Tech & Sourcing @ Morgan Lewis

A teenager opens an app. The feed is personalized based on earlier activity. The next video starts automatically. A companion chatbot remembers yesterday’s conversation. To the user, these may appear to be features of one service. Under a new package of California laws, they are separate design choices that can carry different compliance obligations.

As artificial intelligence (AI) becomes increasingly embedded in development services, outsourcing arrangements, and other commercial and technology transactions, customers and vendors are confronting a deceptively simple question: How should risk be allocated when a deliverable is created using AI?

Join intellectual property (IP) partner Colleen Ganin for Fashioning the Law: A Panel Discussion and Q&A, presented by Volunteer Lawyers for the Arts and Morgan Lewis. Colleen will be joined by Ayisha Morgan, General Counsel of Elite World Group, and David Eshmoili, General Counsel and Corporate Secretary of David Yurman, for a discussion of the legal and business issues shaping the fashion industry, from brand protection and intellectual property to the growing impact of AI on fashion and creative businesses.

As AI continues to be incorporated into service offerings, outsourcing arrangements, and other commercial transactions, companies may find they are contracting for more than a discrete technology tool. They may also be creating an operational dependency on a provider’s AI models, data practices, supporting technology, and continued performance.

Cyber insurance traditionally assumes a familiar sequence: an attacker gains access to a system, data is stolen or operations are disrupted, and a claim follows. Autonomous systems may complicate every step, including whether the event qualifies as a cyber incident at all.

A traveler asks an AI concierge to book a quiet oceanfront hotel in Naples for the weekend. Only after the confirmations arrive does the traveler discover that the bot selected Naples, Florida, while the flight is headed to Rome. The hotel is nonrefundable. As AI concierge services move beyond suggesting restaurants and into booking flights, hotels, rental cars, and activities, errors can quickly result in actual charges and disputes over responsibility. When a bot selects the wrong dates, overlooks a cancellation restriction, or books a hotel it was intended merely to recommend, the question becomes who is responsible for the error and the resulting costs.

On 2 August 2026, the transparency obligations in Article 50 of the EU AI Act began to apply. Relative to Article 50, the EU Digital Omnibus (which amended the EU AI Act) only deferred certain specific obligations. As such, the bulk of the Article 50 obligations are already applicable to organizations subject to the EU AI Act. Below is a high-level overview. An upcoming accompanying LawFlash will examine the obligations and exceptions contained in Article 50, the Commission’s Guidelines, and the Code of Practice referenced below in more detail.

Throughout this AI & Outsourcing Services series, we have explored how artificial intelligence is transforming the outsourcing industry, reshaping contract terms, creating new forms of vendor dependency, and redefining how value is measured and priced. As organizations increasingly deploy AI-enabled technologies within outsourced environments, another critical issue is emerging: governance.

The fourth blog in our AI and Outsourcing series examines another significant consequence of AI-enabled outsourcing: the fundamental shift in how parties define, measure, and price value. As artificial intelligence (AI) becomes embedded in service delivery, traditional pricing models based on labor inputs, headcount, and transaction volumes are increasingly being challenged. Customers and service providers alike are reevaluating how outsourcing arrangements should be structured when automation and AI-driven efficiencies can dramatically alter the economics of service delivery.

Most services agreements for vendor-provided technology services contain standard provisions allowing vendors to use customer data and data generated through the provision of services to improve and enhance service offerings. Vendors are increasingly seeking express rights to use such data to not only improve their services but also train their AI models. While these provisions seem to be a natural extension of traditional service-improvement rights, they can have significantly broader implications. Before agreeing to such language, organizations should carefully evaluate how customer data will be used, the extent of the rights being granted, and whether the potential benefits outweigh the risks.