AI vendor contracts and procurement

The vendor’s standard terms are written to protect the vendor. On the risks that matter most — discrimination, data protection, training data — they generally leave the exposure with you.

The eleven things to ask for

A checklist you can use before signature, whether or not you instruct us.

1. Training data lawfulness and provenance. What was the model trained on, and on what lawful basis? A warranty that the training data was lawfully obtained and processed is the single most valuable term you can ask for — and the one most likely to be resisted, which tells you something.

2. Bias testing evidence. Not a statement that testing was done. The results, the methodology, and the population it was tested on.

3. Audit rights. The right to inspect, or to receive the outputs of independent assessment, particularly where you are a deployer with your own obligations.

4. Performance warranties. What the system is warranted to do, and what happens when it does not. “As is” is common and is not acceptable for a system making decisions about people.

5. Explainability support. If you must give meaningful information about the logic involved, the vendor has to be contractually obliged to help you do it. Many contracts are silent, which leaves you with a legal obligation you cannot discharge.

6. Indemnities. For intellectual property infringement arising from the model or its outputs, for data protection breaches caused by the vendor, and — where you can get it — for discrimination claims arising from the system’s design.

7. Liability caps. Usually set at a multiple of fees, which bears no relation to an uncapped discrimination claim across thousands of applicants. Push for carve-outs on the risks that matter.

8. Model updates and change control. Models change. A system that behaved acceptably at procurement can behave differently after an update. You need notice, and ideally the right to test before the change takes effect.

9. Your data and whether it trains their model. Frequently buried in the terms. If your inputs — candidate data, customer data, internal documents — are used to train the vendor’s model, that has consequences you need to have decided on deliberately.

10. Data protection terms. Proper processor terms, sub-processor controls, international transfer arrangements, security obligations and breach notification.

11. Exit and portability. What you get back, in what format, and what happens to your data and any model trained on it when the contract ends.

The two that matter most

If you can only negotiate two, negotiate training data lawfulness and liability for discrimination outcomes.

Those are the risks with no ceiling. Everything else is a commercial allocation of a quantifiable exposure; those two can be open-ended, and they are the ones standard terms are most careful to leave with you.

Procurement, not just contracts

The contract is the last step. Before it:

Define what the system will actually be used for, because that determines the regulatory classification and therefore the obligations.

Ask the vendor the questions above during selection, not after. A vendor who will not answer during a competitive process will certainly not answer afterwards.

Run a data protection impact assessment where required — which for AI making decisions about people usually is.

Record the reasoning. Why this system, what you asked, what you were told, what you tested. Under an obligation to justify, evidence of a considered process is worth a great deal.

What we do

Review the vendor’s terms against the risks that actually matter for your use case. Draft the questions to put during procurement. Negotiate the terms worth negotiating, and tell you which are not worth the time. And advise on the classification question first, because it determines everything else.

What it costs

A vendor contract review against a specific agreement is a fixed fee, quoted before we begin. Negotiation is hourly at £400 plus VAT.

Questions

Questions businesses ask us

The vendor says their terms are non-negotiable. Is that true?

Sometimes, particularly with large platforms. Where it is, the question becomes whether the residual risk is acceptable and what you do internally to manage it — which is a decision to take deliberately rather than by default.

Can we get an indemnity for discrimination claims?

Rarely in full, but it is worth asking, and what you are told is informative. A vendor confident in their bias testing responds differently from one that is not.

Does our data train their model?

Check. It is frequently buried in the terms, and the answer has consequences for confidentiality, data protection and competitive position.

What happens when they update the model?

Often nothing contractual, which is the problem. Ask for notice of material changes and, if you can, the right to test before they take effect.

Is a contract review worth it?

On a system making decisions about people, yes. The exposure is uncapped and the review is a fixed fee.

The hub

AI law →

Also in this area

AI in recruitment and automated decisions →

Also in this area

Does the EU AI Act apply to your UK business? →

Start with a conversation

A free 20-minute call. Tell us what has happened and we will tell you whether we can help, what it would involve and roughly what it would cost.

No charge

A free 20-minute call

Tell us what has happened and we will tell you whether we can help, what it would involve and roughly what it would cost. No advice is given on this call and there is no charge for it.

£350 plus VAT

A paid strategy session

One hour with a partner, followed by a written summary of your position and options. For people who want proper advice without instructing a firm yet. Credited in full against your fees if you go on to instruct us.

Or reach us directly

0207 112 8818

WhatsApp +44 7476 045967

[email protected]

We answer enquiries the same working day.