AI use policy for a software company

A software company's developers use coding assistants that see the codebase and generate code whose provenance is unknown, and its product may itself use AI features that process customers' data and make outputs customers rely on. The policy deals with both: what the assistants may see, how generated code is reviewed for licence contamination and security, who owns it, and how AI features in the product are described, what customers' data they use and what the company warrants, with the contract provisions for the customer terms and the model providers' agreements. I draft both (the AI use policy and the contract provisions that accompany it) for the business for £995 fixed in five working days.

Who this is for

Software companies, SaaS businesses, app developers and technology consultancies in England and Wales whose engineers use AI coding tools or whose products include AI features.

What matters in a software company's AI use policy

Coding assistants, the codebase and the secrets in the prompt

A coding assistant sends parts of the codebase and the developer's comments to the provider, and the policy sets which assistants are approved (business or enterprise tiers whose terms exclude training on the company's code and limit retention), what may be in the context the assistant sees (never credentials, keys, tokens, customer data or the parts of the codebase the company treats as its core secret), how secrets are kept out, and the prohibition on consumer tools for anything touching the company's code; confidential information, clients' data and trade secrets are kept out of tools whose terms permit retention of inputs or training on them, because both the Trade Secrets (Enforcement, etc.) Regulations 2018 and the business's confidentiality obligations ask what steps were taken to protect them, and source code is the trade secret a software company has.

Generated code, licences and the open-source clause nobody read

Generated code may reproduce code from the training data, including code under licences (copyleft licences in particular) whose terms would impose obligations on the company's product that its customers' terms do not allow and its investors will find in due diligence; the policy requires generated code to be reviewed for recognisable reproduction, requires the assistant's duplication filter to be on where the provider offers one, requires the company's open-source policy and licence scanning to apply to generated code, records the use of assistants in the repository's history, and addresses ownership: the Copyright, Designs and Patents Act 1988 treats the person who made the arrangements as the author of a computer-generated work, and the company's employment contracts and contractor agreements should assign whatever rights arise to the company.

Security, review and the vulnerability the tool wrote

Generated code contains vulnerabilities, reproduces insecure patterns from the training data and can be manipulated through the dependencies it suggests (including packages that do not exist and are then registered by an attacker), and the policy requires generated code to pass the same review, testing and static analysis as any other code with the reviewer knowing it was generated, requires suggested dependencies to be verified, prohibits assistants from making changes without a developer's review, and keeps the security review independent of the tool that wrote the code.

AI features in the product and the customers who rely on them

Where the product includes AI features (generation, summarisation, classification, recommendation, prediction, a chatbot), the policy sets the rules for building them (the models and their terms, evaluation before release, monitoring after it, documentation of limits, human review where a feature affects people) and the statements the company makes about them (accurate marketing, documented limitations, no untested accuracy claims), because a feature that makes decisions about the customer's end users brings Article 22 into the customer's hands: when an AI tool alone decides something with legal or similarly significant effects for a person, Article 22 of the UK GDPR as amended by the Data (Use and Access) Act 2025 permits it outside special category data only if the person is informed, may make representations, may obtain human intervention and may contest the decision, and the company's product must let its customers provide them; where the company sells into the European Union, the EU's AI regulation classifies some systems as high risk with obligations on providers, which the policy flags for assessment.

Customers' data, models and the training question in the terms

personal data put into an AI tool is processed under the UK GDPR like any other, requiring a lawful basis, a notice to the people concerned, a data processing agreement with the provider under Article 28 and an impact assessment under Article 35 where individuals are affected, and a software company's AI features process its customers' data (and their users' data) through model providers that are the company's sub-processors; the policy requires the company's data processing agreement with customers to disclose the model providers and the transfers under Article 46, requires training on customer data to be excluded unless the customer has agreed to it in terms that say so, requires the company's own agreements with model providers to exclude their training on the company's and its customers' data and to limit retention, and sets the retention of prompts, outputs and logs.

The contract provisions that go with the policy

The contract provisions drafted with the policy go into the customer terms (the description of the AI features and their limits, the warranty the company gives about the product and the warranty it does not give about generated outputs, the customer's responsibilities for its use of the features, the data processing agreement's disclosure of model providers and the training position, the liability cap), the supplier agreements with model and tool providers (training excluded, retention limited, the data processing agreement, the location, the liability for the provider's failures, the right to switch provider), the employment and contractor agreements (the assignment of rights in generated code, the policy incorporated), and the company's open-source and security policies; the policy is reviewed when the tools or models change.

What it costs

AI use policy, £995. Internal policy plus the accompanying contract provisions. Five working days.

AI provisions in a contract, £595. Review or draft AI-specific terms in a supply or customer agreement. Five working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• An internal AI use policy your staff will follow, rather than a document that bans everything and is quietly ignored
• Contract provisions covering output ownership, training data, confidentiality and liability
• A defensible position to give customers who ask what your AI governance looks like
• Review of your AI suppliers' terms, including what they reserve the right to change
• Practical guidance on what to permit, what to restrict and what to prohibit outright
• One round of amendments

What is not included

• Technical AI assurance, model testing or bias auditing
• Sector-specific regulatory approval
• Advice on non-UK regulatory regimes beyond flagging where they apply
• Ongoing regulatory monitoring

Questions I am often asked

Can our developers use AI coding assistants?

On approved business tiers whose terms exclude training on your code and limit retention, with secrets kept out of the context and the assistant disabled in repositories that hold them. Consumer tools are out for anything touching the codebase.

Who owns the code the assistant generates?

The law is unsettled for code with no human author; the policy requires review and records of the human contribution, and the employment and contractor terms assign whatever rights arise to the company. Licence scanning catches reproduced open-source code before it reaches the product.

Can we train our product's models on customer data?

Only where the customer has agreed in terms that say so. A general 'service improvement' clause is not that, and your model providers' terms must exclude their own training on your customers' data. The contract provisions put the position in the customer terms and the supplier agreements.

Related guidance and services

• AI contracts and AI use policies, £995, the service this page describes
• Data protection agreements and privacy terms, £795
• Employment contracts and handbooks, £595
• Privacy notice for a SaaS product
• Data processing agreement for a SaaS vendor

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.