Training rights on your data
Whether the vendor may use your content, your customers' content, or your prompts to improve their models and whether opting out is on by default or something you must request.
Risk topic
You Didn't Buy an AI Vendor. You Have Several.
Nobody at your company signed a contract for an AI system. Your existing vendors just added one, updated their terms, sent an email nobody opened and kept billing you the same amount.
Where the AI actually came from
Your scheduling tool got a smart assistant. Your CRM started writing follow ups. Your phone system started summarizing calls. Your document platform started answering questions about your files.
Chances are nobody on your team evaluated any of that. It arrived in a release note and the terms that govern it were updated on a page you accepted the moment you kept logging in.
- AI features switched on by default in existing software
- Subprocessors added to a vendor's list without telling you
- Call recording and transcription built into your phone system
- Assistants inside your CRM, help desk, or document storage
- Tools your contractors and agencies use on your work
- Free tiers your team signed up for with a company email
The contract you signed disclaims the part you care about
The clause that matters most is usually the one about liability.
Read almost any vendor agreement and you will find the same shape: the vendor makes no promise the output is accurate, disclaims responsibility for how you use it, caps their liability at roughly what you paid them last year and leaves you to defend any claim that follows. The obligations that attach to your customers, your regulators, and your license stay entirely with you.
So the deal is simple. They build it, you rely on it and when it produces something wrong, you own the consequence. That is just what the paperwork says. Most businesses have never read that far down the page.
The Signal
These are the terms that decide your exposure. They are worth finding before you need them.
Retention and deletion
How long inputs and outputs are stored, whether deletion is real deletion and what happens to your data when you leave.
Subprocessors and model providers
Which third parties your vendor passes your information to, whether they notify you before adding one and whether you can object.
Indemnification for output
Some vendors now indemnify customers against intellectual property claims arising from generated output. Many do not and the ones that do attach conditions you must actually meet.
Accuracy disclaimers and liability caps
Many agreements disclaim accuracy and cap total liability at fees paid. That cap is the real ceiling on any recovery no matter the size of the harm.
Regulated-data terms
Health, financial, biometric, and student information usually require specific contract terms. A general subscription agreement is rarely enough on its own.
Why It Matters for your business
Your obligations do not transfer with the software. If a regulator, a client, or a court asks who was responsible, the answer is the business that used the output.
Enterprise buyers now push these same questions down to you. When a large customer asks about your AI subprocessors and retention, you are answering for your vendors' terms as if they were your own, because for that purpose they are.
And these terms move. Vendors update them, add subprocessors, and change defaults on their own schedule. The version you reviewed at signing may not be the version you are operating under today.
Prepare Now
- List every vendor that has added AI features to a product you already use, including the ones you did not ask for.
- For each one, find the answer to three questions: do they train on our data, how long do they keep it and who else sees it.
- Turn off AI features you do not need, especially in tools that hold customer or regulated information.
- Ask for the data processing terms in writing. A marketing page won't hold up.
- Check whether your vendor indemnifies you for output and what conditions that indemnity depends on.
- Put a calendar reminder to re-read the terms of your top vendors, because they change without a signature.
The Evidence Test
A client's security team sends you a questionnaire on Monday. Can you answer from your records?
- Which of your vendors process your data with AI and which subprocessors do they use?
- Which of them train on your content and where is that written down?
- What are your deletion rights and has anyone ever tested them?
- What is the liability cap in each agreement and who signed off on accepting it?
- When did each vendor last change its terms and who reviewed the change?
How AI Governance Rule Watch™ keeps that record for you
When a client, insurer, or auditor asks how your business handles AI, you don't have to dig through email. You open your account and show them.
Governance Score
A quick read on where your business stands: what's missing, what's overdue, and what needs your attention next.
Living AI Tool Roster
A list of every AI tool your team uses and the rules for each one. If you stop using a tool, you keep the date, the reason, and who signed off.
Document Studio
Ready-to-adopt policies and notices, including a staff policy, client notice, vendor rider, and incident protocol. You start from a finished draft.
Check-ins and reviews
Weekly and monthly check-ins plus 3-, 6-, and 12-month Governance Reviews of your whole AI program, with reminders. When your insurer asks when you last reviewed how your business uses AI, you have the date.
Evidence Vault
A list of the records you keep, when each was last reviewed and what's due next. You never upload client files.
Diligence Ledger
A dated history of every review, decision, and policy you adopt. You can't go back and rewrite or delete completed entries and corrections keep the original history, which is why an auditor can rely on it.
One-Click AI Governance Status Report
One click produces an Auditor report and a Stakeholder report you can hand to a regulator, insurer, client, or partner the same day.
Rules watched for you
1,200+ official sources, including agencies, all 50 states, courts, and licensing boards, turned into plain-English action items.
Could you show your work tomorrow?
Vendor terms change without much warning. The rules that decide whether those terms are good enough for your business are set by your industry, your state, and the customers you serve. AI Governance Rule Watch™ is built to track those changes for you so you are never finding out about a new clause the hard way.
Enterprise AI governance platforms cost tens of thousands a year and are built for companies with compliance departments. A one-time memo from counsel goes stale as soon as the next rule lands. AI Governance Rule Watch™ is built for businesses like yours. We watch the official sources, tell you what to do, give you the policies, and keep a dated record of what you did. See how we compare.
Get your AI governance in order.
When an AI tool causes a problem, your client blames you. AI Governance Rule Watch™ watches the rules that apply to your business, tells you what to do about them, gives you the policies and keeps a dated record of the work. When a regulator, client, insurer, or licensing board asks, you can answer the same day.
Founding member rate. Cancel anytime. Plus applicable taxes. Renews until canceled. Not legal advice and not a compliance certification.
This guide is not legal advice. See our legal disclaimer.