Desk notes · US commercial contracts · What changed
What changed: AI clauses are now standard in enterprise DPAs
A year ago it was rare. Now most US and EU enterprise buyers send a DPA that says something about AI — usually a prohibition, sometimes a disclosure requirement, occasionally both. Here is what we are seeing and how we respond.
The clause arrives in one of three forms. The strictest: the processor shall not use customer data to train, fine-tune or improve any machine-learning model. The middle: no use for training models made available to third parties. The mildest: disclose any AI or ML processing of customer data and the safeguards around it.
Why buyers ask
Partly regulation — EU and UK data-protection rules were always sceptical of processing beyond the documented purpose, and AI training is an obvious example of purpose creep. Partly reputation: no enterprise wants to discover that its customer data taught a model that a competitor now uses. And partly because a buyer’s own customers are asking them the same question, and the DPA is where the answer has to be backed by a promise.
How to answer
Honestly, and specifically. If the product uses AI on customer data — for search, summaries, suggestions — say so, describe the safeguards, and confirm the data is not used to train models offered to others. Most buyers accept that. If the product does use customer data for model improvement, the conversation is harder and the answer is usually an opt-out plus anonymisation commitments, priced into the relationship.
What not to do: accept a blanket prohibition on “any AI processing” when the product’s core feature is AI processing. That is a breach on the day of signature. We strike the blanket, replace it with a disclosure and a no-training-for-others commitment, and move on. It has not yet cost a deal.
Next step
Seen something like this on your own paper?
Send it over. Twenty minutes, marked up, explained.