limit their liability for damages arising from the use of their AI products.

For example, if an AI vendor disclaims all responsibility for inaccurate outputs, the customer may bear the risk of losses resulting from reliance on those outputs. Similarly, a broad limitation of liability may significantly restrict the customer’s ability to recover damages if the vendor breaches its obligations.

Certain obligations, such as confidentiality, data security, or intellectual property indemnification, may warrant exclusions from the general liability cap or be subject to a higher liability cap.

The appropriate allocation of risk will depend on the nature of the AI technology, the sensitivity of the information involved, and how the company intends to use the product.

In conclusion, selecting an AI vendor involves more than evaluating its technology. Conducting thorough due diligence regarding the vendor’s experience, data practices, and compliance, while carefully negotiating intellectual property rights and contractual protections can help companies make informed decisions and manage legal and commercial risks as they incorporate AI into their operations.

Law clerk Evangelina Lopez contributed to this blog post.