Contract Management

Hi All -

Like everyone we are seeing an increase in new (to us) vendors that use AI in their products, and the boilerplate contracts for these products will generally include language about if/how our data is used, is it anonymized, who owns it if it's used to train the model, is it used to train the model, etc. We also have our existing population of legacy vendors, many of whom we know are also incorporating AI into their products, support, etc. 

My question is about how others are dealing with this contractually. Meaning, has anyone taken the approach of drafting language (an AI addendum if you will) that is included by default in any contract where the vendor has access to sensitive information? And if yes, have you asked your existing population of legacy vendors to sign such an addendum (as a change order, amendment, etc.)? Or maybe you are still figuring out what the best approach is? Any insights/comments would be appreciated. 

We have template AI related contract language we use for the next new or renegotiated agreement. our TPRM system tracks usage of AI and includes a flag and place to record contract amendment topics for the next renewal.  The renewal process is how we are addressing legacy agreements that lack appropriate contract language.

Your risk posture may require a more aggressive approach.

Did you seek Legal Counsel for the specific contract language that you use?  

For your TPRM system, is it that you've identified the AI usage from the vendor and then your system does the tracking? 

For renewals - have you been getting pushback or redlines from the contract language?