Thank you to Madelin Sinclair McAusland & Liz Smith for providing us with this guest blog as part of Burges Salmon AI Editorial Month at techSPARK.
Whether you are procuring an Al powered tool or wanting to control how your suppliers use your data within their Al ecosystem, we know that the volume of Al related content can be overwhelming. Here we have distilled the key points to consider into one handy guide to help steer your approach.
The overarching point to remember is transparency – ensure that you and your key stakeholders fully understand the use of Al in the relevant product and push for an explanation if a counterparty peppers discussions with broad statements lacking in specificity. Consider your data and AI governance requirements and how they need to be reflected in any contract or impact the sign-off of any Al related contract.
In addition, consider what type of Al tool is being used. Marketing can often describe a solution or tool as “Al powered” or “AI enabled” – it’s important to understand what the vendor is selling (i.e. a bespoke Al tool or an Al wrapper?) as this will have implications on a number of other issues raised in the paper.
- Data Considerations
- Data Ownership: Ensure that the contract clearly specifies who owns the data generated by the Al tool.
- Training Data: Consider the quality and source of the training data and how that may impact the output generated by the Al tool (such as the accuracy and quality). In some cases, you may have some data ringfenced and some data that can a to train the Al tool.
- Data Security: In respect of Al, there is often a complex value chain that may present novel security risks. Establish standards for data security, including measures to prevent unauthorised access, data breaches, and other security threats.
- ISO: Ask your provider to commit to adherence to a specific ISO standard and/or your organisation’s security requirements. For example, ISO/IEC 42001 sets out a certifiable framework specifically designed for Al management systems and promoting robust Al governance.
- Data Privacy: Where personal data will be captured, include provisions that ensure compliance with applicable data protection laws and regulations (consider whether deanonymisation is possible). If your customer or employee data will be used, consider how the proposed use dovetails with your privacy notice and ensure you are working closely with your Data Protection Officer
- Data Retention and Disposal: Specify the duration for which data will be retained and the methods for its eventual disposal (should deletion be evidenced?), ensuring compliance with legal and regulatory requirements.
- Data Usage: Consider permissible (and non-permissible) uses of any input data and output data generated by the Al tool.
- Intellectual Property
- Licensing: Detail the scope and limitations of any licences granted for use of intellectual property, including any third-party IP integrated into the Al system.
- IP Infringement: Consider the origin of the data used to train or use the Al system and whether there is any potential for infringement of third party rights.
- Where you are procuring IP related services (e.g. creative services from a design agency), ensure that you explicitly address whether or not Al can be used in its creation. For core branding such as a trade mark we’d recommend insisting upon an original non-Al creation.
- Liability
- Liability Limits: Set clear limits on the liability of each party – this is important for both the customer and supplier. Al tool providers are having to provide more robust liability coverage than they used to – customers will likely want to push suppliers to stand behind their product and reflect this in the liability cap.
- Negotiation: Some counterparties may be able to negotiate a better risk allocation deal if your organisation can offer something in return, e.g. access to a wider range of data or a big name for their client list early on in their Al journey.
- Internal Training: Ensure users are properly trained to use the Al system to take steps to (1) control liability and (2) be able to rely on any warranty coverage.
- Warranty Coverage
- Historic Warranties: The market has moved on warranty coverage – in the early days, customers would receive very little from Al tool suppliers, but this has changed as tools become more widespread and sophisticated.
- Market Position: While the warranties are hotly negotiated in each situation, we’d expect some minimum warranties in all circumstances and an enhanced warranty package where there will be bespoke development of elements of the Al tool.
- Term
- Contract Duration and Lock-in Risk: We are seeing many Al tool providers concerned that their product will be overtaken by others in the market. To balance this risk, some try to lock in customers for long periods. Whatever you agree, consider the risk of lock-in carefully and note that in some cases it may be worth paying a higher price for a shorter duration. Consider any limitations on the ability to switch to another provider.
- Exit provisions: Establish key requirements to assist with transitioning to a new provider (for example, portability of data and what form any data transfer should take). Incorporate training and knowledge transfer throughout the contract lifecycle.
- Reassess use of Al over the contract lifecycle: Consider including a practical framework to ensure this happens on a regular basis. In some situations, you may have a better outcome using an iterative process to define requirements as you would in an agile IT environment.
- Regulatory
- Regulatory Requirements: When using Al tools in a regulated sector (e.g. healthcare or defence) or the EU (e.g. the EU Al Act), ensure that you have factored in regulatory requirements (and associated guidance).
- Review Process: Build in a process to review how any changes in the Al system (e.g. if it adapts autonomously), any changes in its intended use and/or how any changes in marketing or user-facing material impact the regulatory requirements.
- Responsibility Allocation: Finally, as regulation in this area develops, be clear in the contract about who bears primary responsibility for costs associated with the evolving regulatory landscape. Ideally this should be agreed upfront together with a process for implementing changes required by new regulatory requirements.
Start conversations on the points above early in the commercial process. If your counterparty is resistant to discussion of these points, it may give an early warning sign that the counterparty may not be an appropriate long-term commercial partner.
If you’d like to discuss further, please contact Madelin Sinclair McAusland or Liz Smith.
Meet The Guest Blog Authors
Madelin is a senior lawyer specialising in commercial contracts, data protection (including in house as a data protection officer), technology, transactional intellectual property and a wide range of other legal matters. Madelin spent the first seven years of her legal career in private practice before moving to Virgin Management where she worked for seven years before joining Burges Salmon LLP in September 2024.
Covering a wide range of sectors including technology, media, life sciences, food and drink, transport, sport, leisure and retail, she has also advised an array of organisations spanning from individuals, the Branson family office, start-up businesses and incubators to charities, public sector bodies, private and public companies.
Madelin Sinclair McAusland, Director
T: +44 (0) 117 307 6646
M: +44 (0) 7967 856 315
E: Madelin.SinclairMcAusland@burges-salmon.com
Liz is an associate at independent law firm Burges Salmon LLP. She has a broad range of experience across multiple sectors advising on technology related contracts, including IT outsourcing, digital transformation, SaaS and software licensing transactions. Liz also has experience advising on a wide range of data protection, artificial intelligence and intellectual property related issues. She writes on AI regulation and law on the Burges Salmon AI blog, and delivers AI-specific training to clients. Liz was a key contributor to the Chambers and Partners Artificial Intelligence Guide 2024. She is also a member of the Society for Computers and Law.
Covering a wide range of sectors including technology, media, life sciences, food and drink, transport, sport, leisure and retail, she has also advised an array of organisations spanning from individuals, the Branson family office, start-up businesses and incubators to charities, public sector bodies, private and public companies.
Liz Smith, Associate
T: +44 (0) 117 902 6693
M: +44 (0) 7966 426 266
E: Liz.Smith@burges-salmon.com
Keep up to date by visiting our Al Blog here. To subscribe to our Al mailing list, click here.
