Publication

Before You Buy AI: A Business Guide to AI Vendor Contracts and Risk Management

Published:

29 juillet 2026

Author(s):

• Myriam Whalen

Share

Print

From data ownership and privacy compliance to cybersecurity and intellectual property, here’s what to review before signing an AI software agreement. 

Artificial intelligence has quickly moved from a future technology to a day-to-day business tool. Organizations of all sizes are adopting AI-powered products for drafting documents, customer service, coding assistance, data analysis, recruitment, marketing, and workflow automation. 

 The business case can be compelling: increased efficiency, reduced administrative burden, and access to powerful new capabilities. However, many organizations purchase AI tools using the same processes they apply to traditional software—a practice that can overlook the risks associated with AI.

 Unlike conventional software, AI systems often rely on large datasets, automated decision-making, third-party models, and evolving technologies that create unique legal, operational, and reputational risks. Canada does not yet have a comprehensive, standalone private-sector AI statute in force; however, existing laws may already apply to AI use. These include privacy, consumer protection, human rights, contract, employment, cybersecurity, and sector-specific laws. In addition, proposed federal privacy reform, including Bill C-36, would, if enacted, introduce new privacy obligations relevant to automated decision systems and the management of personal information.

Before signing your next AI software agreement, careful consideration should be given to the following seven questions to avoid some of the common pitfalls businesses make when negotiating their agreements. 

 1. What Happens to the Data You Put Into the AI Tool? 

 This is often the most important question yet is easily overlooked. 

 Many AI tools function by processing prompts, documents, emails, customer records, contracts, code, or other information provided by users. Depending on the contract, the vendor may have rights to retain, analyze, or use that information beyond simply providing the service. 

 Key questions to ask include:  

• Does the customer retain ownership of all uploaded data? 
• Can the data be shared with subcontractors or affiliates of the vendor? 
• How long is data retained? 
• Is the data deleted upon termination? 

 For businesses handling confidential information, trade secrets, client information, or personal information, these provisions can create significant risk. 

 Practical Tip: Require clear contractual language confirming that your organization retains ownership of its data and limiting the vendor's use of that data to providing the contracted services. Understand what data types (inputs, outputs, training data, etc.) apply to determine if personal information is involved. This may trigger privacy law compliance requirements and may require negotiation of additional agreements. In addition, don't assume a vendor's published privacy policy provides sufficient protection. A vendor's commitment to privacy should be reflected in the contract, not just on its website. 

 2. Can the Vendor Use Your Data to Train AI Models? 

 It may come as a surprise to learn that not all AI products treat customer data the same way. 

 Some AI providers permit customer data to be used to train or improve machine learning models. Others offer an "opt-out" mechanism. Enterprise products often prohibit model training entirely, but that protection should never be assumed. 

 As AI regulation continues to evolve, regulators are increasingly focused on transparency regarding automated systems and the use of personal information in AI environments.  

 Practical Tip: If the AI system will process confidential, sensitive, personal, or customer information, negotiate an express prohibition on using your prompts, uploaded files, outputs, metadata, logs, or other customer data for model training, testing, benchmarking, analytics, or product development unless explicitly approved in writing. 

 3. Who Is Responsible If the AI Gets It Wrong? 

 Traditional software is often designed to perform defined functions in relatively predictable ways. AI systems, particularly generative AI tools, may produce variable or probabilistic outputs, including outputs that appear confident but are inaccurate. 

 Generative AI tools can: 

• Produce inaccurate information. 
• Create misleading summaries. 
• Generate defective code. 
• Make inappropriate recommendations. 
• Hallucinate facts. 

 Most vendors attempt to transfer this risk to customers through broad disclaimers stating that outputs are provided "as is" and should not be relied upon without independent verification. 

 While that may be reasonable in some circumstances, businesses should understand exactly where responsibility sits before deploying AI in critical workflows. 

 Practical Tip: Vendors will commonly resist liability for all outputs. Where AI outputs will be used in material workflows, customers should consider whether the agreement includes appropriate performance commitments, documentation, human review expectations, disclaimers, escalation rights, and remedies if the tool materially fails to perform as described. 

 4. Does the Vendor Provide Meaningful Cybersecurity Commitments? 

 AI systems often process large volumes of information and may connect to numerous internal systems. 

 Businesses should carefully review:  

• Security standards
• Encryption requirements 
• Incident response obligations 
• Breach notification timelines 
• Audit rights 
• Subprocessor controls 

 Federal policymakers continue to place increased emphasis on cybersecurity, digital resilience, and protection of sensitive information. Businesses can expect growing regulatory attention in this area.  

 Practical Tip: If the platform will process sensitive information, ask for security documentation, subprocessor lists, data flow information, and third-party audit reports where available. The agreement should address safeguards, access controls, encryption, logging, incident response, breach notification timelines, cooperation obligations, and appropriate indemnities for privacy or security incidents.   

5. Are You Receiving Appropriate Intellectual Property Protections? 

 Many businesses assume AI-generated outputs automatically belong to them. 

 The reality is often more complicated. 

In some cases, the more practical question may not be whether the customer ‘owns’ the output in an absolute sense, but whether the customer has enough contractual rights to use, modify, commercialize, and provide the output to its customers, and whether the vendor stands behind those rights.

 Questions to consider include:  

• Who owns outputs generated using the platform? 
• Can the vendor reproduce those outputs? 
• Does the vendor provide intellectual property indemnities? 
• What happens if a third party alleges copyright infringement? 
• Does the vendor have necessary rights and licenses to use training data and third-party technology? Does the AI solution comply with applicable laws? 

 These issues remain an active area of legal and commercial development. 

 For organizations using AI-generated content in marketing, software development, product design, or customer deliverables, intellectual property provisions deserve careful review. 

 Practical Tip: Confirm that your organization receives sufficient rights to use outputs for its intended business purposes and assess whether contractual indemnity protection is available. Customers should be wary of broad “as-is” disclaimers, especially where vendor materials suggest that outputs are suitable for commercial use, software development, marketing, customer deliverables, or other business-critical purposes. If vendor marketing materials suggest certain claims, consider including performance metrics in the agreement with a clear termination mechanism if targets aren’t met. 

6. What Happens If Privacy Laws Change? 

Privacy and AI regulation are evolving rapidly. 

The federal government recently introduced Bill C-36, which remains proposed legislation. If enacted, it would materially overhaul Canada's private-sector privacy framework and introduce new requirements relevant to privacy management programs, automated decision systems, service providers, cross-border transfers, and individual rights. 

Businesses purchasing AI solutions today may still be using those systems years from now under a very different regulatory environment.

That being said, it’s imperative to note that AI tools are already subject to existing privacy obligations where they collect, use, or disclose personal information. The Office of the Privacy Commissioner of Canada and provincial counterparts have stated that generative AI does not operate outside existing legislative frameworks and that organizations developing, providing, or using generative AI must comply with applicable Canadian privacy laws. 

Practical Tip: Consider including contractual provisions requiring the vendor to maintain compliance with applicable privacy laws and cooperate with future regulatory requirements. 

7. What Is Your Exit Strategy? 

 A common mistake made by organizations is that they get so caught up on AI implementation that termination gets overlooked. 

 Before signing, consider the following:  

• Can you export your data? 
• In what format? 
• How much notice is required to terminate your contract? 
• Are there early termination fees? 
• How long does the vendor retain data after termination? 
• What transition assistance is provided during migration? 

 Vendor lock-in can become particularly problematic when AI tools are integrated deeply into business processes. 

Practical Tip: Ensure the agreement provides workable data export rights and a clear offboarding process. 

The Governance Question Every Board Should Be Asking 

 Increasingly, AI procurement is not just an IT decision. 

 It is also:  

• a privacy issue 
• a cybersecurity issue 
• a contractual risk issue 
• a governance issue 
• a reputational issue 

 Boards and management teams should understand what AI systems are being used across the organization, what information is being entered into those systems, and what contractual protections are in place. 

 The risk is rarely that an organization adopts AI. 

The risk comes from adopting AI without understanding how the technology fits into the organization's broader legal and risk management framework– that’s the question every board needs to address.

 The issues discussed above are intended to highlight some of the most common contractual and risk-management considerations associated with AI procurement. Depending on how an AI solution is used, additional considerations may arise relating to employment practices, human rights, consumer protection, industry-specific regulation, procurement obligations, professional liability, data governance, or other areas of law. Organizations should evaluate AI tools in the context of their specific business, industry, and risk profile.

Bottom Line

 AI tools can create significant value for businesses. Their proper implementation and adoption can improve productivity, accelerate decision-making, and unlock new opportunities for growth. 

 To mitigate risks associated with AI tools, businesses should approach AI procurement with the same diligence they would apply to a significant commercial relationship. It’s important to conduct due diligence, including trial runs, on vendors before the purchase  of any AI tool, whether as a paid service or even as a trial run. 

 Before signing an AI software agreement, take the time to:  

• confirm ownership and usage rights for inputs, outputs, and related materials, including any restrictions on commercial use;  
• review the defined terms to ensure they are not ambiguous; 
• obtain clear indemnities from the vendor and pay close attention to any exclusions;  
• ensure privacy obligations are met and that the contract addresses data privacy and security (including incident response and notice obligations);  
• carefully review liability provisions and any limits imposed;  
• keep an eye on changes to AI regulation and legislation that may be forthcoming; and  
• implement internal AI governance processes such as policies, training, and oversight.  

 Careful negotiation of these clauses at the outset may prevent substantial legal, operational, and reputational issues later. 

 The organizations that gain the greatest competitive advantage from AI will not necessarily be those that adopt it first; they’ll be the ones that adopt it thoughtfully. 

 Thinking About Bringing AI Into Your Business?  

AI is evolving quickly, and many organizations are adopting new tools without fully understanding the contractual, privacy, intellectual property, and cybersecurity implications. 

Our Corporate, Commercial, Privacy, and Technology lawyers regularly advise businesses on software procurement, SaaS agreements, data governance, and emerging technology issues. We can help you assess risks, negotiate key contract terms, and implement practical safeguards that support your business objectives. 

Share

Print