AI Clause in Business Contracts: What to Cover and Why

AI Clause in Business Contracts: What to Cover and Why

An AI clause in a business contract is the passage that says whether, where and how AI can be used in delivering the work, which data it may touch, who reviews the output and who is responsible when something goes wrong. It does not need to be long, but it must be specific enough that both parties know what was agreed. This article lists the topics to bring to the conversation. It does not replace advice from a lawyer.

Key takeaways

• Older contracts are usually silent on AI, and silence lets each party assume whatever suits it.
• The core topics are: permitted use of AI, the data involved, human review, liability and exit from the contract.
• A good clause describes real workflows (customer support, proposals, reports), not the technology in the abstract.
• Personal data calls for attention to Brazil's LGPD (General Data Protection Law), including when the AI provider is based outside Brazil.
• The final text should be drafted or reviewed by a lawyer. Your role as the business is to bring the correct facts to them.

Why does a contract need to mention AI?

When a supplier starts using AI to write reports, answer customers or classify documents, the nature of the service changes, even if the scope on paper stays the same. The same goes for a client who pastes project details into an AI tool to summarize a meeting. Neither party acted in bad faith, but nobody agreed on anything.

The risk is not AI itself. It lies in three common gaps: nobody knows when it was used, nobody knows where the data went and nobody knows who checked the result. A well-written clause closes those three gaps in plain language.

One point of method helps here. Separate what comes from official documentation (such as the LGPD and guidance from the ANPD, Brazil's data protection authority), what comes from implementation experience (how AI workflows tend to fail) and what is your own guess about the future. The contract should rest on the first two and provide review mechanisms for the third.

Which topics should an AI clause cover?

Use the list below as a script for the conversation with your lawyer and with the other party. Not every contract needs every item. An equipment maintenance contract calls for less than a customer service contract.

• Definition: what the contract means by an AI system (a third-party tool, an in-house model, an automation with fixed rules).
• Permitted and prohibited use: which activities AI can be used for and which it cannot.
• Transparency: whether and how the other party will be told that AI took part in the delivery.
• Data: which categories go into the tool, which stay out, where they are processed and how long they are kept.
• Training: whether the other party's data may or may not be used to train or improve models.
• Subcontractors: which AI providers are involved and how changes will be communicated.
• Human review: who checks what the AI produces before it reaches the end customer or becomes a decision.
• Liability: who answers for errors, leaks, improper content or violations of third-party rights.
• Ownership and confidentiality: who owns the generated output and how confidential information is protected.
• Records and audit: which logs exist and who can consult them.
• Incidents: the deadline and format for notice when something goes wrong.
• Termination: what happens to data and configurations when the contract ends.

Permitted use: state what, where and for what

The most useful clause does not simply say that AI may or may not be used. It describes the stages. For example: drafting text can use AI, calculating the final quote cannot. Sorting incoming messages can use AI, answering questions about warranty or billing cannot.

Think in three categories and write each one with examples from your own business:

• Free use: low-risk internal tasks with no personal or confidential data.
• Conditional use: tasks that require prior approval, human review or a specific tool.
• Prohibited use: tasks where AI should not take part, such as decisions that affect people's rights or sensitive communication.

This split mirrors what many companies already do internally in a company policy for employee ChatGPT use. If the internal policy and the contract say different things, the contract loses credibility at the first dispute. It is also worth looking at what the company should not delegate to AI and turning that list into prohibited use.

Data: what goes in, where it stays and who has access

This is the topic where the clause comes closest to the LGPD. If the supplier processes personal data on the client's behalf, the contract generally needs to make clear each party's role (controller and processor), the purpose of the processing and the security measures. The lawyer decides how to frame this, but you need to bring the facts: which data, whose, through which channel and into which tool.

Practical questions to answer before drafting:

• Does the AI tool receive names, phone numbers, ID documents, health data or financial data?
• Do WhatsApp messages, voice notes or meeting recordings pass through it?
• Does the provider process data outside Brazil? If so, see what the LGPD requires for international data transfer when using AI providers.
• Is the data used to train the provider's models, or can that be switched off?
• How long are conversations and attachments stored, and who can delete them?

For more sensitive data, some companies prefer to restrict what goes to external services and run part of the work in a controlled environment. The guide on running Ollama local models in a company covers what to consider on that path. Whichever option you choose, the contract should reflect what actually happens, not what would be ideal.

Human review and liability: who checks and who answers?

Human review only has value if it is specific. Writing that content will be reviewed by humans does not say who, when or with what power to correct or block it. Describe the control point instead: the person responsible for the service reviews the text before it is sent to the customer, and cases outside a defined set of situations are passed to a human agent.

When AI takes part in decisions that affect people (credit, cancellation, access to a service), the LGPD has a topic of its own: the right to request review of decisions made solely on the basis of automated processing. The article on LGPD automated decision-making and the right to review explains the point. In the contract, it is worth providing for how such a request reaches the responsible person and how quickly it will be handled.

On liability, the text usually addresses:

• Who answers to the end customer for errors in AI-generated content.
• Who bears the cost of the fix and how it is carried out.
• How responsibility is divided when the error comes from a third-party provider.
• Which limits and exceptions apply. This is a strictly legal decision and should be negotiated with a lawyer.

What you can do as a manager is make the workflow explicit. The clearer the design (who does what, where review happens, which records exist), the easier it is to allocate responsibility fairly.

Illustrative scenario: a WhatsApp customer support supplier

Illustrative scenario: a company hires a supplier to run first-line customer support on WhatsApp with an AI agent. The previous contract only mentioned customer service and response hours.

When reviewing the contract, the company and its lawyer decide to include the following points:

• The agent can answer questions about opening hours, address and order status. It cannot negotiate price, promise warranty terms or handle formal complaints.
• Messages containing words linked to cancellation, billing or complaints are passed to a person.
• The end customer is told in the first message that they are talking to a virtual assistant.
• Conversation data is not used to train third-party models and is kept for a defined period.
• The supplier keeps a record of the responses and delivers the history of a specific conversation on request.
• Any change of AI provider is communicated before it goes live.

The design echoes what is discussed in how to integrate AI into your company's WhatsApp: clear limits, handoff to a human and a record of decisions. The contract simply turns those technical decisions into verifiable commitments.

How to bring the topic into the contract: step by step

The method we use in AI projects also works for preparing the contract conversation: map, limit, pilot and hand over. Applied to the contract, it looks like this.

• Map: list where AI is already used or will be used in the relationship (by you, by the supplier, by the client), with the tools and data involved.
• Limit: define what AI can and cannot do, which data stays out and where human review is mandatory.
• Take it to the lawyer: hand over the map and the limits, and ask them to turn these into clauses suited to the LGPD and the type of contract.
• Pilot: if possible, start with one real workflow and a short timeframe, with logs and a success criterion agreed between the parties.
• Hand over: at the end of the pilot, document what worked, adjust the clause and decide whether to expand, adjust or stop.

One practical detail: long-term contracts benefit from a technical annex, separate from the body of the contract, listing tools, workflows and data. Annexes are easier to update than the whole contract, and AI changes faster than most commercial relationships.

To structure risks, some companies use management references such as the NIST AI Risk Management Framework and the OWASP Top 10 for LLM applications. They are neither law nor a model clause, but they help name risks that the contract should address. It is also worth following Brazil's AI regulation, since future rules may require the text to be revisited.

Frequently asked questions

Do I need an AI clause even if my company does not sell AI? If you or your supplier use AI at any stage that touches customer data, confidential information or communication with third parties, the topic is worth addressing. The clause can be short, but it should say what is permitted, which data goes in and who reviews the result.

Does an AI clause replace the company's internal policy? No. The internal policy guides the team day to day, and the contract fixes what was agreed with another party. The two should be consistent, and the contract can refer to the policy or to a technical annex.

Can the clause ban AI use entirely? It can, if the parties agree, but it is hard to enforce when AI is built into everyday tools. It usually works better to define prohibited uses, require disclosure of the tools and data involved, and provide for audit or reporting.

Who should draft the clause? A lawyer, preferably one familiar with data protection and technology contracts. The role of the manager and the technical lead is to bring the facts: workflows, tools, data, review points and what happens when something fails.

Sources

• ANPD: Autoridade Nacional de Proteção de Dados
• NIST AI Risk Management Framework
• OWASP Top 10 for LLM Applications