AI contracts are no safety net, enterprise buyers are told

AI buyers should not assume a contract will protect their organisation if a service misuses data or causes harm. A Diginomica investigation instead points to specific checks on data use, governance and liability that buyers need to handle in-house.

Watch Desk analysis

What happened

In an article published on 12 October, Diginomica’s Derek du Preez draws on interviews with ten lawyers, vendors, consultants, start-ups and buyers. The central finding is less a magic clause than a procurement reality: organisations need to understand what a provider can do with their data, and build procedures to manage risks they cannot simply sign away.

That means asking whether data is processed only to deliver a service or may also be reused to train or improve models, and whether the same terms cover every feature. One interviewee warns that beta features may have different data terms from a platform’s main service. The article also reports that 65% of surveyed CIOs said AI was receiving the largest share of their new technology investment, while just 3% were very confident their governance was fit for the tools they were deploying; 12% said deployment was outpacing governance.

Why it matters

AI procurement adds questions that familiar software contracts may not answer neatly. Buyers need to distinguish inference, where a model processes data to produce an output, from training, where data is used to adjust or improve a model. They should establish which uses they authorise, whether restrictions apply across features, and what practical policies back up the contract.

Liability is another awkward seam. The article’s interviewees say there is no settled case-law playbook for every situation in which an AI service causes harm. A vendor may resist taking on all the risk, so organisations also need to decide what liability cap they can accept and show they took reasonable steps to manage the system.

Our read

The useful lesson is not “contracts do not matter”. It is that a signed contract cannot do the work of governance. Before buying, map what data goes where, check the terms for individual features, and decide who inside the organisation owns oversight and response when something goes wrong. Paperwork is no substitute for a working process, however satisfying the signature feels.

What to watch

• Whether providers make data-use terms consistent across core and beta features.
• Whether buyers negotiate clearer limits on training, liability and permitted data use.
• Whether organisations strengthen internal oversight as AI deployment spreads.

Discussion spark: Should AI vendors carry more of the liability when their systems cause harm, or should organisations that choose and deploy them remain chiefly responsible?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.