AI in contracts: the clauses to set when buying and supplying

Short answer: There is no separate "AI contract law", but the AI Act, product liability and the Data Act together determine what you must set in a contract. The core is role allocation, compliance warranties, documentation, liability, data and intellectual property, logging and exit. Whether you buy or supply AI, these points belong on paper.

Why the contract makes the difference

The AI Act divides duties across roles: the provider carries the heaviest package, the deployer its own set. Article 25 also provides that you become a provider yourself if you put your name on a system or substantially modify it — with all the duties that entails. The contract is where you make those roles, and their consequences, explicit before a regulator or court does it for you.

The core clauses

1. Role allocation. Set out who is provider and who is deployer, and what happens with changes that could flip the role (Art. 25).
2. Compliance warranties. Have the supplier warrant that the system complies with the AI Act (classification, conformity assessment, CE marking, and for GPAI the documentation and training-data duties).
3. Information and documentation. The provider supplies the instructions and documentation the deployer needs to meet Article 26.
4. Liability and indemnity. Allocate liability deliberately and tie it to product liability; arrange indemnities for third-party claims.
5. Data and intellectual property. Who may use input data, who owns the output, and how does that relate to Data Act rights over data generated by use?
6. Transparency and logging. Secure access to logs and relevant information for monitoring, incident investigation and audits.
7. Updates, changes and retraining. Agree how updates and retraining are made and notified — a substantial change can affect classification or role.
8. Exit and cooperation. Arrange termination, data portability and cooperation with supervisory requests.

For the buyer and the supplier

The buyer wants warranties, documentation, liability at source and a workable exit. The supplier wants to bound its responsibility — especially against changes or use outside the intended purpose, which can turn the customer into a provider. A good AI contract makes both interests explicit instead of saving them up until there is damage.

What to do

• Start with the role: provider or deployer — and what a change does to it.
• Reference the standard: have compliance with the AI Act and relevant standards warranted contractually.
• Make documentation and logging enforceable — you need them for supervision and for a liability defence.
• Settle data and output before go-live, not after.

The contract is where AI governance and AI liability meet. Get it right and you shift the risk to the party that can bear it — and know in advance who stands for what.