20 drafting starting points for vendor, employment, customer and partner agreements — each with its legal basis and what you risk by leaving it out.
Showing 20 of 20 clauses.
When you need it: You share customer data with an AI vendor (chatbot, analytics, etc.)
Draft language
Vendor shall not use Customer Data, including any output, feedback, or derivatives thereof, to train, fine-tune, improve, or benchmark any AI model, without express prior written consent from Customer. This prohibition applies to all subprocessors engaged by Vendor.
Legal basis
GDPR Article 28(3)(b); EU AI Act Article 10(5)
Risk if omitted
Your customer data used to train competitor AI models. GDPR violation if personal data involved.
When you need it: Vendor AI makes decisions affecting your customers
Draft language
Vendor shall not make solely automated decisions that produce legal effects or similarly significantly affect individuals without: (a) notifying Customer in advance; (b) providing Customer with the technical means to implement Article 22 GDPR safeguards; and (c) enabling human review of all such decisions on request.
Legal basis
GDPR Article 22; EU AI Act Annex III
Risk if omitted
Regulatory liability for automated decisions affecting individuals without human oversight.
When you need it: Vendor provides a high-risk AI system
Draft language
Where the AI System supplied hereunder falls within the scope of Annex III of EU Regulation 2024/1689 (EU AI Act), Vendor warrants that it has completed and maintains the applicable conformity assessment, holds a valid CE marking, is registered in the EU database of high-risk AI systems, and will provide Customer with all documentation required by Articles 11–13 upon request.
Legal basis
EU AI Act Articles 11, 43, 49; Annex III
Risk if omitted
Customer faces joint liability as deployer of unassessed high-risk AI system.
When you need it: Vendor must notify you of AI-related serious incidents
Draft language
Vendor shall notify Customer within 24 hours of becoming aware of any serious incident involving the AI System as defined in EU AI Act Article 3(49), including any breach, unexpected behavior, or near-miss event. Vendor shall provide a written incident report in time for Customer to meet the applicable EU AI Act Article 73 tier (2, 10, or 15 days depending on severity) and shall cooperate fully with Customer's regulatory notification obligations, including the separate GDPR Article 33 72-hour breach-notification window where personal data is involved.
Legal basis
EU AI Act Article 73; GDPR Article 33
Risk if omitted
Missing regulatory notification deadlines (GDPR: 72h; EU AI Act: 2/10/15-day tiered window depending on severity).
When you need it: You need data to stay in the EU
Draft language
Vendor shall store and process all Customer Data exclusively within the European Economic Area (EEA) unless Customer provides express prior written consent to a specific third-country transfer accompanied by appropriate safeguards under GDPR Chapter V. Vendor shall immediately notify Customer of any proposed change to processing locations.
Legal basis
GDPR Chapter V; EU AI Act Article 57
Risk if omitted
Personal data transferred to inadequate third countries; potential GDPR fines up to 4% global turnover.
When you need it: Vendor uses sub-vendors to deliver the AI service
Draft language
Vendor shall: (a) maintain an up-to-date list of all subprocessors at [URL]; (b) notify Customer no less than 30 days before engaging any new subprocessor; (c) impose data protection obligations on each subprocessor no less protective than those in this Agreement; and (d) remain liable to Customer for the acts and omissions of each subprocessor.
Legal basis
GDPR Article 28(2); EU AI Act Article 25
Risk if omitted
Hidden data sharing with unvetted third parties; GDPR controller liability for subprocessor breaches.
When you need it: Vendor provides AI-generated content you will use or publish
Draft language
Vendor acknowledges that outputs generated by the AI System may be inaccurate, incomplete, or inconsistent ("AI Errors"). Vendor shall: (a) document known error rates in the Technical Documentation; (b) implement human review requirements for specified high-stakes outputs; (c) not warrant that any AI output is accurate, and Customer assumes all risk of use without appropriate human review.
Legal basis
EU AI Act Article 13 (transparency); Consumer Protection Law
Risk if omitted
Publishing AI hallucinations as fact; consumer protection and defamation liability.
When you need it: You need to verify vendor compliance
Draft language
Customer, or its designated third-party auditor, shall have the right to audit Vendor's data processing facilities and practices no more than once per calendar year upon 30 days' written notice, or at any time following a confirmed or suspected security incident. Vendor shall cooperate fully and bear reasonable costs of making relevant records and personnel available.
Legal basis
GDPR Article 28(3)(h); ISO 42001 §9.3
Risk if omitted
Unable to verify compliance; regulators may hold you liable for unverified vendor practices.
When you need it: All employees using AI tools at work
Draft language
Employee acknowledges receipt of the Company's AI Usage Policy [Policy Reference] and agrees to comply with its terms, including restrictions on: (a) inputting confidential, personal, or client data into unauthorized AI tools; (b) presenting AI-generated content as original work without disclosure; and (c) using AI systems not approved by the IT Security team. Violations may result in disciplinary action up to termination.
Legal basis
Employment law; GDPR Article 32; EU AI Act Article 4 (AI literacy)
Risk if omitted
Employees share trade secrets with AI vendors; no contractual basis for discipline.
When you need it: You use AI tools in your recruitment process (NYC employers)
Draft language
Where the Company uses any automated employment decision tool (AEDT) in the hiring or promotion process, candidates will be notified at least ten business days before the assessment. Candidates may request an alternative selection process or information about the tool's qualifications screened. Annual bias audits will be conducted by an independent auditor and results published on the Company's website.
Legal basis
NYC Local Law 144 (2023); EU AI Act Annex III §4; EEOC Guidance
Risk if omitted
NYC civil penalties: $500 for a first violation, $500-$1,500 for each subsequent violation (each day counts separately); EEOC enforcement action for discriminatory AI screening.
When you need it: Employees use AI to create work product
Draft language
Work product created by Employee using AI tools in the course of employment shall be owned by the Company, subject to the same work-for-hire provisions as non-AI work. Employee warrants that: (a) all AI-generated work complies with the applicable AI tool's terms of service; (b) no copyrighted third-party training data is reproduced in a manner that would infringe copyright; and (c) Employee has reviewed all AI-generated work for accuracy before submission.
Legal basis
Work-for-hire doctrine; EU AI Act Article 50 (transparency); EU Copyright Directive Article 4
Risk if omitted
Unclear IP ownership; copyright infringement risk from AI-reproduced training data.
When you need it: You monitor employee AI tool usage
Draft language
Employee acknowledges that the Company may monitor usage of Company-approved AI tools and systems for security, compliance, and quality purposes, subject to applicable privacy laws. Where legally required, the works council/employee representatives have been consulted regarding this monitoring. Monitoring results may be used in performance management or disciplinary proceedings.
Legal basis
EU Regulation 2016/679 (GDPR) Article 88; Works Council Act; ePrivacy Directive
Risk if omitted
Monitoring without consent unlawful in many EU jurisdictions; evidence inadmissible in disputes.
When you need it: Your product generates AI content for customers
Draft language
Our AI features generate content based on machine learning models and may produce inaccurate, incomplete, or inappropriate outputs. You are responsible for reviewing all AI-generated content before use. We do not guarantee the accuracy of AI outputs and accept no liability for decisions made based on AI-generated content without appropriate human review.
Legal basis
EU AI Act Article 50; Consumer Protection Law; Limitation of Liability
Risk if omitted
Unlimited liability for AI errors relied upon by customers; consumer protection enforcement.
When you need it: Customers submit content to your AI
Draft language
You shall not submit to our AI system: (a) personal data of individuals without their consent; (b) data that would constitute a hate crime, child exploitation material, or content prohibited by applicable law; (c) confidential information of third parties; (d) biometric data, health data, or special category data without express written authorization from us. We may terminate your access for violations without refund.
Legal basis
GDPR Article 9; EU AI Act Article 5; Terms of Service enforcement
Risk if omitted
Your platform processes illegal content; you bear liability as controller for illegal data processing.
When you need it: Business customers use your high-risk AI system
Draft language
Business customers deploying this AI System in an EU AI Act Annex III context must: (a) designate a human reviewer for all high-risk outputs; (b) conduct and maintain a Fundamental Rights Impact Assessment; (c) log AI System usage and maintain logs for a minimum of 6 months; (d) notify Aegis Digital Systems of any serious incident within 24 hours. Failure to comply may result in suspension of access.
Legal basis
EU AI Act Articles 26, 27, 29; Annex III
Risk if omitted
Business customers non-compliant as deployers; joint liability with provider.
When you need it: You resell or distribute AI services through partners
Draft language
Partner shall flow down to all end customers all obligations required by the EU AI Act, GDPR, and other applicable AI regulations applicable to deployers. Partner shall not represent that the AI System has any compliance certification not expressly confirmed in writing by Provider. Partner shall indemnify Provider for any liability arising from Partner's failure to comply with applicable AI regulations or to pass through required deployer obligations.
Legal basis
EU AI Act Article 25 (distributor obligations); GDPR Article 28
Risk if omitted
Provider liable for partner's non-compliance with deployer obligations throughout supply chain.
When you need it: You and a partner jointly develop an AI model
Draft language
Pre-existing IP contributed by each party remains owned by that party. Jointly developed AI models, training data sets, and derived works shall be jointly owned in equal undivided shares unless otherwise agreed in a signed Statement of Work. Each party may exploit jointly owned IP without accounting to the other, except: (a) neither party may grant exclusive licenses without the other's consent; (b) each party shall mark jointly owned outputs as such.
Legal basis
EU AI Act Article 28 (provider obligations for jointly developed systems); IP Law
Risk if omitted
Disputed IP ownership; partner claims exclusive rights to jointly developed AI; lock-in risk.
When you need it: You hire freelancers who may use AI to complete work
Draft language
Contractor shall disclose to Client, prior to delivery, any use of generative AI tools (including but not limited to ChatGPT, Claude, Gemini, or Midjourney) in the creation of deliverables. Client reserves the right to request non-AI alternatives or to accept AI-assisted work with appropriate acknowledgment. Undisclosed AI use that violates Client's brand guidelines or publication standards constitutes a material breach.
Legal basis
Transparency obligations; FTC Disclosure Requirements; EU AI Act Article 50
Risk if omitted
Client publishes work as entirely human-created; FTC disclosure violations; plagiarism disputes.
When you need it: Freelancers handle your confidential data
Draft language
Contractor shall not input Client's confidential information, trade secrets, personal data, or non-public business information into any third-party AI tool, LLM, or cloud AI service. Contractor may use AI tools approved in writing by Client on a project-by-project basis. This obligation survives termination of this Agreement for a period of 5 years.
Legal basis
Trade secret law; GDPR Article 28 (processor obligations); NDA provisions
Risk if omitted
Trade secrets ingested into AI training datasets; irreversible confidentiality breach.
When you need it: Freelancer delivers AI-generated creative work
Draft language
Contractor warrants that all deliverables: (a) do not infringe the intellectual property rights of any third party; (b) comply with the terms of service of any AI tool used in their creation; (c) have been reviewed by Contractor for copyright infringement risks arising from AI training data; and (d) are disclosed as AI-assisted per Clause [X] above. Contractor shall indemnify Client for claims arising from breach of this warranty.
Legal basis
EU Copyright Directive; US Copyright Office AI guidance; IP indemnification
Risk if omitted
Copyright infringement claims against your business for AI-reproduced third-party content.
Aegis Firma generates complete AI-ready DPAs, vendor terms and AI policies from your actual profile — and keeps them current as the law moves.
Start free