News

How to draft an AIaaS contract? A Guide to digital contracts

Artificial Intelligence as a Service (‘AIaaS’) refers to the outsourcing of Artificial Intelligence (‘AI’) tools and capabilities from third-party vendors to businesses. This model allows companies to implement AI solutions without the need to invest heavily in the development and maintenance of AI technology in-house. AIaaS encompasses various types of services, such as bots and virtual assistants, machine learning frameworks. Basically, it would have some similar characteristics with SaaS, IaaS and PaaS contracts, which are more explored. In this article, we look at the specifics of AIaaS where the provider or user is located in the European Union or where EU regulation applies.

Key Issues

So far as it borrows elements of a provision of services agreement the attention shall be kept on the quality and scope of the provided services that can be regulated through a Service Level Agreement (‘SLA’). Drafting SLA involves specifying quality of service delivery by AI-vendor to the contractor (receiver of the services), performance metrics and remedies. Below are the key elements that are beneficial to be mentioned: - clear definition of the AI services provided, including the scope, capabilities, and any limitations (description, subject and aims of the contractor), the territory and probably the sphere (health, marketing, consumer support, etc.);

• measuring of the performance: it is better to establish a concrete performance benchmarks like response time or volume of the reply, accuracy (no bias answer), correction of the answer, references to the sources, quantity of mistakes, etc.;
• continuality of the service or acceptable downtime (and time for maintenance and technical work);
• call center or support services: are they free of charge (basically or only in some concrete tariffs), would the customer support be individual and, if yes, through which channel (telephone, message support), or would it be a bot support, human support or a manual located on the web-site. Would there be an individual and prompt support in urgent cases (when the program went down or inaccessible). Response time for routine and extreme matters support, liability for non-compliance with the support obligations (or possibility to be switched on to another route of support);
• remedies for non-compliance with the SLA, so far as the exit from the agreement would likely not be an effective option in case of single time failure, it is wise to negotiate price reduction for the upcoming month payment, probably with a greed of quality, say 2% non-compliance – 7% discount, 5% non-compliance – 15% discount, etc. Alternatively, there could be a loss definition mechanism;
• frequency of review of the quality and scope of AI-services in concrete sector (and satisfaction level of the contractor) might be a pivotal term, since the technology is constantly and rapidly developing, and a 2-year term for re-considering of services description, quality level and other characteristics may be a business-killing clause for a contractor. It is recommended to have short-term for revision of SLA (e.g. 6 months), and, if possible, also a procedure of adjustment or re-negotiation of terms initiated by the contractor at any time. If there is a new technical breakthrough it may be necessary to adjust performance metrics or terminate agreement in case the present AI-vendor is not capable to deliver such new service;
• escalation procedures and how the conflict would be handled (until it comes to the court) might be referenced in the body of a Master Agreement, instead of SLA, but could be included in SLA also.

Master Agreement

In terms of specific of what AI is, and how it generates results based on the previous training and the dataset fed by the exact user to receive a result, a drafter may encounter a number of  difficulties while negotiating such a contract, namely, difficulties in clear definition of final results and its quality, impossibility to freely negotiate and draft the contract from scratch, concerns as to IP rights to results of AI service, liability for harmful or inaccurate outputs of AI, data privacy risks and reversibility issues. However, it is advisable to take into account the following concerns and main legal issues. Major clauses in the Master Agreement (AIaaS) should include the following:

• the parties (vendor, contractor, and, if necessary, other persons to be mentioned),
• services (scope, definition, level, territory),
• price,
• access grant (accounts), use restrictions,
• SLA,
• remedies for failure,
• adjustments,
• escalation procedure,
• reversibility,
• confidentiality and data security,
• IP ownership (a right of final use of the solution),
• testing and acceptance,
• term and termination,
• governing law, risk allocation.

AI-specific features: recommendations for drafting AIaaS clauses

Ip rights: It is advisable to clarify the ownership of IP rights associated with AI-generated output, whether the rights are full or limited, whether they remain with the AI provider or the AI user (AI ownership is currently impossible) or are shared between the two, whether the rights can be transferred (if so, under what conditions, licence agreement, patentability, exclusivity, etc). As there is no clear and globally standardised regulation of AI and its outputs, the intellectual property (IP) rights regime is the most sensitive issue for the parties, and they will have to regulate it by agreement (in the absence of an official legal framework). The parties shall also be aware of the recent adoption of the EU AI Act, so the provisions of the agreement should be aligned with the new regulation (Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence).

Warranties: certain warranties and representations provided by the AI-vendor regarding the quality, performance of legality of the AI and its generated outputs shall be included in the contract for the benefit of the AI-user.

Confidentiality: provisions for keeping any proprietary information of the contractor (and, alternatively, the supplier) secret and undisclosed between the parties during the term of the contract (with a possible obligation to ensure that confidential information is only disclosed to third parties also bound by a confidentiality agreement).

Updates and maintenance clauses should contain undertakings of AI-vendor to maintain sustainability and performance of the AI function, to provide relevant and necessary updates to the user, and to support the functionality of AI and proceeding of the generating powers.

Insurance: an insurance clause may be included to ensure coverage of the liability of the vendor (and/or contractor) in relation to AI outputs and any risks (including claims by end users) in relation to AI-generated outputs that have caused damage or resulted in loss (most likely in the form of loss insurance).

Personal data: provisions on the protection of personal data (in line with the GDPR) need to be included to ensure that the services of AI are provided from the centres located within the EU territory (to ensure a sufficient level of protection and compliance with the regulation). It is advisable to regulate liability for the leakage of personal data, taking into account the high penalties and the obligation to notify on accidents within a short period of time.

Dispute resolution and escalation clause: since going to court may not be the most efficient way to resolve the dispute (time consuming and costly while the company needs to act quickly), the court or arbitration should be mentioned as a last resort. The possible hierarchy could be a discussion (a recorded meeting) between the responsible managers of the supplier and the contractor (or other forms of negotiation, e.g. via email or support service). If a satisfactory decision is not reached, the issue can be escalated to a committee consisting of several representatives (or responsible managers) of both parties, where the compromise is to be found and fixed in the relevant document adapted to AIaaS. If this does not help either, a mediation process may be used. The time for each party to respond shall be fixed, as it is in the user’s interests to fix the problem quickly, and the vendor may be a protracting party. In this light, limitation of overall time for dispute procedure would be useful (e.g. 20 calendar days) upon which an unsettled dispute may be submitted to arbitration (which is a preferable option before litigation, as a faster track, but it would cost more for a company). 

Termination: the contract shall include the clause specifying the conditions under which either party may terminate the agreement and, preferably, also a roadmap of actions required for termination with details of the consequences of termination. Since the business of the contractor may become very much dependent on the use of AI service of the vendor (or there is a lack of alternative vendors) it is important to limit grounds of termination on the part of the vendor, which generally might be only non-payment on the side of a contractor (several consecutive non-payments or 90-days overdue). The official written notification procedure shall be included in the contract. The contractor shall specify the exact information to which it is entitled after the termination of the AIaaS (on which resource the backup data would be stored and for how long, all technical details). It would be better for the contractor to ask for a short period of notice to terminate the contract, with reasons such as non-compliance with SLAs, security breaches, prolonged unavailability of the AI, obsolescence of the AI, failure to meet the contractor's stated objectives, etc. A payment settlement procedure must be described so that the contractor does not have a debit or credit balance due to the supplier after termination of the contract.

Exit: the exit or reversibility clause, which is related to the termination clause above, should contain more technical details on how the data will be transferred (to which storage/hosting, how long it will be accessible), what data and results of the AI service will be returned, how the AI vendor will destroy the data in its possession after the termination of the contract, who is a responsible person on behalf of the vendor, time limits, IP-related issues. It is advisable to mention whether the contractor wants the data to be transferred directly from the previous AI provider to a new AI provider, to ensure a continuous and uninterrupted process for the contractor. The exit process is a more technical aspect, but can be critical to business continuity, especially if the contractor is heavily reliant on AI services. If the exit conditions are breached by the supplier, a termination consequence would not be an effective measure, so there is room for negotiating high penalties.

Amendments: amendments and review of the Master Agreement and SLA should also be considered by a lawyer. It is better to provide a short period for review of the agreement with automatic renewal if there is no 30 days written notice to terminate the agreement. As technology evolves rapidly, a 3-year contract may be too long for the AI sector, so 1 year with 6-month adjustments would be optimal. A simple procedure for operational changes would be an advantage. In the short term, there should be a quick and consensual procedure to respond to the changing landscape, both technically and legally.

Price: the most likely option of price would be monthly prepayments, in which case it is important to note the mechanism for returning overdue credit in the event of early termination or non-compliance with the SLA (as well as the discount set off against future payments). A lump sum is also possible. A benchmark clause based on the cost of competitors' services may be advisable in order to adjust the price to the market price with a fluctuation of up to 10%.

Legal compliance and data protection, AI ethics: in order not to violate relevant rules or data protection regulations, it is necessary to ensure that the AI provider complies with all applicable rules and regulations when processing the data and delivering results (outputs, so that there is no illegal content, unacceptable data or suggestions, etc.). This can be done through a compliance clause. The liability for non-compliance must remain with the AI provider, and there must be a complaint mechanism for a contractor to deal with illegal outputs (or outputs with errors). The AI vendor should comply with European regulations (if the contractor is located in Europe), and the responsibility for tracking changes to such regulations and updating them should be with the vendor, not the contractor.

Remedies: remedies and indemnities are a rather complicated story, as the AI provider would not tend to accept strong liability in relation to AI services, as it does not fully control the AI activity. Therefore, the contractor may wish to negotiate remedies provided by applicable law (as a minimum level of protection) and price discounts. Termination of the contract is the contractor's last resort. Indemnities as such are not typical for the AIaaS.

Conclusion

There is almost no doubt that the sample form of AIaaS would be proposed by the AI provider as a model agreement to be made available to many users, perhaps even in the standard form agreed by way of accession only, with no (or little) possibility of amendment and adaptation. However, the negotiation process could be conducted through a written record containing clauses in the contractor's redaction explaining the reasons for non-agreement, which could potentially help to further substantiate the contractor's position in litigation.

The most negotiable document would be an SLA, and that is the negotiating space for a contractor. The negotiation process can run in parallel with the initial testing of the AI product, so that there is more clarity about the details that need to be included in the agreement. As the framework agreement will most likely contain a clause stating that the previous negotiations will not be taken into account and that only the expressly written terms of the contract will be binding on the parties, it is advisable to keep a record of the negotiations before the contract is signed and afterwards (when adjustments are made) in case of further conflicts.

Check out our Telegram channel for more useful articles and the latest news.