The AI Contract Audit: Seven Clauses UK Buyers Should Test Before They Sign

AI is no longer a demo-day novelty. In 2026, it turns up in the tools UK teams already use: the CRM that drafts follow-up emails, the support desk that suggests replies, the finance package that reads invoices. That is useful. It is also a contract issue, because the moment a supplier processes your data through a model, the paperwork starts making promises on your behalf.

Most small UK buyers are good at testing the product. They click through the workflow, check the integrations and ask about uptime. Far fewer test the clauses that decide what happens when the model changes, when the output is disputed, or when the renewal price quietly climbs. That gap is where the expensive surprises live.

The demo is not the deal

A product demo shows capability. A contract shows responsibility. Those are not the same thing. An AI feature can look tidy in a sandbox and still leave you exposed if the supplier trains on your data, changes the model without notice, or hands you output with strings attached.

This is not about turning every software purchase into a legal project. It is about asking a handful of plain-English questions early, while you still have negotiating room. Once the contract is signed, your leverage usually disappears until renewal.

Clause one: training data, in plain English

The first question is simple: does the supplier use your data to train, fine-tune or improve models? If yes, ask which data, for which models, and whether that use continues after the contract ends. 'Aggregated and anonymised' sounds reassuring, but it is worth checking how the supplier defines it.

For UK teams handling personal data, this is also a UK GDPR question. You need to know whether the supplier is acting as a processor, what instructions cover the AI processing, and whether a data protection impact assessment is needed. The ICO has been clear that AI processing does not get a free pass just because it is clever.

A useful test: ask the supplier to point to the exact clause that says your customer data will not be used for model training. If the answer is a blog post or a sales deck, keep asking.

Clause two: who owns the output?

AI output ownership is often described as 'yours', but the detail matters. Does the supplier assign rights in the output to you? Does it retain a licence to use the output? Are there restrictions on commercial use, or on using the output to build a competing model?

There is also the practical question of similarity. If two customers get similar output from the same model, who owns what? Most suppliers will say the output is not guaranteed to be unique. That is fair, but it should be stated clearly rather than buried in a help-centre article.

A useful test: describe a real use case, such as publishing AI-assisted marketing copy or including AI-generated code in a product, and ask the supplier to confirm in writing that the contract covers it.

Clause three: opt-outs that actually stick

Many AI tools offer an opt-out from training. The key word is 'stick'. Can you opt out at account level, workspace level or only by emailing support? Does the opt-out survive a product update, a plan change or a new AI feature that is switched on by default?

Ask for the opt-out to be recorded in the contract or an agreed annex, not just in a settings menu. Settings change. Contracts are harder to move.

A useful test: ask what happens when the supplier launches a new AI feature next quarter. Will it be off by default for your account, or will someone in procurement need to notice a release note?

Clause four: model-change notices

AI models change. That is normal. The problem is when a supplier swaps a model, changes a provider or adjusts safety filters without telling you in a way that matters. A release note is not the same as a notification that affects your obligations, your outputs or your compliance position.

You want a commitment to notify you of material model changes within a reasonable period, especially where the change affects data use, output quality or subprocessors. For regulated or customer-facing work, you may want advance notice and a right to discuss the change before it goes live.

A useful test: ask the supplier to define 'material change' in the contract. If the definition is vague, propose one that covers data use, model provider and output restrictions.

Clause five: indemnities and their exclusions

AI indemnities are often marketed loudly and limited quietly. Read the exclusions before you get excited. Common carve-outs include misuse, prompts you supply, output you modify, or claims arising from your own content.

That does not make the indemnity useless. It does mean you need to know where it stops. If your team plans to publish AI-generated content, use AI in customer communications or rely on AI-assisted code, check that the indemnity actually reaches those scenarios.

A useful test: ask the supplier to walk through one realistic claim scenario from start to finish. Who defends? Who pays? What must you do? If the answer takes more than five minutes to explain, the clause may be too complicated for the risk.

Clause six: renewal pricing and AI add-on creep

AI features have a habit of moving tiers. A capability that was included at signing can become a paid add-on at renewal. A usage cap can appear. A 'fair use' policy can do a lot of work in the background.

Check the renewal clause for price uplift mechanisms, notice periods and whether AI usage is capped or metered. If the supplier can change pricing on renewal, ask for a cap or a longer fixed term. If AI usage is metered, ask for a sample invoice based on your expected volume.

A useful test: build a simple three-year cost model with your expected seat count and AI usage. If the supplier cannot explain the renewal maths, that is a warning sign.

A pre-signature test you can run in a meeting

You do not need a formal legal review for every small purchase. You do need a repeatable set of questions. Try this in the next supplier call:

• Show me the clause that covers training data and opt-outs.
• Confirm in writing that we own or can commercially use the output for our stated use case.
• Explain how you notify us of material model changes.
• Summarise the indemnity and its exclusions in plain English.
• Show the renewal pricing mechanism and any AI usage caps.

If the supplier cannot answer those five questions clearly, do not treat that as a personality problem. Treat it as missing product information.

The point is not legal theatre

The point is to buy AI with your eyes open. UK teams do not need a 40-page AI policy before they can use a drafting assistant or a support tool. They do need to know what the supplier will do with their data, what they get to keep, and what happens when the model or the price changes.

That is not pessimism. It is procurement hygiene. The best AI contract is not the one with the longest schedule. It is the one where the important promises are short enough to test and clear enough to enforce.