AI Vendors, AI Contracts, AI Risk: The Legal Questions Businesses Are Finally Asking
A company can approve an AI tool in minutes. The legal consequences of using it can take considerably longer to sort out.
Businesses now use AI to draft marketing materials, analyze contracts, write code, screen applicants, summarize customer information, and support everyday decision-making. Yet the speed of adoption can make it easy to overlook a basic question: what happens to the company's information once it enters the system?
That question leads to several others. Who owns the output? Can the vendor use company data to train its models? What happens if the system produces an inaccurate result? And who is responsible when something goes wrong?
In 2026, these are no longer theoretical concerns. They are contract, confidentiality, compliance, and governance issues.
Start by Understanding What the AI Actually Does
Not every AI tool creates the same level of legal risk. A platform generating generic marketing ideas is different from one processing customer records, employee information, proprietary source code, or confidential financial data.
Before approving an AI vendor, businesses should identify what the system does, what information it receives, how its output will be used, and who will have access to it.
Higher-Risk Uses Deserve More Scrutiny
Businesses should take particular care when AI is used to:
· Process personal or confidential information
· Analyze proprietary business information
· Generate or modify software code
· Make recommendations affecting employees or customers
· Evaluate financial, legal, or regulatory information
· Produce content that will be incorporated into products or client deliverables
The more sensitive the information and consequential the output, the more carefully the underlying technology, contract, and internal controls should be reviewed.
The AI Vendor Contract Matters
A vendor's website may promise security, privacy, and responsible AI practices. Those statements are useful, but they are not a substitute for reading the agreement.
Businesses should understand what the contract actually says about data ownership, confidentiality, security, retention, subprocessors, incident reporting, and liability. NIST's Generative AI Profile specifically recommends reviewing vendor contracts for secondary data use, liability allocation, incident notification, service levels, and other terms that can affect an organization's exposure.
A contract attorney in Los Angeles can help businesses examine whether an AI agreement adequately addresses the risks associated with the company's intended use.
Before Signing, Ask These Questions
· Can the vendor use company information to train or improve its models?
· How long does the vendor retain submitted information?
· Who can access the data?
· What subprocessors are involved?
· What happens to the company's information when the contract ends?
· How quickly must the vendor report a security incident?
· What liability does the vendor accept if its system causes harm?
The answers can vary considerably between providers. That is why "enterprise AI" or "secure AI" should not be treated as legal conclusions.
Can the Vendor Use Your Data to Train Its Models?
This may be one of the most important questions a business asks before putting sensitive information into an AI platform.
Consider a company using an AI system to summarize customer contracts. The company may assume the information is simply processed and returned. But the vendor's terms could address retention, model improvement, human review, analytics, or other secondary uses.
That creates a contractual issue as much as a technology issue.
Businesses should identify whether information is:
· Processed solely to provide the service
· Retained for troubleshooting
· Used for analytics
· Used to improve models
· Shared with third-party providers
The answer should be consistent with the company's own obligations. If a customer contract restricts how confidential information may be shared, a business should not assume an AI vendor can receive that information simply because the employee has a legitimate business reason for using the tool.
Confidentiality Rules Still Apply
AI does not create an exception to an existing confidentiality obligation.
A business may have nondisclosure agreements with customers, employees, contractors, investors, or strategic partners. It may also have obligations concerning trade secrets and proprietary information.
The Contractual Chain Should Match
If a customer expects its information to remain confidential, the business should examine whether its AI vendor agreement provides appropriate protections.
The same principle applies internally. Employees should know what information they may enter into approved AI systems and what information should remain outside them.
A short AI policy can establish practical boundaries around confidential information, customer data, proprietary technology, and approved tools. Without one, employees may make different assumptions about what is acceptable, creating inconsistent practices across the organization.
Who Owns the AI-Generated Work?
Businesses often assume that if they paid for an AI service, they automatically own everything the system produces.
That assumption deserves closer examination.
The relevant questions can include:
· What rights does the vendor grant over outputs?
· Does the vendor retain any license to use submitted information?
· Are outputs subject to additional restrictions?
· Does the company have rights to commercialize the resulting material?
· Could third-party material be incorporated into an output?
The issue becomes particularly significant when AI-generated material is used in software, advertising, product development, research, or client work.
Businesses should also distinguish between ownership questions and questions about whether particular material receives copyright protection. Those are related but not identical issues.
For technology companies, this review should extend to AI coding tools. A company using AI during software development should understand the vendor's terms and maintain appropriate review processes for generated code and third-party material.
Privacy and AI Compliance Are Becoming More Connected
Privacy compliance is becoming increasingly relevant to AI adoption, particularly for California businesses.
California's updated CCPA regulations became effective January 1, 2026. The rules address areas including privacy risk assessments, cybersecurity audits, and automated decisionmaking technology. Some requirements have phased compliance dates, with certain automated decisionmaking requirements beginning January 1, 2027.
That does not mean every business using AI is automatically subject to every requirement. It does mean companies should determine whether their particular use of AI implicates privacy obligations.
A corporate compliance lawyer in Los Angeles can help businesses evaluate questions such as:
· What personal information enters the AI system?
· Why is that information being processed?
· What rights may consumers have?
· What role does the AI vendor play in processing the information?
· Is the technology being used to make significant decisions about individuals?
· Are additional assessments, notices, or controls required?
Businesses should also pay attention to AI-specific California requirements affecting developers. For example, AB 2013 established training-data documentation requirements for covered generative AI systems made available to Californians, beginning January 1, 2026.
The distinction between an AI developer and an AI user matters, so companies should evaluate which obligations actually apply to their role.
AI Errors Can Become Business Problems
AI output can look polished while being completely wrong.
That creates a different kind of legal risk. A business might rely on an inaccurate summary, send an erroneous customer communication, use flawed research in a commercial decision, or allow an automated system to produce an inappropriate recommendation.
NIST's AI Risk Management Framework emphasizes trustworthy AI characteristics including validity, reliability, security, accountability, transparency, explainability, privacy, and fairness. Its Generative AI Profile also recommends establishing processes for monitoring third-party AI systems and responding to incidents.
Human Review Still Has a Job to Do
Businesses should determine when AI can operate independently and when a qualified person must review the output.
Human review is particularly important where AI output could affect:
· Legal rights
· Employment decisions
· Financial decisions
· Customer eligibility
· Regulatory obligations
· Material business commitments
The goal is not to prevent employees from using AI. It is to ensure that the company knows where accountability remains with people.
Build an AI Policy Before Everyone Creates Their Own
An AI policy does not need to become a 100-page corporate manual.
It should answer the questions employees are already asking.
A Practical Policy Can Cover These Areas
· Approved AI tools
· Prohibited information
· Confidentiality requirements
· Customer and employee data
· Human review
· Vendor approval
· Security expectations
· Intellectual property
· Recordkeeping
· Responsibility for final decisions
The policy should also be revisited as the company's AI use changes. A tool initially used for drafting internal emails may eventually become integrated into customer-facing operations, creating a substantially different risk profile.
Review AI Vendors Before Something Goes Wrong
The strongest time to negotiate an AI contract is before sensitive information is uploaded, not after an incident occurs.
Businesses should examine the vendor's data practices, security commitments, liability provisions, termination rights, and incident procedures before signing. NIST specifically recommends clear responsibility for incidents involving third-party generative AI, appropriate notification provisions, and service-level terms addressing incident response and availability.
The Questions Worth Asking First
· What information will the vendor receive?
· Can it use that information for another purpose?
· How is the information protected?
· What happens after termination?
· Who is responsible if there is a breach?
· What happens if the AI system changes materially?
· Can the business audit or obtain information about relevant incidents?
These questions may feel tedious when everyone is excited about the latest AI capability. They become considerably less tedious when something goes wrong.
Use AI With a Legal Strategy, Not Just a Login
AI can make businesses faster and more productive, but adopting a tool should not mean outsourcing judgment about the legal consequences. Before sensitive information enters an AI system, businesses should understand the vendor's terms, establish appropriate internal rules, protect confidential information, and determine where human oversight belongs.
At Alex Nahai Law, we help businesses address those questions before they become expensive problems. As a corporate law firm in Los Angeles, we provide practical legal guidance on contracts, compliance, governance, and technology-related business concerns.
If your business is using AI or considering a new AI vendor, call 310-697-8797 or contact Alex Nahai Law today to discuss your legal and contractual needs.
