AI and Contract Law: Managing AI related issues and risks

The terms and conditions agreed between suppliers and customers for the development and use of AI systems to some extent reflect current drafting practice in respect of other business to business software contracts but there are key AI specific issues to consider.

What should contracts for AI systems cover?

It is essential that the contract not only clearly articulates the scope of the products and services being provided but also reflects the key stakeholders’ expectations of the benefits of procuring the AI solution, the desired outcomes, and the responsibilities of each party involved, including allocation of liability. Parties should consider including provisions related to the development, implementation, maintenance, training and support of the AI system, as well as project goals, milestones, and deliverables, in order to facilitate effective performance management.

Key contractual issues to consider in agreements for AI systems

• Bespoke, off the shelf or modified off the shelf AI solution – Customers need to consider whether the off the shelf AI models available in the market are sufficient for their intended purposes or if a bespoke product trained on a specific set of data determined by the customer is necessary. This decision will have obvious cost consequences for the customer.
• Data - The contract should specify who owns or is responsible for the data used in the AI system, rights of use for the foundation model and ownership of outputs and outline protocols for data access, storage, security, and compliance with data protection laws.
• Open source and multi-user models – Users of services that interact with open source and multi-user AI models must check the terms and conditions of these models as they may require warranties as to the provenance of the data input into the model and permit use of this data for “service improvement” or for model training. This may be a concern for businesses if the data inputs include third party data that a customer may not have the right to permit the model owner to process or learn from.
• Continuing supplier obligations – there will also have to be consideration of the responsibility suppliers will have to update models or to remove erroneous data. This will depend on whether a customer has decided to trust a supplier model or train its own and retain post creative processes to validate outcomes and output data.
• Consent – Is consent required for use of AI? What due diligence, testing and risk assessments are you doing
• Use cases and objectives – What are your use cases and business reasons? That may dictate what terms are most significant. While traditional software agreements may focus on functionality and uptime, AI services contracts should address governance, accuracy, training, and learning capabilities. If the AI is designed to bring about a particular result for the customer, it should consider how to define a successful outcome using measurable indicators to track performance and how this can realistically be achieved based on who is responsible for the data, model and governance.
• Third party rights – What third party AI is being used and how much control does your supplier have over it?
• Risk Assessment – It is likely that suppliers of AI technology will have to provide substantial information on their products, in particular in relation to the key principles of (i) safety, security and robustness; and (ii) transparency and explainability. Businesses procuring AI products or services will need this information to evaluate their risk. Parties must consider potential risks such as algorithmic biases, erroneous outcomes and in the context of GenAI “hallucinations”, or the system’s inability to adapt to changing circumstances.
• Circuit breakers / kill switches – depending on the usage of the AI system, it may be important to discuss and agree the requirements for any circuit-breaker or “kill switch” which the customer can trigger where the actions taken by the AI system risk becoming prejudicial to the customer’s business. The customer should consider whether the supplier is required to maintain earlier iterations of the AI system in these circumstances. Suppliers will look to pass the costs of maintaining such earlier iterations on to their customers, as such customers will need to assess the value in maintaining these earlier iterations.

How should contracts for AI systems address risk allocation and liability?

Having considered the key risks arising from the actual service or model to be deployed in the light of appropriate due diligence and consideration of the risk assessments, the contract should address responsibility for legal issues or liabilities arising. This may require specialist input as the cause of any liability may be complicated given the dynamic relationship between the data and AI model and who is responsible for overall governance and supervision.

This risk allocation will vary depending on the nature of the AI system (is it bespoke or a one-to-many service), any specific regulatory considerations, the level of spend by the customer and the customer’s expectations in terms of outcomes. Liability caps, disclaimers and specific indemnities will be focal points of negotiations, as they commonly are when negotiating traditional software agreements.

What’s next for AI and Contract Law?

The key for contract drafting is to keep pace with, and be flexible enough to address, the rapidly developing AI landscape. As the law on areas such as AI and IP and AI liability develop, contracts will need to address changing risk allocations. The ever-increasing technological capabilities of the AI systems themselves make it imperative that security and governance are addressed throughout the supply chain. Contracts must address how the AI system should operate and very importantly what happens if something goes wrong.