AI vendor assessment: what to get in writing before you sign

01

Your data: who may train on it

Check that the promise not to train on your data binds the vendor itself as well as the model providers behind it.

Intercom's Additional Product Terms for its AI products, which include the Fin AI Agent, say that Intercom "contractually restricts Third Party AI Providers from using Customer Data for training or otherwise improving Third Party AI Provider's services." Its guide for customer legal and security teams, a help page, adds: "We use Customer Data to improve our Services by fine-tuning specific AI models for Fin, which are then deployed in the AI Products used by our Customers." Those models are trained on anonymised customer data unless the customer asks to be opted out.

Zendesk's AI Services Addendum says that if a customer uses its generative AI services, "Service Data will not be used by any LLM Provider for any purpose other than to provide and secure the AI Services." Zendesk's AI Data Use Information help page says it sanitises customer data "before using it to train any of our models that could be used by other customers". The page describes these proprietary models as non-generative.

Salesforce's Agentforce Privacy FAQ states that Salesforce "does not currently use Customer Data to train generative AI models" and that its product terms would require customers to opt in to such training. Microsoft's FAQ for Copilot in Dynamics 365 and Power Platform says prompts and responses are not used to train Microsoft AI models "unless your tenant admin opts in to sharing data with us." Google Cloud's Service Specific Terms for its AI/ML Services say: "Google will not use Customer Data to train or fine-tune any AI/ML models without Customer's prior permission or instruction."

Public buyers write the point as a duty on the supplier. The Australian Digital Transformation Agency's AI contract template (Cloud version) for government buyers requires that the buyer's AI inputs and outputs are "not incorporated into or merged with an AI System" unless the contract says otherwise. The US Office of Management and Budget's memo M-25-22 says federal agencies' processes should ensure that contracts "permanently prohibit the use of nonpublic inputted agency data and outputted results to further train publicly or commercially available AI algorithms, consistent with applicable law, absent explicit agency consent."

02

Where each promise is written

Ask which documents form part of your agreement before relying on a product promise.

Intercom's restriction on training by Third Party AI Providers is in the AI Products provisions of its Additional Product Terms. Google Cloud's training restriction is in its Service Specific Terms for AI/ML Services. Zendesk's AI Services Addendum has its own signing process. Salesforce's Agentforce Privacy FAQ says it "is provided for informational purposes only"; Microsoft's answers are in the FAQ for Copilot data security and privacy for Dynamics 365 and Power Platform on Microsoft Learn.

03

What the agent may do, and who may change it

Write down the actions the agent may take, and ask for notice before the vendor changes the model underneath it.

In the AI Products provisions of Intercom's Additional Product Terms, the agent's output includes what it does: Output means "the results in any format, including actions taken by an AI Product, generated by an AI Product based on the Input." Salesforce's Agentforce Privacy FAQ puts the limits in the customer's own set-up: when customers assign topics to an agent, "they also specify the instructions an Agent can follow and the actions an Agent can take in relation to that topic." Zendesk's Generative AI at Zendesk help page describes its AI agents as "executing actions across connected systems". The systems the agent may reach and the actions it may take belong in the order form or its specification, where you can point to them later.

Policy updates and changes to the model need separate answers. Salesforce's Artificial Intelligence Acceptable Use Policy for its Covered AI Services says updates take effect "upon posting".

Use Case 1 in the Australian Digital Transformation Agency's AI contract template (Cloud version) addresses changes to the underlying model. The seller "must request written approval from the Buyer before any change is made to the Approved underlying AI Model" that would take it outside the agreed requirements, which cover the model's country of origin, its ownership and where data sits at rest and during processing.

The same template requires "a circuit-breaker capable of interrupting and stopping the AI System immediately", on the buyer's instruction and through a tool the buyer can use. The EU's model clauses for public buyers of non-high-risk AI, a working document in its February 2025 version, ask that the people overseeing the system can halt it through "a 'stop' button or a similar procedure".

M-25-22 asks US federal agencies to consider requiring notice before new AI features are added, and encourages them to require a roll-back to a previous version when a new version fails to meet performance standards.

04

Who owns what the agent produces

Owning the agent's output and being defended over it are separate clauses, so check both.

Between Zendesk and the customer, its AI Services Addendum makes the customer "the sole owner of all Service Data which includes Customer AI Input and AI Output." Google Cloud's Service Specific Terms, under Generative AI Services, say "Generated Output is Customer Data" and that Google "does not assert any ownership rights in any new intellectual property created in the Generated Output." Intercom's Additional Product Terms for AI Products say "Input and Output are Customer Data under the Agreement".

Intercom's Additional Product Terms for AI Products say it "makes no representations or warranties and provides no indemnities with respect to Output." Microsoft Learn's Customer Copyright Commitment Required Mitigations page describes Microsoft's obligation under its Product Terms to defend customers against certain third-party intellectual property claims about output. For Microsoft Copilot Studio, output from a model hosted outside Copilot Studio is not covered unless that model runs in Azure OpenAI and meets the required mitigations.

Google Cloud's Service Specific Terms extend indemnity to certain intellectual property claims about unmodified output from listed paid Generative AI Indemnified Services using specified Google models or adapters. The exclusions include a customer who disregards, disables or circumvents the filters and other tools Google provides for responsible use. The EU's MCC-AI-Light model clauses require the supplier to indemnify the public buyer against third-party claims over intellectual property or data protection rights arising from its use of the AI system.

05

When the agent gets it wrong

Agree how a wrong answer or action will be detected and who must respond.

Intercom's Additional Product Terms for AI Products say output "may contain material inaccuracies" and make the customer "responsible for its use of the AI Product(s) and Output"; its help-page guide for customer legal and security teams adds that "It is the Customer's responsibility to validate and test Fin's training before setting it live." Salesforce's Agentforce Privacy FAQ says the customer "assumes all responsibility for Agent output". Zendesk's AI Services Addendum makes the customer responsible for deploying the AI services for its use case, and commits Zendesk to "commercially reasonable risk assessments and testing" for inaccuracies, hallucinations and bias.

In Moffatt v. Air Canada (2024), a chatbot on Air Canada's website incorrectly said that a customer could apply for a bereavement fare retroactively. Air Canada argued that it could not be held liable for the chatbot's information. The Civil Resolution Tribunal of British Columbia found negligent misrepresentation and ordered Air Canada to pay damages. The ruling concerned the airline's information to its customer.

In Use Case 1, the Australian DTA Cloud template includes an optional requirement to notify the buyer immediately if "the AI System is malfunctioning or producing incorrect or harmful AI Outputs". It also requires logs recording "decisions made by the AI System and AI Output produced by the AI System", with access "at all times, during the Contract Period."

The EU's MCC-AI-Light clauses require testing "against prior defined metrics and probabilistic thresholds", testing in the buyer's own environment if the buyer asks, and handover at the end of the agreement of the logs the supplier holds under it. M-25-22 says vendors "must provide the access and time necessary for agencies to complete independent evaluation."

06

What to ask for in writing

Before you sign, ask the vendor to show where each of these stands in your contract.

Training: whether the vendor or its model providers may use your inputs or outputs for training, and how any permission or opt-out is recorded.

Documents: for each answer, whether it sits in the agreement, an addendum, the data processing agreement, the order form or a help page.

Actions: the systems the agent may reach and the actions it may take, written into the order form.

Change: which changes to the model or AI product terms require notice or approval, and how you can stop the agent.

Output: who owns what the agent produces, and whether an indemnity covers it and on what conditions.

Mistakes: who responds to incorrect or harmful output, which logs you can inspect during the contract and take with you at the end, and how the agent will be tested on your own cases before launch.

A company can borrow the public buyers' questions without adopting their templates, which were written for government contracts. Read your own order form and data processing agreement against these points too, since they may add to the public terms. These clauses decide who carries the risk, so have your lawyer read them before you sign.

Assess the use itself before the contract; public AI impact assessment templates show what such an assessment covers.

The contract serves a decision made earlier: which business problem the agent should solve, who owns it and how its effect will be measured. In AI consulting for leadership teams, that decision starts with one business problem with a named owner.