Engaging with an Artificial Intelligence (“AI”) service provider entails navigating a complex legal landscape. To develop a successful partnership, organizations must carefully evaluate legal considerations prior to signing a contract. This article covers the essential best practices for contracting with AI service providers.
AI companies and the services they provide are relatively new to the business world. Thus, it is imperative to conduct comprehensive due diligence on the AI service provider. This may include reviewing the company’s status on the California Secretary of State website to ensure good standing, reviewing publicly available reviews, asking for references from other customers, determining how long they have been in business and how long the product has been live, and making inquiries into the company’s financial health. Getting a sense of the overall health of the company can be key to avoiding a relationship with an unstable or unreliable entity.
It is key to understand what type of data will need to be shared with the company in order for it to provide the offered services. Once it is determined what data will be shared, an assessment must be made as to what legal restrictions or protections exist for that data. For example, does the data include employee information, pupil records, or non-public business information? If any confidential information will be shared, the contract must clearly state each party’s obligations regarding compliance with all applicable laws. It should also clearly delineate legal responsibility for a breach of any confidential information.
The contract should also set forth who holds ownership of the data (both input and output). Typically, ownership of data should remain with the entity receiving the AI services. However, AI companies may request to retain aggregated anonymized data or data in a form that it can utilize for its own benefit. These provisions should be carefully scrutinized to avoid the AI service provider utilizing the data in a manner that violates any applicable privacy laws or organization policies.
A contract with an AI provider should require the provider to be liable in the event of a data breach. It should also specify the provider’s specific obligations under data breach laws and notification requirements so it is clear who must take immediate steps in the event of a breach of confidential information. A contract should clearly state the repercussions of any breach of the data obligations or other breach of the contract. It is also prudent to require the company to indemnify for any third party claims that may arise from their AI services. These provisions are critical to reducing potential fiscal impacts in the event something goes wrong with the services.
A strong termination provision can provide your organization with significant leverage throughout the term of the services. If drafted correctly, it can allow termination if the AI provider’s services are falling short of expectations, not meeting the desired needs, or if the AI provider is not delivering the services in accordance with the contract. Termination provisions can also protect your organization in the event the AI company abruptly cancels by requiring notice and reimbursement requirements.
Another element to include in a termination provision is how the data will be handled at the conclusion of the relationship. It should articulate any return or destruction of data and the timelines for the action.
Contracting with an AI service provider requires careful consideration of a number of variables. By conducting due diligence, understanding data protection and ownership rights, establishing liability obligations, and anticipating termination, organizations can set themselves up for a successful relationship. This list is not exhaustive however and there are other important factors that should be considered, especially depending on the type of AI services being provided. Engaging legal counsel to assist with reviewing AI service contracts will mitigate risk and ensure the agreement is tailored to the specific needs of your organization.