Terms for an AI-powered SaaS feature

Adding an AI feature to a product changes what the terms have to say, because the product now produces content and conclusions rather than storing them. The terms have to describe the feature and say what it does not guarantee, tell the customer what it may do with the outputs and that it remains responsible for them, settle who owns what the feature generates, say whether customer data trains the model, name the model provider as a subprocessor, deal with decisions about individuals, and limit liability for outputs within the statutory rules. I draft those terms, as a section of a set of SaaS terms or as a supplement to yours, for a fixed fee of £995, delivered in five working days.

Who this is for

SaaS businesses in England and Wales that have added or are adding generative, predictive or analytical AI features to their product, using their own models or a third-party provider's, and need the customer terms to cover what the feature does.

What matters in terms for an AI feature

Describing the feature and what is not promised

The terms should describe what the feature does in plain terms, that it produces outputs from patterns in data and may produce outputs that are inaccurate, incomplete, biased or unsuitable, that it is not a substitute for professional judgement, and that the supplier does not warrant the accuracy of outputs beyond providing the feature with reasonable care and skill under section 13 of the Supply of Goods and Services Act 1982. Against a consumer the description must be accurate under Part 4 of the Digital Markets, Competition and Consumers Act 2024, because a claim of accuracy in the marketing is a term of the contract.

The customer's use of outputs and human review

The terms should make the customer responsible for reviewing outputs before relying on them or publishing them, for their use in the customer's business, for compliance with law in that use, and for not using outputs in ways the acceptable use policy prohibits (unlawful content, deception, high-risk uses the supplier excludes), and should say that outputs may be similar to outputs generated for other customers, so that no exclusivity is implied. A customer that publishes an inaccurate output under its own name has published it.

Ownership of outputs and rights in them

The terms should state who owns the outputs: usually the customer, as between the parties, with the supplier retaining the model, the feature and any improvements. Copyright in computer-generated works vests in the person who made the arrangements for their creation under section 9 of the Copyright, Designs and Patents Act 1988, and whether an output attracts copyright at all depends on the human contribution, so the terms should assign whatever rights exist to the customer rather than warrant that rights exist, and should say that the supplier gives no warranty that outputs do not infringe third-party rights beyond the indemnity, if any, it chooses to give.

Training on customer data and the processor position

The terms should say whether the customer's data and prompts are used to train or improve models, and for whom: not at all, only for the customer's own instance, or on aggregated and de-identified data. Using personal data in customer content to train the supplier's general models takes the supplier outside its processor role under Article 28 of the UK GDPR and needs its own lawful basis and transparency; the terms and the privacy notice should say what the position is, and enterprise customers will insist on no training without consent.

Third-party model providers and subprocessors

Where the feature calls a third-party model, the provider is a subprocessor of personal data in the prompts and should be listed as such under the Article 28 terms, with its data retention and training commitments described, its location addressed under Article 46 where data leaves the UK, and the supplier's dependence on it disclosed: the feature may change or be withdrawn if the provider changes its terms or availability. The provider's own use restrictions should be flowed down to the customer.

Automated decisions, individuals and liability for outputs

Where the feature makes or supports decisions about individuals (screening, scoring, pricing), Article 22 of the UK GDPR, as amended by the Data (Use and Access) Act 2025, governs solely automated decisions with significant effects, and the terms should allocate to the customer, as controller, the safeguards, human review and information the rules require, with the supplier providing what the product can. Liability for outputs should sit within the general cap, with the exclusions of loss drafted to cover reliance on outputs, tested under section 11 of the Unfair Contract Terms Act 1977 for business customers and within the Consumer Rights Act 2015 for consumers, and the EU AI Act addressed where EU customers use the feature.

What it costs

SaaS terms of service, £995. Your standard customer-facing terms. Five working days.

Buying online forms the engagement on payment. The scope is what the saas and technology contracts page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A bespoke contract drafted for how your product is sold, delivered and supported
• Service levels you can meet, with remedies that are proportionate rather than aspirational
• A liability position that is defensible and will survive enterprise procurement
• IP and data provisions that fit together rather than contradicting each other
• A commercial note on where you will get pushback and what is worth conceding
• One round of amendments

What is not included

• Negotiating individual enterprise deals, which I quote separately
• Advice on the law of jurisdictions outside England and Wales
• Technical security certification or audit
• Regulatory advice for regulated sectors such as financial services or health

Questions I am often asked

Who owns what our AI feature generates for a customer?

The terms give the customer whatever rights exist in the outputs and keep the model and feature with the supplier. Whether an output is protected by copyright at all depends on the human input, so the terms assign rather than warrant.

Can we use customer prompts to improve the model?

Only if the terms say so and the privacy notice matches, and enterprise customers will expect no training without consent. The terms draft the position you choose, from no training to aggregated data only.

A customer relied on an inaccurate output and lost money. Are we liable?

Within the cap, for a failure to provide the feature with reasonable care; not for the customer's reliance where the terms make review its responsibility and exclude that loss. The terms are drafted to that line.

Related guidance and services

• SaaS and technology contracts, £995, the service this page describes
• AI contracts and AI use policies, £995
• Data protection agreements and privacy terms, £795
• SaaS terms of service for a B2B product
• Data ownership and portability clauses in SaaS terms

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: September 2026. Email geoffrey@caesar.co.uk.