AI Vendor and SaaS Contracts
We negotiate and draft AI contracts: MSAs, DPAs, output licensing, indemnities, hallucination SLAs and EU model contractual clauses for public and private AI procurement.
What we cover
AI MSA & SOW
Master Service Agreement with AI-specific terms: training, fine-tuning, output, monitoring.
AI DPA
Data Processing Agreement adapted to AI: sub-processors, transfers, retention, training data.
Output licensing
Who owns the output: customer, vendor or co-ownership; usage restrictions.
IP & data indemnities
Indemnities for IP infringement in training and output (OpenAI Copyright Shield-style).
AI SLAs
Availability, accuracy, hallucinations, latency, drift detection.
EU model clauses & procurement
Applying EU model contractual clauses for AI public procurement and AI vendor due diligence.
Applicable legal framework
- §EU model contractual clauses for AI procurement (high-risk and non-high-risk)
- §GDPR — Art. 28 (DPA) and Art. 46 (international transfers)
- §EU AI Act Art. 25 — allocation of responsibilities along the AI value chain
- §DSM Directive for output licensing
- §Romanian Civil Code on contracts and liability
How we work
- 1
Requirements & risk profile
We identify use cases, data involved, regulatory risks and SLA expectations.
- 2
RFP & vendor due diligence
Technical and legal support in vendor selection: AI Act compliance, security, certifications.
- 3
Negotiation & drafting
Drafting or reviewing MSAs, DPAs, technical schedules, model cards.
- 4
Operationalisation
Onboarding, monitoring, reporting and change management.
- 5
Renewals & disputes
Renewal negotiations, non-conformity management, exit and data return.
Frequently asked questions
What is special about an AI contract vs a classic SaaS?
Unique aspects: input/output rights, training on customer data, hallucinations and accuracy, AI Act compliance, allocation of duties between provider and deployer, indemnity for IP infringement in training data.
Must I use EU model clauses for public AI procurement?
The European Commission has published model clauses for high-risk and non-high-risk AI. For contracting authorities, use is strongly recommended; for the private sector they are a useful benchmark.
What should I require in an AI DPA?
Explicit list of sub-processors (including third-party models), clear ban on training on customer data without consent, processing-location guarantees, short prompt retention, audit rights and incident reporting.
Related AI services
Need AI legal advice?
Book an initial consultation about AI law and compliance.