AI clauses in a supplier agreement

A business's suppliers (its agency, its outsourcer, its accountant, its developer, its recruiter) use AI tools on the business's data and in the work they deliver, and the business's supplier contracts say nothing about it: no disclosure, no restriction on where the business's data goes, no warranty about generated deliverables, and no say in the tools that make decisions about the business's customers. The clauses give the business the visibility, the restrictions and the remedies, drafted for its supplier terms or for marking up a supplier's own. A fixed £595 covers the drafting or review of the AI provisions for the agreement, delivered in five working days.

Who this is for

Businesses in England and Wales buying services from suppliers who use AI tools, from a small company with a handful of suppliers to a procurement function with a supplier template.

What matters in AI clauses for a supplier agreement

The supplier's disclosure and the right to know what the tools do

The clause requires the supplier to disclose whether and how it uses AI tools in delivering the services, to name the categories of tool and (on request) the tools and their terms, to tell the business when a deliverable is substantially generated, to notify material changes, and to answer the business's reasonable questions; the business then knows whether its data is going into a consumer tool, whether its report was generated, and whether the recruiter's shortlist was ranked by an algorithm, which are the three discoveries a business without the clause makes by accident.

The business's data and the supplier's tools

the policy bars confidential information, trade secrets and clients' data from tools whose terms allow the provider to retain inputs or train on them, since the reasonable-steps test in the Trade Secrets (Enforcement, etc.) Regulations 2018 and the business's confidentiality duties both look at what was done to protect the information, and the supplier's confidentiality obligation is extended to prohibit the business's information entering any tool other than one meeting stated conditions (business terms, no training on inputs, limited retention, security, location), with the business able to restrict or prohibit tools on stated information; entering personal data into an AI tool is processing under the UK GDPR and brings with it the need for a lawful basis, a notice to the individuals, an Article 28 data processing agreement with the provider and, where people are affected, an Article 35 impact assessment, so the supplier's data processing agreement requires the business's authorisation for AI tools as sub-processors and lists them.

The deliverables, the warranties and the generated element

The supplier warrants that deliverables are its own work save as disclosed, that generated elements have been reviewed for accuracy and for reproduction of third-party material, that it has used tools under terms that do not grant the provider rights in outputs, and that the deliverables comply with the business's stated restrictions; the Copyright, Designs and Patents Act 1988 names the person who made the arrangements as the author of a computer-generated work (section 9(3)), a provision untested on modern tools, and protects only works that are original, so the intellectual property clause requires the supplier to assign what it owns, to license what it cannot assign, and to tell the business which elements may be unprotected, with the business deciding whether a deliverable it cannot own is one it wants to pay for.

Decisions about the business's customers and staff made by the supplier's tools

Where the supplier's tools screen the business's job applicants, score its customers, decide its claims or shape what its customers are offered, the business as controller is responsible for the decisions, and under Article 22 of the UK GDPR as amended by the Data (Use and Access) Act 2025, a solely automated decision with legal or similarly significant effects is permitted outside special category data only with safeguards: the person is told, can make representations, can get human intervention and can contest; the clause requires the supplier to tell the business which decisions its tools make or shape, to provide the documentation (what the tool uses, its testing for bias, its explainability) that the business needs for its impact assessment and its notices, to apply human review where the business requires it, and to indemnify the business for discrimination claims caused by the supplier's tool under the Equality Act 2010.

Changes of tool, subcontractors and the audit right

The clause requires notice of a change of tool or provider that affects the business's data or deliverables, with a right to object where the new tool does not meet the conditions, flows the obligations down to the supplier's subcontractors and freelancers (who are the usual source of undisclosed generated work), and gives the business an information and audit right (the supplier's tool list, its policy, its data processing terms with providers, its records of the tools used on the business's work), exercisable on notice and proportionately; a supplier that cannot produce its own AI use policy is telling the business something.

Liability, termination and the supplier that will not say

Breach of the AI clauses is a breach of the agreement with the ordinary remedies, the supplier indemnifies the business for infringement in generated elements it failed to check or disclose and for the business's losses from the business's information entering a prohibited tool, liability sits within the agreement's cap with a higher cap for data and confidentiality breaches where the supplier will agree one, and the business may terminate for a material breach or for the supplier's failure to give the disclosure the clause requires; the clauses are drafted for the business's supplier template or used to mark up a supplier's own terms, and the business's AI use policy, drafted separately, sets what the business itself does with the tools.

What it costs

AI provisions in a contract, £595. Review or draft AI-specific terms in a supply or customer agreement. Five working days.

AI use policy, £995. Internal policy plus the accompanying contract provisions. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• An internal AI use policy your staff will follow, rather than a document that bans everything and is quietly ignored
• Contract provisions covering output ownership, training data, confidentiality and liability
• A defensible position to give customers who ask what your AI governance looks like
• Review of your AI suppliers' terms, including what they reserve the right to change
• Practical guidance on what to permit, what to restrict and what to prohibit outright
• One round of amendments

What is not included

• Technical AI assurance, model testing or bias auditing
• Sector-specific regulatory approval
• Advice on non-UK regulatory regimes beyond flagging where they apply
• Ongoing regulatory monitoring

Questions I am often asked

Our agency uses AI on our campaigns. Do we need a clause?

Yes: without it the agency owes you no disclosure, your data may be in a consumer tool, and the deliverables may contain generated elements nobody owns. The clause gives you disclosure, restrictions on your data, warranties on deliverables and an audit right.

Our recruiter's tool shortlists candidates. Whose problem is that?

Yours, as controller, under Article 22 and the Equality Act. The clause makes the supplier disclose what its tools decide, provide the bias and explainability documentation, apply human review where you require it, and indemnify you for discrimination caused by the tool.

Can we stop a supplier changing the AI tool it uses on our data?

The clause requires notice of a change that affects your data or deliverables and gives you a right to object where the new tool does not meet the conditions. A change you were not told about is a breach.

Related guidance and services

• AI contracts and AI use policies, £595, the service this page describes
• SaaS and technology contracts, £995
• Data protection agreements and privacy terms, £795
• Data protection clauses in a supplier contract
• Reviewing an AI vendor's terms before you sign

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.