10 Ideas to Use When Drafting AI Redlines in Your Sell-Side Contracts: Practice Points

Draft your own AI addendum even when you always work off customer paper. Carly's first piece of advice was to build a vendor-side addendum and push it. Creating one forced her team to sit down with product and engineering and work out which no-training clauses they could accept and which warranties they could give, and that legwork makes every later redline faster. Laura made the same argument about templates generally, saying a company that only works off customer paper should still build one because it memorializes what a good outcome looks like. Once you have it, you redline the customer's version to match and paste in language you already approved.

Box the AI terms into a document you can find three years from now. Carly preferred a separate AI addendum over a section buried inside the DPA. Her reasoning was organizational rather than legal, since nothing in the law requires a separate document. She had just pulled a DPA from a deal signed four years earlier and it took no time because it sat as its own exhibit. DPAs are built around personal data, and AI terms usually need to reach broader than that.

Confirm you can actually deliver what you sign. Blaine treated a customer AI addendum the same way he treats any other customer paper. A SaaS company runs one system for many customers, so anything you agree to in one contract has to work across the whole base. Agreeing to something your business does not do today means going back and rebuilding business processes to match. Before signing a strategic deal as is, he walked the obligations through the product team and the data scientists to confirm the company could comply today.

Know what the law requires before you push back on it. Carly anchored her definition of AI in the EU AI Act and went to the statutes to see what they actually demanded. The EU AI Act reserves its deep requirements for high-risk systems, and the Colorado law and the automated decision rules under Article 22 each have their own scope. Her warning to newer lawyers was blunt. The worst thing that can happen in a markup is telling a customer something is not required by law when it is. Laura added that the delta between what the law requires and what you agree to give is what you actually get to negotiate with.

Give explainability without handing over the secret sauce. Customers wanted the logic involved, the training data, and the models sitting underneath the product. Carly walked the line between the confidentiality concern and the explainability some laws require, keeping vendor commitments broad enough to avoid promising away a trade secret. Blaine moved the specifics outside the contract into documentation the customer can review, because getting precise about your logic in the contract turns a product decision into a contractual obligation. Carly's addition was to get your white papers and assessments ready, mark them confidential, and send them, because a lot of what customers want is comfort.

Ask for pre-approval of model providers rather than notice on every change. Blaine did not want a notice obligation that fires every time a model changes. Model support windows run twelve to eighteen months, so a vendor with thousands of customers ends up sending notices at least annually. His fallback was pre-approved consent rights covering the named companies whose models he might use, instead of naming a specific model. That usually gave customers enough comfort that the vendor was not quietly running some unknown open source model.

Treat no-training clauses as an education problem first. The fear driving these clauses comes from generative AI and the worry that customer data resurfaces in somebody else's output. Carly pointed out that plenty of AI vendors are not generative at all, and that using customer data in the model is often the entire value of the service the customer chose them for. Blaine explained what the product actually does and reminded customers that the confidentiality terms they already signed still apply regardless of AI. When a customer holds firm, anonymized and aggregated data can be the middle ground, and the restriction should be scoped to AI use so it does not sweep in support and outage work.

Push back on output warranties that no product can meet. Carly saw bias warranties most often, and she narrowed them to discriminatory bias and violation of law, because bias on its own is far too broad a word. Accuracy warranties were the other standard ask, and no vendor can promise output that is always right. Blaine's answer was that humans make mistakes too, so the standard should not change because software produced the answer. On oversight, both of them put the human in the loop on the customer side, asked the customer to acknowledge responsibility for decisions made with the output, and pushed for testing in lower environments BEFORE anything runs in production.

Tie AI law compliance to applicable law and leave yourself room to cure. An open-ended covenant to comply with AI law reads as all AI law, including high-risk obligations that never applied to your system. Carly called the forward-looking piece the scariest part, since you cannot easily carve out laws that do not exist yet, and she compared it to how privacy law felt when it first arrived. Both speakers built in a meet and confer, a cure period, and an obligation to work through the problem in good faith. Blaine also asked customers for a rep that they would use the product lawfully and as intended, and pushed any termination right down to the affected part of the service.

Keep liability in one place and replace it rather than layer it. Carly called herself a purist on liability and kept the cap in the MSA even when an AI addendum arrived later. When a customer insisted on another super cap, she required an amendment that deleted the existing cap and replaced it in full, rather than leaving a Frankenstein of caps scattered across three documents. Laura made the same case about what she calls littered indemnities, the stray one-sentence indemnity obligations sprinkled through a contract that nobody remembers and that never agree with each other. On outputs, Blaine ran copyright infringement claims through the IP infringement indemnity he already had instead of writing a new AI-specific one.