AI acceptable use clause for a SaaS product

A SaaS product with AI features needs an acceptable use clause that goes beyond the usual list of unlawful and abusive uses: the model providers behind the features impose usage policies the provider must flow down, some uses are high risk and must not be made without a person involved, customers put in data they may not have the right to process, and competitors try to extract the models. The clause sets the prohibited uses, the high-risk uses that need human review, the customer's responsibility for inputs, the protection of the provider's product and the enforcement route. I deliver the agreement's AI provisions, drafted or reviewed, in five working days for a fixed £595.

Who this is for

SaaS and software providers in England and Wales with AI features in their product, and providers whose model provider's terms require a flow-down they have not yet written.

What matters in an AI acceptable use clause

What the clause does and why the general acceptable use policy is not enough

The provider's existing acceptable use policy prohibits unlawful content, abuse, security attacks and resale, and the AI clause adds what AI features need: the uses the model providers prohibit, the high-risk uses that need a person, the inputs customers may not supply, the extraction and competition restrictions, and the enforcement the features need (suspension of the feature rather than the whole service); the clause sits in the AI features addendum or the main terms, applies to the customer and everyone the customer lets use the product, and makes the customer responsible for its users.

The prohibited uses the model providers require the provider to pass on

The provider's agreements with its model providers contain usage policies the provider must impose on its own customers (prohibitions on generating illegal content, child sexual abuse material, content that incites violence or hatred, non-consensual intimate imagery, malware, fraud and deception, harassment, and on uses that violate others' rights), and a provider that fails to flow them down is in breach of its model provider's terms and may lose access to the models; the clause lists the prohibitions in the provider's own words, states that they may be updated as the model providers' policies change, and reserves the provider's right to add restrictions on notice.

High-risk uses, human review and the decisions the product must not make alone

The clause prohibits using the AI features to make decisions with legal or similarly significant effects on individuals without meaningful human review (hiring, credit, insurance, housing, education, medical, legal and safety-critical decisions), because under Article 22 of the UK GDPR as amended by the Data (Use and Access) Act 2025, a solely automated decision with legal or similarly significant effects is permitted outside special category data only with safeguards: the person is told, can make representations, can get human intervention and can contest, and the customer as controller must provide them; where the provider sells into the European Union, the clause prohibits the uses the EU's AI regulation prohibits and requires the customer to comply with that regulation's obligations for any high-risk use the provider supports, and the provider documents which uses it supports and which it does not.

Inputs, rights and the data customers may not put in

The clause requires the customer to have the rights and the lawful basis for everything it inputs (its own data, third-party content, personal data), prohibits inputs the customer has no right to process (scraped content in breach of a site's terms, data subject to a confidentiality obligation the product's terms would breach, special category data unless the product is designed for it), and makes the customer responsible for the consequences; personal data entered into an AI tool is processing under the UK GDPR that needs a lawful basis, a notice to the individuals, a data processing agreement under Article 28 with the provider and, where the tool is used on people in ways that affect them, an impact assessment under Article 35, and the clause points the customer to the data processing agreement for the provider's obligations and its own.

Extraction, competing models and the protection of the provider's product

The clause prohibits using the features to extract the models, their weights, their training data or their system prompts, to generate outputs for training a competing model, to benchmark the service for publication without consent, to circumvent the provider's safety controls or rate limits, and to probe the features through prompt injection or jailbreaking except under an agreed security testing arrangement; trade secrets, confidential information and clients' data stay out of any tool whose provider may train on or retain the input, a line the Trade Secrets (Enforcement, etc.) Regulations 2018 (which protect only secrets kept by reasonable steps) and the business's confidentiality obligations both require, and the provider's system prompts and configurations are its trade secrets, which the clause and the product's controls protect together.

Enforcement, suspension and the customer who was warned

The provider may suspend the AI features (or the account) for a breach of the clause, immediately where the breach is serious or the model provider requires it and otherwise after notice and a chance to remedy, may remove or refuse to generate content that breaches it, may report illegal content to the authorities where the law requires, and may terminate for repeated or serious breach; the customer indemnifies the provider for claims and for the provider's losses (including the loss of access to a model provider) arising from the customer's breach, and the provider's own AI use policy, drafted separately, governs the provider's staff and their access to customers' prompts and outputs.

What it costs

AI provisions in a contract, £595. Review or draft AI-specific terms in a supply or customer agreement. Five working days.

AI use policy, £995. Internal policy plus the accompanying contract provisions. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• An internal AI use policy your staff will follow, rather than a document that bans everything and is quietly ignored
• Contract provisions covering output ownership, training data, confidentiality and liability
• A defensible position to give customers who ask what your AI governance looks like
• Review of your AI suppliers' terms, including what they reserve the right to change
• Practical guidance on what to permit, what to restrict and what to prohibit outright
• One round of amendments

What is not included

• Technical AI assurance, model testing or bias auditing
• Sector-specific regulatory approval
• Advice on non-UK regulatory regimes beyond flagging where they apply
• Ongoing regulatory monitoring

Questions I am often asked

Our model provider's terms require us to flow down its usage policy. What does that mean?

Your customer terms must prohibit the uses the model provider prohibits, or you are in breach of its terms and risk losing access. The clause lists them in your own words and reserves the right to update them as the policies change.

Can customers use our features to make hiring or credit decisions?

Not without meaningful human review and the safeguards Article 22 requires, which the clause prohibits them from omitting. Where you sell into the EU, the AI regulation's high-risk obligations apply to such uses, and you document which you support.

What can we do if a customer tries to extract our model or prompts?

Suspend the features immediately, terminate for serious or repeated breach, and recover losses under the indemnity. The clause prohibits extraction, competing-model training, circumvention and jailbreaking outside an agreed security test.

Related guidance and services

• AI contracts and AI use policies, £595, the service this page describes
• SaaS and technology contracts, £995
• Data protection agreements and privacy terms, £795
• AI features addendum to SaaS terms
• AI use policy for a software company

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.