AIArtificial intelligence

Contracts with an AI vendor: data, model training and exit

Where does the data go, does it train models, how do you get out and who answers for security? These are the questions to bring to the table with an artificial intelligence vendor, alongside the European rules that apply.

Strategic editorial team 28 September 2026 9 min read

Cover: “The contract with your AI vendor”, Artificial intelligence

In a contract with an artificial intelligence vendor, the decisive clauses cover four topics. The first is what happens to the data, meaning where it is processed, how long it is kept and which sub-processors handle it. The second is whether prompts, documents and responses can be used to train models. The third is how you leave the relationship, taking with you what belongs to the company. The fourth is which security and incident notification commitments the vendor makes. These points should be settled in writing, with your lawyer and data protection officer, before you sign.

Why does the contract matter more than the demo?

The demo shows what the product can do today. The contract sets what will happen to the data and to the service for years. And the service changes under its users’ feet. The main vendors publish model retirement schedules. A version used in production is declared deprecated and, after a notice period, is no longer available. For a company that has tested its responses on that model, this means repeating the tests, revising the instructions and sometimes renegotiating costs, because the next model is priced differently.

A typical scenario. An industrial group uses an assistant to sort technical support requests, after testing it carefully on a particular model. A year later, the vendor announces that the model will be retired, with ninety days’ notice, in the middle of peak season. The contract says nothing about notice periods, testing the replacement or the cost of switching. The migration is rushed, and for weeks requests are routed less accurately. So a contract must say how future changes will be communicated, with how much notice, and what options you have to test alternatives or to withdraw.

If you have already read the three questions to ask before signing an AI project, this is the next step. It is about the clauses.

Where does the data go, and who processes it?

When the vendor processes personal data on the company’s behalf, the GDPR requires a contract with specific content (Article 28). It must provide for processing only on documented instructions and for confidentiality obligations on staff. It must also cover security measures, sub-processors only with authorisation, deletion or return of the data at the end of the service, and cooperation with audits. That is the minimum. An artificial intelligence service calls for a few more questions.

Where does the processing take place? The question is not just where the data is stored, but where the model runs. Microsoft, for example, states that traffic from European users of its office assistant stays within its EU Data Boundary. But a page updated in August 2026 specifies that models provided by Anthropic as a sub-processor are currently excluded from that boundary. So the right question is which models are used, who runs them and which setting changes the route the data takes.
Which sub-processors, and how much notice of changes? The list should be attached to the contract and kept up to date, with the right to object to additions.
On what basis is data transferred outside the Union? For the United States, the current basis is the adequacy decision on the Data Privacy Framework. The General Court of the European Union upheld it on 3 September 2025 (case T-553/23), and that judgment has been appealed to the Court of Justice (case C-703/25 P). It is worth knowing which instrument would take over if that basis fell away.
How long are prompts, responses and logs kept? And who at the vendor can read them, even if only to check for abuse?

Are prompts, documents and responses used to train models?

The answer is in the contract, not in the brochure, and it needs to be broken down into five parts.

Training of the vendor’s general models. Anthropic’s commercial terms, for example, state that the vendor may not train models on customer content. Microsoft states that prompts, responses and data accessed by its assistant are not used to train its foundation models.
User feedback. Microsoft specifies that optional feedback may be used to improve its services, though not to train foundation models. You need to understand it and, if necessary, have the administrator switch it off.
Technical and usage data. Find out what is collected, for how long and for what purpose.
Models fine-tuned for the company. Find out who owns them, whether they can be reused for other customers and what happens at the end of the contract.
Ownership of outputs. Anthropic’s commercial terms assign the rights in outputs to the customer. Microsoft states that it does not claim ownership of them. Other vendors use different wording, and the difference matters when outputs become documents, code or published text.

How do you exit the contract?

The exit is written at the start, while the relationship is good. List the assets to be returned. These are uploaded documents, configurations, instructions and prompt templates, logs and, if needed, conversation history, together with the format in which they will arrive. Then set out the timing, the costs, the assistance during the transition and written confirmation of deletion.

Since 12 September 2025, the Data Act, Regulation (EU) 2023/2854, has set rules for switching between data processing services, including cloud services. The contract must allow you to move to another provider, or to bring the data back onto your own systems. The maximum notice period is two months, and the transition period should not normally exceed 30 days. The contract must also state which data and digital assets can be exported. Until 12 January 2027, the provider may charge only reduced switching costs that are directly linked to the switch. From that date switching charges are no longer allowed, although early termination penalties remain possible. The “digital omnibus” package presented by the European Commission in November 2025 proposes some adjustments to these rules, which are still under discussion. Your lawyer will check the text in force at the time of signing.

One technical question completes the picture. If the document index is built in a proprietary format, it must be possible to rebuild it elsewhere from the source documents, which remain the company’s property.

Which security commitments should you ask for?

Measures that are described, not just declared, as Article 32 of the GDPR requires, with the reports of any independent audits and their scope.
Incident notification. The GDPR requires the processor to notify the controller without undue delay (Article 33). The contract can set precise timings and content for that notice.
Defences against hidden instructions, and the tests that check them. This risk is specific to AI assistants, and our in-depth piece on prompt injection and poisoned documents describes it.
Controls for the administrator. These include permissions, logs that can be consulted, configurable retention and the option to switch off individual features.
The supply chain. For organisations covered by NIS2, the EU directive on network and information security, supply chain security is one of the required risk management measures (Article 21). The AI vendor’s answers become part of that work.

Who does what under the AI Act?

The AI Act, the European regulation on artificial intelligence, distinguishes the provider, which develops the system and places it on the market, from the deployer, meaning the organisation that uses it in its own activities. Obligations depend on the role and on the level of risk. Since 2 August 2026, the transparency rules have applied, such as the duty to let people know they are interacting with an AI system. For the high-risk systems listed in Annex III, the main obligations will apply from 2 December 2027, following the amendments made by Regulation (EU) 2026/1744. The contract must say who prepares the instructions for use, who keeps the logs and who informs users.

A good reference point, even for private companies, is the model contractual clauses for the procurement of AI systems. They were updated on 5 March 2025 by the community of practice on the public procurement of AI, run with the support of the European Commission. There is a full version for high-risk systems and a simplified one for other systems. They are designed for public administrations and are not binding, but they offer an orderly list of the topics to cover.

The questions to bring to the table

Topic	Question	Where to look for the answer
Processing	Who is the controller, who is the processor, and on what instructions?	Data processing agreement
Location	Where is the data stored and processed, models included?	Technical annex, list of sub-processors
Training	Are content, feedback and usage data used to train models?	Commercial terms, service documentation
Retention	How long are prompts, responses and logs kept?	Technical annex, administrator settings
Exit	What can be exported, in what format, with what timing and at what cost?	Termination and migration clauses
Models	With how much notice are they changed or retired?	Terms of service
Security	Which measures, which audits, which notification times?	Security annex, data processing agreement
Liability	Who answers for errors, copyright infringements and AI Act obligations?	Warranties and limitations of liability

In brief

Models and terms change over time. The contract must provide for notice, tests of replacement models and the option to withdraw.
The processing location, the models and the sub-processors must be written down, because a configuration setting can change the route the data takes.
The exclusion from training must cover content, feedback, usage data and fine-tuned models.
The exit is designed at the start. It covers the assets to return, formats, timing, costs and deletion. For cloud services, the Data Act sets precise rules.
Security commitments and the roles set by the AI Act are assigned in writing.

Frequently asked questions

Can the big vendors’ terms be negotiated?

Often only a little, especially for modest volumes. In that case the choice shifts to the plan and the configuration. You pick the offer with suitable terms, document the settings and keep copies of the versions of the terms you accepted.

Is the phrase “we do not train models on your data” enough?

No. You need to check what “your data” covers. Does it include feedback and usage data? Does it also apply to sub-processors? Can the vendor change it with a simple notice?

Is the data processing agreement enough?

It is necessary, but it covers personal data. Trade secrets, technical documents and commercial information need confidentiality and usage clauses that go beyond the GDPR.

What should you ask for in a custom project?

Ask for ownership of the code, the instructions, the configurations and any fine-tuned models. Ask also for the documentation another vendor would need to take over without starting from scratch.

Reading proposals and contracts before signature, and delivering a written document that lists the points to clarify, is our second opinion on AI projects and vendors service. In that work we do not propose products of our own. The assessment stays separate from the sale.

Sources

Consulted on 16 September 2026.

Find out moreArtificial intelligence for businessesArtificial intelligence built into the systems your company already uses. We choose the right processes, connect the data, and settle security and rules first.