An AI vendor’s right to process information to answer a prompt is different from its right to retain that information, let people review it, or use it to improve a product. The distinction matters before confidential customer files, member records, or secure exam content enter the service.
The contract review should identify the intended use and the permission it requires. A general assurance that the customer owns its data does not answer what the vendor may do with it.
“No training” answers only one question
A product may exclude customer content from model training while retaining prompts and outputs for security, abuse monitoring, support, or legal requirements. Product improvement may refer to a separate use. Different terms may apply to feedback, diagnostic records, or an optional feature.
Consider a firm using a tool to summarize confidential client documents. A no-training commitment may be necessary, but the review also needs to establish who can access the documents, how long they remain available, and whether the firm’s obligations to the client permit the disclosure. The vendor’s willingness to receive them supplies no missing client permission.
Product tiers and settings can change the answer
A public account, enterprise subscription, and API service can have different terms. An organization should not assume a promise describing one product applies to another or to a feature enabled later.
If the use depends on a particular configuration, that configuration becomes part of the approval. A contractual opt-out has limited value if the deployed account does not receive it. Likewise, a right to change data terms should be evaluated against the organization’s ability to detect the change and stop the affected use.
Deletion needs a defined object and a defined limit
Deleting an uploaded file may be different from removing logs, backups, derived records, or content already incorporated into another process. The parties should understand what the deletion commitment reaches and any retained copies or exceptions.
A credentialing body considering live exam items faces a particularly difficult choice: once confidentiality is lost, return of a file may not restore the item’s assessment value. Restricting the use to public or synthetic material may be a more workable option than relying on a remedy after exposure.
Output rights do not establish originality or copyrightability
A vendor may allocate its rights in outputs to the customer or permit commercial use. That does not establish that the output is copyrightable, exclusive, or free of another person’s rights.
The Copyright Office’s report on AI and copyrightability focuses on human authorship. The contractual allocation and the protection available under copyright law are separate analyses. A customer expecting proprietary course materials or exclusive marketing assets needs both.
The remedy should be compared with the likely loss
An indemnity may cover certain infringement claims while excluding the customer’s modifications, combinations, or particular uses. A liability cap may leave a material gap between recovery and the cost of an incident. Security commitments, notice obligations, defense control, exclusions, and caps need to be read together.
No single clause resolves every use. A low-stakes drafting tool and a system acting on customer records warrant different judgments. AI Errors: Who Bears the Business Consequences? addresses accuracy and reliance separately from data permission.
When the terms cannot be negotiated
The choices may be to limit the approved information, restrict the task, use a different tier, select a different product, or decline the proposed use. Those choices can preserve value without assuming that every concern can be solved by requesting another clause.
The result of review should identify what use can proceed, the product and settings on which that conclusion depends, and the information or activities outside that approval. The Technology, AI, and Data Risk Guide connects the contract to those wider decisions.
