AI clauses for a business using AI to handle customer data

A business that runs its customers' data through AI tools (to summarise, classify, score, respond, recommend) has three contracts to bring into line: the customer contract, which has to disclose the use and obtain what agreement is needed; the data processing agreement, which has to name the AI providers as sub-processors; and the AI providers' agreements, which have to exclude training and limit retention so that what the business promises its customers is true. The clauses are drafted for all three together, because a clause in one that the others contradict is a breach waiting to be found. For £595, fixed, with delivery in five working days, I draft or review the agreement's AI provisions.

Who this is for

Businesses in England and Wales processing customer data in AI tools, whether as controllers for their own customers or as processors for business clients, from a support team with an assistant to a platform with AI features.

What matters in AI clauses for customer data

The three contracts the clauses go into and why one is not enough

The customer contract (consumer terms or a business agreement) governs what the business may do with the customer's data and what it has told the customer, the data processing agreement (where the business processes data for business customers) governs the sub-processors the business may use, and the AI provider's agreement governs what the provider does with what the business sends it; a business that promises customers their data is never used to train AI while its provider's terms permit training has a misrepresentation, and a business that names no AI sub-processors in its DPA has a breach of Article 28, so the clauses are drafted across the three and checked against each other.

The customer contract and what customers must be told and agree to

The customer terms disclose that the business uses AI tools on customer data, for what purposes, with what human review and with what route to a person, state the position on training (the business's and its providers' models are not trained on customer data unless the customer agrees in terms that say so), state that outputs may be imperfect and how the customer raises a concern, and for consumers comply with the Consumer Rights Act 2015 and the Digital Markets, Competition and Consumers Act 2024 (accurate description, no misleading omission, no unfair exclusion); where the business's tools make or shape decisions about customers, under Article 22 of the UK GDPR as amended by the Data (Use and Access) Act 2025, a solely automated decision with legal or similarly significant effects is permitted outside special category data only with safeguards: the person is told, can make representations, can get human intervention and can contest, and the terms and the process provide them.

The data processing agreement and the AI providers as sub-processors

any personal data that goes into an AI tool is being processed under the UK GDPR, which calls for a lawful basis, transparency to the individuals, an Article 28 agreement with the provider and an Article 35 impact assessment where the use bears on people, and where the business processes data for business customers its own DPA with them must list the AI providers as sub-processors (with general authorisation, notification of changes and a right to object), state the locations and the transfers under Article 46, state that customer data is not used for training, and provide the assistance the customer needs for its own assessments and notices; a business customer's security questionnaire asks these questions.

The AI provider's agreement and the terms the business must obtain

it is the provider's terms that say whether inputs are used to train or improve the models and how long they are held, and business tiers generally exclude training where consumer tiers permit it, so the business obtains from each provider a data processing agreement (the provider as the business's processor or sub-processor), an exclusion of training on the business's data, a stated retention of prompts, outputs and logs (with zero or short retention where the provider offers it), the security commitments and the locations, the sub-processor list, breach notification in time for the business's own obligations, and the right to delete; the clauses for the business's side are drafted to match what the providers will give.

The privacy notice, the assessment and the decisions the tools make

The privacy notice names the categories of AI tool, their purposes, the providers, the transfers, the retention, the training position and the customer's rights (including the right to object to profiling and the Article 22 safeguards where they apply), the records of processing under Article 30 list the tools, and the impact assessment under Article 35 exists where the use is likely to be high risk (profiling, automated decisions, special category data, new technology at scale), with the measures it identifies built into the contracts and the configuration; a tool whose terms permit training on inputs or their retention is off limits for confidential information, trade secrets and clients' data, because protection under the Trade Secrets (Enforcement, etc.) Regulations 2018 and compliance with the business's confidentiality obligations depend on the steps taken, and the business's confidentiality obligations to its business customers are met by the same provider terms that meet its data protection obligations.

Retention, deletion and the data that went into a model

The clauses set the retention of prompts, outputs, transcripts and logs by the business and its providers, provide for deletion on the customer's request and at the end of the relationship with certification, address backups, and deal with the data that cannot be deleted: data already used to train a model cannot be removed from it, which is why the training exclusion is obtained before any data goes in; the business's AI use policy, drafted separately, governs what its staff do with the tools.

What it costs

AI provisions in a contract, £595. Review or draft AI-specific terms in a supply or customer agreement. Five working days.

AI use policy, £995. Internal policy plus the accompanying contract provisions. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• An internal AI use policy your staff will follow, rather than a document that bans everything and is quietly ignored
• Contract provisions covering output ownership, training data, confidentiality and liability
• A defensible position to give customers who ask what your AI governance looks like
• Review of your AI suppliers' terms, including what they reserve the right to change
• Practical guidance on what to permit, what to restrict and what to prohibit outright
• One round of amendments

What is not included

• Technical AI assurance, model testing or bias auditing
• Sector-specific regulatory approval
• Advice on non-UK regulatory regimes beyond flagging where they apply
• Ongoing regulatory monitoring

Questions I am often asked

We use an AI tool on support tickets. Which contracts need to change?

All three: the customer terms (disclosure, training position, route to a person), your DPA with business customers (the tool's provider as a sub-processor) and your agreement with the provider (training excluded, retention set, a DPA). A clause in one that the others contradict is a breach.

Can we tell customers their data is never used to train AI?

Only if your providers' terms exclude it, in writing, for the tiers you use. Consumer tiers generally permit training; business tiers generally exclude it. Check before you promise, and record the terms in force.

Do we need an impact assessment to use AI on customer data?

Where the use is likely to be high risk (profiling, automated decisions, special category data, new technology at scale), yes, before it starts, with the measures it identifies built into the contracts and the configuration. The assessment is the document the regulator asks for.

Related guidance and services

• AI contracts and AI use policies, £595, the service this page describes
• SaaS and technology contracts, £995
• Data protection agreements and privacy terms, £795
• Privacy notice for a company using AI tools on customer data
• Reviewing an AI tool's data terms for customer data

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.