Reviewing an AI vendor's terms before you sign

An AI vendor's terms are a set of documents (the terms of service, the usage policy, the data processing addendum, the tier-specific terms, the privacy policy) that change often and that decide what the vendor may do with what the business puts in, what the business gets in what comes out, what the vendor will stand behind, and what it may change or withdraw. The review reads all of them for the tier the business will use, and reports what they permit, what they reserve and what the business should ask for before signing. The business receives a review of the AI supplier's terms within five working days for a fixed £595, with a note on what is permitted, what is reserved and what to ask for.

Who this is for

Businesses in England and Wales buying or enabling an AI product and wanting to know what they are agreeing to before the first prompt.

What matters in reviewing an AI vendor's terms

The documents that make up the terms and the ones the business has not seen

The terms the business is asked to accept usually incorporate by reference a usage policy, a data processing addendum, service-specific or tier-specific terms, a privacy policy and a list of sub-processors, each of which the vendor may update, and the review assembles the set that applies to the business's tier and intended use, identifies the version in force and the vendor's right to change it (and on what notice), and reads them together, because the training exclusion is often in the data processing addendum, the output rights in the service terms and the prohibitions in the usage policy; the note lists the documents reviewed with their dates.

Inputs, outputs and the rights the vendor takes

The review reports what rights the business keeps in its inputs (usually all, with a licence to the vendor to process them), what rights the vendor grants in outputs (an assignment or a broad licence on business tiers, with the caveat that similar outputs may be generated for others and that generated outputs may be unprotected, since whoever made the arrangements is the author of a computer-generated work under section 9(3) of the Copyright, Designs and Patents Act 1988, a provision untested on modern tools, and only original works are protected), whether the vendor reserves rights in outputs or restricts their use (no training competing models, no passing off as human work where the terms say so), and whether the vendor offers an indemnity for intellectual property claims about outputs and on what conditions (business tiers, safety features on, no modification of the output); the business learns what it owns before it builds on it.

Training, retention and the tier the business is on

the provider's terms decide whether inputs may be used to train or improve its models and how long they are retained, and business tiers generally exclude training where consumer tiers do not, and the review states the position for the tier the business will use (and the tier its staff are on, which is often not the same), whether training is excluded by default or requires an opt-out, how long prompts and outputs are retained and for what purposes (abuse monitoring, legal compliance, the business's own history), whether zero-retention is available, and whether human reviewers at the vendor may read the business's inputs; nothing confidential (trade secrets, clients' data, unreleased plans) goes into a tool whose terms let the provider train on or keep the input, because the Trade Secrets (Enforcement, etc.) Regulations 2018 and the business's confidentiality obligations turn on the steps taken to keep it secret, and the review tells the business which of its information may go in.

Liability, indemnity and the output the vendor will not stand behind

AI vendors' terms exclude warranties of accuracy, exclude liability for reliance on outputs, cap liability at a low multiple of fees (or a nominal sum on free tiers), and require the business to indemnify the vendor for its use, and the review states what the vendor will stand behind (the service as described, its security commitments, sometimes an intellectual property indemnity for outputs), what it will not, and whether the cap and the exclusions are enforceable against the business (the Unfair Contract Terms Act 1977 applies the reasonableness test to standard terms between businesses, and the Consumer Rights Act 2015 protects a sole trader buying as a consumer); the business then knows what risk it carries when it uses the output.

The service the vendor may change, suspend or withdraw

The terms let the vendor change the models behind the service, change features, change the terms on notice (or without), suspend the account for suspected breach, and withdraw the service or the tier, and the review reports the notice periods, the refund position, the business's exit rights and its ability to export its data and history, because a business that builds a workflow on a feature the vendor withdraws needs to know that before it builds; the usage policy's prohibitions are reported too.

The data processing terms, the sub-processors and the location of the data

the UK GDPR treats personal data entered into an AI tool as processing, requiring a lawful basis, a notice to the people concerned, a data processing agreement with the provider under Article 28 and an impact assessment under Article 35 where the use affects individuals, and the review checks the vendor's data processing addendum for the Article 28 terms, the sub-processor list and the notification of changes, the processing locations and the transfer safeguards under Article 46, the security commitments and certifications, breach notification timing, deletion on termination, and whether the addendum is in force for the business's tier (it is sometimes only for enterprise); the note closes with what to ask the vendor for and what the business should put in its own policy and contracts as a result.

What it costs

AI supplier review, £595. You are buying an AI product and want to know what you are agreeing to. Five working days.

AI provisions in a contract, £595. Review or draft AI-specific terms in a supply or customer agreement. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• An internal AI use policy your staff will follow, rather than a document that bans everything and is quietly ignored
• Contract provisions covering output ownership, training data, confidentiality and liability
• A defensible position to give customers who ask what your AI governance looks like
• Review of your AI suppliers' terms, including what they reserve the right to change
• Practical guidance on what to permit, what to restrict and what to prohibit outright
• One round of amendments

What is not included

• Technical AI assurance, model testing or bias auditing
• Sector-specific regulatory approval
• Advice on non-UK regulatory regimes beyond flagging where they apply
• Ongoing regulatory monitoring

Questions I am often asked

Our staff already use the free version. Does the review cover that?

It covers the tier you intend to use and the one your staff are on, which are often different: free and consumer tiers usually permit training and retention that business tiers exclude. The note tells you which information may go into which.

Will the vendor stand behind what its product produces?

Rarely beyond the service as described and its security commitments, with liability capped low; some vendors offer an IP indemnity for outputs on business tiers subject to conditions. The review states what you carry when you use the output.

What should we ask the vendor for before signing?

A business tier, training excluded in writing, zero or short retention, the data processing addendum in force for your tier, the sub-processor list, and an order form that fixes the terms. The note lists them for your vendor.

Related guidance and services

• AI contracts and AI use policies, £595, the service this page describes
• SaaS and technology contracts, £995
• Data protection agreements and privacy terms, £795
• AI clauses in a supplier agreement
• Reviewing an AI tool's data terms for customer data

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.