AI Contract Clauses for Australian Business: What to Look For

Why the contract matters beyond the marketing page

A vendor's public marketing and trust centre pages describe general practices, but the actual contract, usually called Terms of Service, a Data Processing Addendum, or an Enterprise Agreement, is what's legally binding if something goes wrong. These documents are rarely read closely before signing, and AI vendor contracts specifically often contain training-data and liability terms that differ meaningfully from what the marketing implies.

Training data use: read this clause specifically

Look for explicit language about whether your business's data, prompts, and outputs are used to train or improve the vendor's models. Many enterprise or business tiers now include an opt-out or an outright commitment not to train on customer data, but this is often a higher-tier feature, not a default across every plan the same vendor offers. Confirm which specific plan you're actually signing up for carries this commitment, not just what the vendor's general policy page states, as our ChatGPT for Business review shows for one major vendor's terms.

Liability caps and what they actually cover

Most vendor contracts cap their liability at a modest multiple of fees paid, often 12 months' subscription cost, regardless of the actual damage a data breach or major failure might cause your business. This is standard practice across the software industry, not unique to AI vendors, but it's worth understanding what you're actually agreeing to: if the tool causes a serious problem, your practical recourse may be limited to a refund-scale amount, not the true cost of the incident.

What happens to your data when you leave

Check specifically what the contract says about data deletion on termination or non-renewal. Some vendors default to deleting data after a defined period, others retain it indefinitely unless you explicitly request deletion, and the difference matters if your business ever needs to demonstrate that former vendor relationships no longer hold your data. Get this in writing rather than assuming standard practice applies.

Unilateral changes to terms

Many standard-form contracts allow the vendor to change terms, including data handling terms, with only notice via email or a website update, not your explicit consent. For a business relying on a specific data-handling commitment as part of its own compliance posture, this is worth negotiating for anything beyond a low-stakes tool, ask for a clause requiring your active agreement before any change to data-related terms specifically, even if other terms remain subject to standard notice.

What's actually negotiable

Standard-form terms for a small monthly subscription are rarely negotiable, vendors won't rewrite a contract for a single small customer. For a larger annual commitment or an enterprise-tier plan, training data opt-out, liability caps, and data deletion commitments become genuinely negotiable points, and it's reasonable to ask, even as a smaller business. The worst outcome of asking is being told no.

Output ownership and IP indemnification

Two related clauses worth checking that get less attention than data and liability terms: who owns the content the AI tool generates for you, and what happens if that output turns out to infringe someone else's intellectual property. Most mainstream AI vendors now assign ownership of generated output to the customer by default, but confirm this is stated explicitly rather than assumed, particularly for older or smaller vendors where the contract may be silent on the point entirely. Separately, check whether the vendor offers any indemnification if their tool generates content that later turns out to closely match existing copyrighted material, some enterprise-tier agreements now include this protection specifically, while standard consumer terms typically do not. If your business publishes AI-drafted content externally at any volume, this gap is worth knowing about before it becomes a live problem rather than a theoretical one.

A short negotiation approach for the terms that matter most

If you're negotiating an annual or enterprise-tier agreement, a simple approach works better than trying to renegotiate the entire contract. Pick the two or three clauses that matter most for your specific business, training data use is usually top of the list for anything handling client information, and raise them directly and specifically rather than asking for a general review. Ask for the change in writing as a contract amendment or side letter, not just a verbal confirmation from a sales representative, since only the written contract terms are actually enforceable if a dispute arises later. Vendors selling to business customers generally expect this kind of negotiation on a few specific points, it's a normal part of enterprise sales, not an unusual request that risks the relationship.

Related reading: our can staff upload customer data to AI tools and our AI vendor contracts and Privacy Act.

Related reading: our AI governance by region.

Try our free AI Compliance Checker to check whether your AI tools meet your compliance obligations.

For the broader vendor assessment picture beyond contract clauses, see our AI vendor due diligence hub.

Do I need a lawyer to review every AI vendor contract?

For a low-cost, low-stakes tool, reading the key clauses above yourself is usually sufficient. For anything handling sensitive client or financial data, or any meaningful annual spend, a lawyer's review is a reasonable investment relative to the risk.

Are liability caps in AI vendor contracts unusual or a red flag?

No, they're standard practice across most software contracts, not specific to AI or a sign of a bad-faith vendor. The point isn't to avoid liability caps entirely, it's to understand what they mean for your actual risk exposure.

What's the single most important clause to check if I only have time for one?

Training data use. It has the broadest ongoing implication for your business's information and is the one most likely to differ meaningfully between plan tiers of the same vendor.

Who owns content an AI tool generates for my business?

Most mainstream AI vendors assign ownership of generated output to the customer by default on business and enterprise plans, but confirm this explicitly in the contract rather than assuming it, especially for smaller or newer vendors where the terms may not address it directly.

Should I be worried about an AI tool generating content that infringes someone else's copyright?

It's a real, if generally low-probability, risk worth understanding rather than ignoring, particularly for content published externally at scale. Check whether your vendor's contract offers any indemnification for this scenario, and if not, factor that gap into how much independent verification you apply before publishing AI-drafted content.