Artificial Intelligence (“AI”) is no longer a future technology. It is now embedded in the software systems that organisations rely on every day. SaaS platforms, analytics engines, HR tools, financial decision systems, medical software and operational platforms increasingly rely on AI functionality in order to generate outputs, automate processes and support decision making.
However, many Master Services Agreements were drafted before artificial intelligence became commercially embedded in software products. As a result, these agreements often do not address how AI is being used within the services being provided. Organisations may therefore be deploying AI enabled systems without any contractual framework governing how that AI operates, how it is trained, or who carries the risk if something goes wrong.
In many existing Master Services Agreements, there is no requirement for the vendor to disclose whether artificial intelligence forms part of the service offering. Customers may therefore be relying on outputs generated by machine learning models without knowing that automated decision making is taking place. At the same time, the agreements frequently fail to regulate whether customer data may be used to train or retrain the vendor’s AI models. If this issue is not addressed contractually, a vendor may use customer data to improve its algorithms without the customer having any visibility or control.
The position becomes even more concerning when liability is considered. Many technology vendors attempt to disclaim responsibility for AI generated outputs. In other words, the software may generate recommendations, classifications or decisions that materially affect business operations, yet the vendor may argue that it is not responsible for the consequences of those outputs.
- From a legal and risk perspective, this raises several important questions:If an AI system generates an incorrect or harmful output, who is responsible for that decision?
- If the system has been trained on third party data and that training data infringes intellectual property rights, who carries the liability for that infringement?
- Is the customer’s own data being used to retrain the model, potentially exposing confidential or regulated information?
- Can a vendor rely on contractual disclaimers to avoid responsibility for automated decisions produced by its system?
- If a regulator investigates how automated decision making occurred, which party is responsible for explaining and justifying the system’s behaviour?
If these issues are not expressly addressed in the contract, the risk frequently sits with the customer organisation.
One practical way to address this emerging risk is through the use of an Artificial Intelligence Contract Addendum. This is a structured contractual schedule that can be incorporated into an existing Master Services Agreement or SaaS contract in order to address the specific legal and operational risks created by AI enabled systems.
An AI Addendum typically introduces protections that require transparency regarding the use of artificial intelligence within the service, restrict the use of customer data for model training, strengthen intellectual property protections and indemnities, and ensure that liability for AI related harm is appropriately allocated between the parties. It can also introduce obligations relating to incident notification, transparency regarding AI related subcontractors, appropriate human oversight mechanisms and cooperation with regulatory enquiries.
Importantly, the addendum integrates into existing agreements without disrupting the commercial terms of the contract. Instead, it introduces targeted provisions designed to ensure that artificial intelligence is deployed within a clear contractual governance framework.
This approach is particularly relevant when procuring AI enabled software, renewing SaaS agreements, implementing AI driven decision tools, contracting with international AI vendors, or deploying systems where automated outputs influence operational or financial decisions.
Artificial intelligence is rapidly becoming embedded in the systems that organisations depend on. The legal frameworks governing those systems must evolve at the same pace.
AI risk should never be accidental. It should be contractually controlled.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
