Information Security

Our company is going to put a policy and controls in place for the third-parties that we work with that are utilizing AI. We want to get an understanding of how they are utilizing AI, but from my research most companies are putting certain controls in place and adding specific contract language. I was curious if anyone had examples of the contract language they are using to control their third-parties use of AI. I plan to develop a contract addendum to send to any of our third-parties that implement AI. Any help would be greatly appreciated! 

Rob Urich

Senior ERM Analyst 

Following as I am interested in this as well. 

Following...

Hi There,

As the landscape around artificial intelligence continues to evolve, AI disclosure clauses will become more prevalent as we are seeing more vendors use AI in creating their deliverables. We may also see a trend in the increase of requests from clients for an AI addendum to be added to their contracts that contain verbiage addressing data accuracy, transparency and bias prevention.

Here are some things you should consider when creating your AI Disclosure Addendum:

• Make sure your service provider is contractually obligated to inform and update customers of AI usage as part of the products and services they provide. This should include the purpose of and how your service provide will use AI in creating the deliverables.
• Include expectations for performance standards, such as:
  • Providers use of AI will not degrade contractual standards of performance of the services;
  • AI will produce representative and accurate outputs; and
  • AI will not develop inappropriate or harmful behaviors.
• Clearly define who is responsible for ensuring an AI tool does not violate applicable laws as this could fall on the party that provides the dataset(s) that train the AI tool. Keep in mind if an AI tool is used to collect or process personally identifiable information, then it is crucial the data is handled in accordance with relevant regulations and laws.
• Contractual allocation of ownership of intellectual property rights since each party will expect the other to be responsible for the IPR it contributes, typically through indemnification against third party claims of infringement.
• Consider requiring that the vendor provides a detailed explanation of the specific AI algorithms and techniques used in producing the deliverables. This should include potential limitations or biases inherent in the AI system. You may want the vendor to comply with an international standard on preventing bias, like ISO/IEC TR 24027:2021.
  

In addition, here are some helpful educational blogs related to AI:

• AI and Vendor Contracts: What You Need to Do to Reduce Risks
• AI 101: A Primer for Third-Party Risk Managers
• Mitigating AI Vendor Risk With Questionnaires
• How to Manage Evolving Third-Party AI Risks
  
  

These are a few suggestions when AI tools are used in providing products or services. I would love to hear from others in the community on how they are addressing the evolving use of AI technology by their third-party providers.