Read
3 minute read
July 23, 2026
3 minute read
Software vendors design their agreements to protect their own interests while sometimes remaining silent as to the customer's rights and interests. Most customers sign them as presented. Time and leverage are limited, and no legal team can negotiate every clause — nor should it try. The practical answer is triage: find the questions with the greatest consequences, and raise them when the vendor is most likely to listen.
Renewal is that moment. The vendor has revenue at risk and a deadline it cares about. The three questions below are worth raising before the deadline for giving notice of non-renewal.
1. Will the Vendor Train AI on Your Data?
The agreement should state precisely what the vendor may do with customer data for AI development. The restrictions should apply to the vendor's affiliates, subprocessors, and the third-party model providers behind the vendor's AI features. The vendor's default terms rarely do any of this. Standard data-use grants often permit the vendor to use “aggregated” or “de-identified” data to “improve the services”—terms that are usually left undefined. The agreement may also reserve the vendor's right to amend its online terms unilaterally.
To close these gaps, the agreement should do four things:
Define the operative terms. For example, state that "de-identified" data must be stripped of identifiers so that it cannot reasonably be re-associated with the customer, and that "aggregated" data must be combined with data from other sources so that no output is attributable to the customer.
Exclude model training from "improving the services." That phrase should not silently license the vendor to train, fine-tune, or evaluate models using customer data.
Extend every restriction to the vendor's affiliates, subprocessors, and third-party model providers.
Prohibit unilateral amendments. Require any amendment to be made in a writing signed by both parties, so that no online update or continued-use provision can expand the vendor's rights after signing.
2. Can You Get Your Data Back When the Agreement Ends?
The agreement should specify the format, scope, timing, and cost of retrieving the customer's data. What will be exportable, and in what format? For how long after expiration or termination will it remain available? Is transition assistance available, and does it cost extra? The agreement should also state when the vendor will delete the customer's data and whether it will certify that deletion in writing.
The default agreement may say only that the customer "may export its data" while remaining silent on these crucial details.
3. Will the Vendor Indemnify You for AI Output?
Software vendors typically agree to defend customers against third-party claims that the vendor's software or services infringe intellectual property rights. That protection may cover claims directed at the AI technology or service itself, but it may not cover a claim that a particular image, passage, recording, or code sample generated by the service infringes someone else's rights.
The distinction often depends on the indemnity's defined scope. Coverage of the "Services" or "Vendor Technology" does not necessarily include "AI Output." The agreement should therefore state expressly whether the vendor will defend and indemnify the customer against claims arising from its authorized use or distribution of AI Output.
Do not confuse ownership with indemnification. A provision stating that the customer owns the AI Output allocates rights between the vendor and the customer. It does not establish that the AI Output is original, non-infringing, or copyrightable, and it does not determine who must defend a third-party claim. Even if the agreement attempts to assign AI Output to the customer, the vendor can still indemnify the customer against specified AI Output-related claims.
Any AI Output indemnity will likely include conditions and exclusions. For example, it may exclude claims arising from prohibited or unauthorized uses of AI Output, modifications to the AI Output, combinations with other materials, or the use of the AI Output as input into another AI model. Confirm as well whether the indemnity is subject to the general liability cap, a higher super-cap, or no cap at all. An IP indemnity limited to a small amount of subscription fees may cover only a fraction of the cost of defending a single infringement claim. The agreement should identify these conditions clearly so that the customer understands when the protection applies — and when it does not.
The Takeaway
These three questions share a theme: some of the most consequential risks arise from what the vendor's standard agreement leaves unsaid. Silence about AI training, data retrieval, and AI Output indemnification may not become a problem until the customer's data has already been used, a migration is underway, or an infringement claim has arrived.
Renewal is often the best time to address those gaps because the vendor has revenue at stake and the customer still has the option not to renew. The objective is not to renegotiate every clause. It is to secure clear limits on AI training, workable data-retrieval rights, and an IP indemnity that states whether the vendor stands behind the AI Output its service generates.
This post is for informational purposes only and does not constitute legal advice.
