AI features addendum to SaaS terms

A SaaS provider that adds AI features to its product (generation, summarisation, search, recommendations, an assistant) has terms that describe the product as it was, a data processing agreement that does not mention the model providers, and customers' procurement teams asking what the features do with their data. The addendum sits alongside the existing terms and says what the features do, what the provider warrants, what happens to customer data, who owns outputs, what customers may not do, and how the provider changes or withdraws features. The AI provisions for the agreement are drafted or reviewed for a fixed £595 and delivery in five working days.

Who this is for

SaaS and software providers in England and Wales adding AI features to an existing product with existing customer terms, and providers whose customers have started asking about them.

What matters in an AI features addendum

Why the AI features need their own terms

The existing terms were drafted for a product whose behaviour the provider controlled and whose outputs were the customer's own data processed deterministically, and AI features behave differently: they generate content, they rely on third-party models, they can be wrong in ways the provider cannot prevent, and they use customer data in ways the data processing agreement did not anticipate; an addendum (accepted on enabling the features, or incorporated into the terms on renewal) lets the provider describe the features accurately, warrant what it can, disclose the model providers, set the acceptable use and keep the right to change the features, without reopening the whole agreement with every customer.

What the features do and what the provider does not warrant

The addendum describes the AI features in plain terms (what they generate, what they use, where a person should review), states that outputs may be inaccurate, incomplete or inappropriate and should be reviewed before reliance, states that the features are provided as part of the service with reasonable care and skill in their operation but without a warranty of the accuracy or fitness of any output, and brings the features within the service's general warranty and liability provisions; for consumer customers the Consumer Rights Act 2015 limits what can be excluded, and for business customers the Unfair Contract Terms Act 1977 applies the reasonableness test to standard terms, so the statements are drafted to be accurate rather than sweeping.

Customer data, model providers and the training question

any personal data that goes into an AI tool is being processed under the UK GDPR, which calls for a lawful basis, transparency to the individuals, an Article 28 agreement with the provider and an Article 35 impact assessment where the use bears on people, and the provider's model providers are its sub-processors, so the addendum (and the data processing agreement it amends) names the categories of model provider, states the locations and the transfers under Article 46, states that customer data is not used to train the provider's or its model providers' models unless the customer agrees in terms that say so, states the retention of prompts, outputs and logs, and confirms that the provider's agreements with its model providers exclude their training on customer data; the provider's terms decide whether inputs may be used to train or improve its models and how long they are retained, and business tiers generally exclude training where consumer tiers do not, which is the question customers' security questionnaires ask first.

Outputs, ownership and the customer's responsibility

The addendum states that the customer owns its inputs and, as between the parties, the outputs generated from them (subject to the model provider's terms and to the point that outputs may be unprotected, since section 9(3) of the Copyright, Designs and Patents Act 1988 assigns authorship of a computer-generated work to whoever made the arrangements, untested on modern tools, and the Act's protection extends only to original works), that similar outputs may be generated for other customers, that the customer is responsible for its use of outputs and for the inputs it supplies (with the rights and the lawful basis for them), and that the provider may use aggregated and anonymised usage data to operate and improve the service; where the provider's features make decisions about the customer's end users, the addendum requires the customer to provide the safeguards Article 22 of the UK GDPR requires and the provider to make them possible in the product.

Acceptable use, suspension and the prohibited uses

The addendum's acceptable use provisions prohibit unlawful, harmful, deceptive and infringing uses, attempts to extract the models, their weights or their training data, use of the features to develop competing models, circumvention of the provider's safety controls, high-risk uses the provider does not support (medical, legal, financial or safety-critical decisions without human review; where the provider sells into the European Union, uses that the EU's AI regulation prohibits or classifies as high risk unless the provider supports them), and use on data the customer may not process; the provider may suspend the features for breach, for a model provider's failure or for a security incident, with notice where practicable, and the customer indemnifies the provider for claims arising from its inputs and its use.

Beta features, changes and the feature the provider withdraws

The addendum provides that beta and preview features are offered without warranty or service levels, may be changed or withdrawn without notice and may not be suitable for production use, that the provider may change the models and model providers behind generally available features without reducing their material functionality, that the provider may modify or withdraw AI features on notice (with a refund or substitute where a paying customer loses something material, and within the consumer protection limits on variation), and that pricing for AI features may be separate and usage-based; the addendum is drafted to sit alongside the provider's existing terms and data processing agreement, and the provider's AI use policy, drafted separately, governs the provider's own staff.

What it costs

AI provisions in a contract, £595. Review or draft AI-specific terms in a supply or customer agreement. Five working days.

AI use policy, £995. Internal policy plus the accompanying contract provisions. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• An internal AI use policy your staff will follow, rather than a document that bans everything and is quietly ignored
• Contract provisions covering output ownership, training data, confidentiality and liability
• A defensible position to give customers who ask what your AI governance looks like
• Review of your AI suppliers' terms, including what they reserve the right to change
• Practical guidance on what to permit, what to restrict and what to prohibit outright
• One round of amendments

What is not included

• Technical AI assurance, model testing or bias auditing
• Sector-specific regulatory approval
• Advice on non-UK regulatory regimes beyond flagging where they apply
• Ongoing regulatory monitoring

Questions I am often asked

Do we need separate terms for AI features or can we amend the main terms?

Either: an addendum accepted on enabling the features, or amendments incorporated on renewal. The addendum is quicker to roll out across a customer base and keeps the existing terms intact.

Can we train our models on customer data?

Only where the customer has agreed in terms that say so, and your model providers' terms must exclude their training on customer data. The addendum states the position customers' questionnaires ask about.

Who owns the outputs our features generate?

As between the parties, the customer, subject to the model provider's terms and to the point that generated outputs may be unprotected and similar outputs may be generated for others. The addendum says so and makes the customer responsible for its use of them.

Related guidance and services

• AI contracts and AI use policies, £595, the service this page describes
• SaaS and technology contracts, £995
• Data protection agreements and privacy terms, £795
• AI acceptable use clause for a SaaS product
• Privacy notice for a SaaS product

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.