The demo looks great and the price is reasonable. But before your team sends customer information, code, or internal data into an AI tool, check what you actually agreed to.

Key takeaways:

• Check whether the vendor can train on your data, and who owns inputs and outputs.
• Look at confidentiality, security, model changes, and what the AI agent can do.
• Understand liability and what happens to your data when you leave.
• Find every document incorporated by reference, not just the signed PDF.

Someone clicks Start Enterprise Trial. AI software contracts can raise questions ordinary software agreements did not always address as directly. Can the vendor train on your data? Who owns the output? What happens when the underlying model changes? What can the agent do inside your systems? What happens to your information when you cancel? Check these seven things before signing.

1. Can the vendor use your data for training?

Start here. Search the contract and incorporated policies for words like train, improve, develop, model, customer content, input, output, usage data, aggregate, and de-identify. Then answer one simple question:

Can information my business sends to this product be used to train or improve an AI model?

Do not assume the answer. Different vendors, products, APIs, enterprise plans, and consumer plans can have different policies. If your company plans to send confidential or customer information into the tool, this question can be especially important.

2. Who owns the input and output?

Check ownership and usage rights for your prompts, uploaded documents, customer information, AI-generated outputs, and any feedback you provide.

• Do you retain your rights?
• Does the vendor receive a license, and how broad is it?
• Does it continue after you stop using the service?

Do not just search for the word “ownership.” Read the licenses too. An agreement can say “You retain ownership of your content” and then grant the vendor broad rights elsewhere. For an important workflow, understand both pieces.

3. Check confidentiality and security

Imagine your team uses an AI system to analyze contracts, source code, customer records, financial projections, employee information, or strategic plans. AI features do not make ordinary confidentiality and security questions disappear. Ask:

• Who can access the information?
• Where is it processed?
• What subprocessors are involved?
• How are incidents handled?
• What security commitments does the vendor make?
• Does the data you plan to use call for something stronger?

4. What happens when the model changes?

This is unusually important for AI products. The core model behind a service can materially change how the product behaves.

Imagine your business tests an agent for three months and builds an internal workflow around its behavior. Then the vendor replaces the underlying model. Does the contract say anything about significant model changes? Does the vendor give notice? Can important functionality disappear? Does the API version remain available? Can pricing change because a different model is used?

For a casual subscription you may accept that flexibility. For a mission-critical workflow, it deserves more attention.

5. What can the AI agent actually do?

A chatbot might read something and answer. An agent might read email, access Drive, modify a CRM, send a message, update a document, or call another API. So examine both the contract and the technical permissions.

There is a major difference between read email and read, delete, and send email. For consequential actions, keep a human-approval step. The contract cannot compensate for granting an AI system permissions it never needed. See our checklist for connecting an AI agent to Gmail, Slack, or Drive, and AI agent vs chatbot for the difference.

6. Who carries the risk if something goes wrong?

Search for limitation of liability, indemnification, warranty, and disclaimer. Suppose the AI generates incorrect information, creates an infringing output, exposes confidential information, takes an unintended action, or becomes unavailable during a critical workflow. What does the agreement say?

Many software contracts limit vendor liability, which does not automatically make the provision unreasonable. But understand the relationship between the risk your business is taking and the responsibility the vendor is accepting. That matters more as AI moves from helping an employee write to taking actions for the company.

7. What happens when you leave?

People often discover this too late. If you cancel, what happens to your prompts, uploaded files, account data, stored outputs, embeddings, fine-tuned systems, logs, and backups?

Can you export your information? When is it deleted? Does the vendor retain anything? Can you get confirmation of deletion? And if the tool is deeply integrated, how hard is it to move somewhere else?

Use AI to review the AI contract

There is a useful irony here: AI can do the first review of an AI vendor agreement. Upload the agreement and related terms, then ask:

“Does this vendor have permission to train on our inputs or outputs?”

“Identify every provision dealing with customer data, model training, confidentiality, intellectual property, model changes, liability, subprocessors, and termination.”

“Which important AI-specific issue appears to be missing?”

“Identify every document incorporated into this agreement by URL or reference.”

That last one matters, because the rules affecting your use may not all appear in the PDF you signed.

Then verify what the AI tells you, using the steps in how to verify an AI-generated legal document.

A simple AI vendor checklist

Before signing, make sure you can answer seven questions:

1. Can the vendor train on our data?
2. Who owns or can use our inputs and outputs?
3. How is confidential data handled?
4. What happens when the model changes?
5. What actions can the AI take?
6. Who bears the risk when something fails?
7. What happens to our data when we leave?

If you cannot answer one of them, investigate before deploying the tool with sensitive company information. Put the internal rules in writing too, with our AI policy template.

Where DoubleCheck fits

You can use AI to review the contract, but then you are using AI to tell you whether another AI company’s legal terms are acceptable. That is where verification becomes valuable. Bring the vendor agreement, use AI to identify the important provisions, examine relevant sources, and surface questions that deserve attention. If the vendor will access valuable data, operate important systems, or create significant contractual exposure, you can then move it to an independent attorney. You build on top of the AI work instead of throwing it away.

DoubleCheck is built for businesses that start legal work with AI. Bring your question or draft, use an AI-first workflow to understand and verify it, and when professional advice is warranted, you can connect with an independent attorney. Attorneys on DoubleCheck are independent professionals; an attorney-client relationship forms only if an attorney accepts your engagement.

AI reviews → DoubleCheck verifies → attorney steps in when the risk justifies it.

FAQ

What is an AI vendor contract?

It is an agreement governing a business’s use of an AI product or service. It may include an MSA, order form, terms of service, privacy terms, data-processing agreement, API terms, or other documents.

What should I check before buying an AI tool for my company?

At minimum, understand how your data may be used, ownership and licensing of inputs and outputs, confidentiality and security, the AI’s permissions, model changes, liability, and what happens to company data after termination.

Can an AI vendor use my company’s data to train its model?

It depends on the provider, product, plan, contract, and applicable terms. Do not assume. Check the current agreement and policies that apply to your specific account.

Can ChatGPT or Claude review an AI vendor contract?

General-purpose AI can help identify provisions, summarize terms, compare versions, and generate questions. Important conclusions should still be verified, particularly for contracts involving sensitive data or significant exposure.

Should a lawyer review an AI vendor agreement?

Professional review becomes more valuable when the vendor receives sensitive or regulated data, the contract has significant financial value, the AI takes autonomous actions, or the service becomes important to your operations.

---

General information only. This article is not legal, tax, investment, or accounting advice.