AI vendor contract review — what to fix before you sign
The AI Act allocates obligations between provider and deployer, but contracts decide who actually carries the cost of meeting them. A standard software agreement was not written for that, and most AI vendor terms still are standard software agreements.
First hour’s on us. No commitment.
Det här får du
- A marked-up contract with the changes that matter, ranked by what they cost you if left alone
- A role and classification check — whether the agreement quietly makes you a provider, and whether the vendor’s classification holds
- Data and IP terms that settle what happens to your inputs and who owns the outputs
- A liability position proportionate to the risk you are actually taking on
- An exit that works, including what you get back and in what format
Hur det fungerar
- Send the contract. First read and a call, free.
- Review, three to ten days depending on complexity.
- Markup and negotiation support, with your commercial team.
Who you’ll work with
Fidan Ibrahimzada, Legal Counsel for AI and technology law, leads this work. She advises companies on AI regulation, data protection and technology contracts, and previously led the legal department of a commercial law firm. She holds an LL.M. in European Business Law from Lund University. Lawgent is Sweden’s first law firm dedicated to AI and EU regulation — meet the team.
The eight things worth checking
1. Who is the provider?
If the agreement lets you put your own name or brand on the system, or contemplates that you will substantially modify it, you may become the provider under the AI Act — with the full high-risk obligation set. This is the single most expensive thing to miss, and it is usually one clause.
2. What is the classification, and who says so?
Ask for the classification and the reasoning, in writing, in the contract. Then ask what happens if it turns out to be wrong. A vendor unwilling to stand behind their own classification is telling you something.
3. Do you get what you need to comply?
As a deployer you must use the system per its instructions, exercise human oversight, monitor it and keep logs. All of that depends on the vendor: current instructions for use, access to logs and confirmation of retention, notification when the system materially changes, and support for your own information duties. If it is not in the contract, you have no right to it.
4. What happens to your inputs?
Whether your prompts, documents and data are used to train or improve the vendor’s models is the question customers most often assume is settled and most often is not. Many vendors offer a setting; the default is frequently not the one you want. Get the answer into the contract, not just the settings page.
5. Who owns the output?
Output ownership, licence scope, and what happens if the output infringes someone else’s rights. Some vendors offer indemnities for IP claims arising from output; the scope and the conditions attached are worth reading closely.
6. Personal data
Controller and processor roles, a data processing agreement that reflects the actual flows, sub-processor control, transfer mechanisms, and deletion — including what deletion means for a model that has already been trained.
7. Performance, and what “wrong” means
AI systems produce confidently incorrect output as a normal operating characteristic. Standard warranties do not address this. What helps: defined accuracy expectations where they can be measured, clear statements about known limitations, and a remedy that is not simply “the software conforms to the documentation”.
8. Exit
What you get back, in what format, over what period, and what the vendor deletes. Fine-tuned models and accumulated configuration are frequently the hardest part, and the least often addressed.
Selling AI rather than buying it
The same list read from the other side is a commercial asset. Vendors whose terms already answer these questions clear procurement faster, particularly with enterprise and regulated buyers. We draft that position too — it is usually cheaper than losing two months per deal.
Vanliga frågor
The vendor says their terms are non-negotiable. Is that true?
Sometimes for standardised products at low value, rarely otherwise. Even where the main agreement is fixed, addenda and configuration commitments are often available. And knowing what you are accepting has value even when you accept it.
How long does a review take?
A standard SaaS agreement with AI features, three to five working days. A bespoke development or fine-tuning arrangement, longer.
We already signed. Is it too late?
No. Renewal is a natural point to revisit, and a review now tells you what risk you are carrying in the meantime — which is worth knowing whether or not you can change it today.
Do you also review contracts with our customers?
Yes. If you build AI into a product you sell, the allocation runs in both directions and should be consistent.
Vad kostar det?
The first read and conversation are free. After that, a fixed price based on the contract and its complexity, agreed before we start.
Where to start
Send the agreement you are closest to signing. That is usually the most useful hour we can spend together, and it costs nothing.