AI Usage Policy Agreement

AI USAGE POLICY AGREEMENT

This AI Usage Policy Agreement ("Agreement") is made effective as of between Client Name: with principal place of business at , and Provider Name: with principal place of business at .

RECITALS

WHEREAS, Client engages Provider to develop, configure, host, operate, or otherwise provide access to one or more artificial intelligence systems and related services (collectively, "AI Systems"); and

WHEREAS, the parties desire to establish binding rules and procedures governing permitted uses, data handling, security, transparency, audit rights, indemnity, and termination relating to Client Data and Provider Models; and

WHEREAS, the parties agree that safe, lawful, and ethically responsible use of AI Systems is a material term of their relationship.

NOW, THEREFORE

In consideration of the mutual covenants set forth below, the parties agree as follows.

1. DEFINITIONS

For purposes of this Agreement:

"Client Data" means all information, content, documents, datasets, metadata, and other materials provided or submitted by Client to Provider for ingestion, training, inference, or processing by the AI Systems. "Provider Models" means the datasets, trained models, model weights, algorithms, code, configuration, and tooling used or developed by Provider in connection with the AI Systems. "Sensitive Data" includes personal data requiring special protection under applicable law, health information, financial account information, government identifiers, and other high-risk categories identified in writing by the parties.

2. AI SYSTEM CLASSIFICATION AND SCOPE

The parties acknowledge the type(s) of AI System(s) covered by this Agreement:

Generative models (text, images, audio)    Predictive analytics    Classification / Recognition    Other:

3. PERMITTED USES

Provider is authorized to use Client Data and Provider Models only as expressly set forth in this Agreement and only to perform services for which Provider has been engaged. Permitted uses include development, testing, deployment, inference, maintenance, and improvement activities necessary to provide contracted deliverables. Any use outside the scope of the parties’ written statement of work or accepted change order is expressly prohibited absent separate written consent.

4. PROHIBITED USES

The following uses are prohibited without Client's prior written consent: (a) any use that violates applicable law or regulatory requirement; (b) unauthorized surveillance, discriminatory decision-making, or other practices that create unjustified disparate impacts; (c) re‑commercialization of Client Data as a stand‑alone dataset for training third‑party models; (d) disclosure or exposure of Sensitive Data in model outputs; and (e) any purpose expressly identified in writing by Client as prohibited.

5. DATA HANDLING, PRIVACY, AND RETENTION

Provider will process Client Data only on documented instructions from Client and in compliance with applicable data protection law. Provider shall implement reasonable technical and organizational measures to protect Client Data against unauthorized or unlawful processing and accidental loss, destruction, or damage. Provider will retain Client Data only for the period necessary to perform the services or as otherwise required by law; upon expiration or termination the Provider will, at Client's election, return or securely delete Client Data and provide certification of deletion where practicable.

6. MODEL GOVERNANCE, MONITORING, AND TRANSPARENCY

Provider shall maintain records sufficient to demonstrate compliance with this Agreement, including versioning of Provider Models used for Client work and logs of significant model updates that materially affect output characteristics. Provider will notify Client in writing of any model changes that meaningfully alter risk profile or accuracy of outputs and will provide reasonable information about model provenance, training data categories, and performance metrics upon Client's written request, subject to protection of Provider's trade secrets and proprietary materials.

7. SECURITY MEASURES

Provider shall implement, maintain, and periodically test administrative, technical, and physical safeguards appropriate to the sensitivity of Client Data, including access controls, encryption at rest and in transit, vulnerability management, incident response procedures, and employee security training. The measures shall be no less protective than industry standards for cloud service providers offering AI services.

8. AUDIT RIGHTS

Client shall have the right, upon reasonable prior notice and during regular business hours, to inspect and audit Provider's relevant records and security controls to verify compliance with this Agreement. Any audit shall be conducted in a manner that minimizes disruption to Provider's operations, and Client shall treat any non-public information obtained as confidential. Provider may charge a reasonable fee for audits occurring more frequently than once per calendar year unless a material breach is suspected.

Audit scope and specifics:

9. INTELLECTUAL PROPERTY

As between the parties, Client retains all right, title, and interest in and to Client Data. Provider retains all right, title, and interest in and to Provider Models and Provider's pre-existing technology, except that Provider grants Client a non-exclusive, non-transferable license to results, deliverables, and non-proprietary model outputs as expressly set forth in the applicable statement of work. Any improvements developed exclusively from Client Data shall be treated as mutually agreed in writing; where Provider claims intellectual property derived from improvements, Provider grants Client a perpetual, royalty-free license to use such improvements to the extent necessary for Client to exploit the deliverables.

10. LIABILITY AND INDEMNIFICATION

Each party shall be liable for direct damages arising from its breach of this Agreement. Provider's aggregate liability for direct damages arising from or related to this Agreement shall be limited to , except that this limitation shall not apply to claims arising from willful misconduct, gross negligence, or infringement of intellectual property rights. Provider shall defend, indemnify, and hold Client harmless from third-party claims resulting from Provider's breach of confidentiality obligations or unauthorized processing of Client Data, subject to the procedures set forth below.

11. TERM AND TERMINATION

This Agreement commences on the effective date above and continues until terminated by either party in accordance with this Section. Either party may terminate for convenience upon days' prior written notice. Either party may terminate immediately upon written notice in the event of a material breach that remains uncured for thirty (30) days after receipt of written notice specifying the breach.

12. NOTICES

All notices under this Agreement shall be in writing and delivered to the address set forth below or to such other address as a party designates by written notice to the other party.

13. AMENDMENTS; WAIVER

This Agreement may be amended only by a written instrument signed by authorized representatives of both parties. No delay or failure to exercise any remedy or right will constitute a waiver unless expressly set forth in a written waiver signed by the waiving party.

14. GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of , without regard to its conflicts of law rules. The parties submit to the exclusive jurisdiction of the courts located in the chosen jurisdiction for disputes arising from this Agreement.

15. ENTIRE AGREEMENT

This Agreement, together with any statements of work, exhibits, and schedules executed by the parties, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, representations, and understandings, whether written or oral.

16. SEVERABILITY

If any provision of this Agreement is held to be invalid or unenforceable, such provision shall be reformed to the extent necessary to make it valid and enforceable, or if reformation is not possible, such provision shall be severed, and the remainder of the Agreement shall remain in full force and effect.

17. COUNTERPARTS

This Agreement may be executed in counterparts, each of which will be deemed an original and all of which together will constitute one instrument. Signatures delivered by electronic means shall be effective as original signatures.

18. MISCELLANEOUS

The parties acknowledge that this Agreement creates no partnership, joint venture, employment, or agency relationship. Neither party may assign its rights or delegate obligations under this Agreement without the prior written consent of the other, except to an affiliate or in connection with a merger or sale of substantially all assets, provided the assignee assumes all obligations hereunder.

Sign Now