Knowledge centre · AI procurement

AI addendum for SaaS contracts: six sample clauses

Your SaaS vendor has added AI, but your contract is silent on it. An AI addendum fixes that — without renegotiating the entire contract. Six clauses that belong in it, with sample wording as a starting point.

Digital Sourcing B.V. · Updated August 2026 · Reading time ± 6 min

Why an addendum and not a new contract?

Most SaaS contracts were signed before the vendor added AI features. So the contract regulates nothing about data use for model training, liability for AI output, or the right to decline new AI features. Negotiating a whole new contract is rarely feasible — an addendum is. The natural moment is a renewal, expansion or price change: that's when you have room to negotiate.

Below are the six topics that belong in every AI addendum, each with a sample clause. The wording is a starting point for negotiation, not a ready-made legal product.

1. Data use and model training

The most important clause. Without an agreement, the vendor can use your data (prompts, documents, usage data) to train its models — putting your business information into a model that also serves your competitors.

Sample clause
Vendor uses Customer Data, including inputs, outputs and usage data, solely to provide the Service to Customer. Use of Customer Data to train, fine-tune or improve (foundation) models of Vendor or third parties is not permitted, unless Customer gives prior written consent for a specific purpose.

2. Transparency and notice of new AI features

AI often arrives via a routine update ("shadow AI"). This clause forces the vendor to tell you before it's switched on.

Sample clause
Vendor informs Customer in writing at least 30 days before activation of new or changed AI functionality in the Service, including its purpose, the data categories processed and the underlying model. New AI functionality is off by default (opt-in) for Customer's environment.

3. Liability for AI output

Standard terms almost always exclude liability for AI output entirely. A full reversal is rarely achievable, but a reasonable middle ground is.

Sample clause
Vendor warrants that the AI functionality performs in accordance with the Documentation. Liability limitations in the Agreement remain in full force, provided that exclusions of liability do not apply to damage resulting from breach of clause 1 (data use) or of applicable law, including Regulation (EU) 2024/1689 (the AI Act) and the GDPR.

4. Sub-processors and third-party AI

Your vendor often sources its own AI from a third party (a model provider). Without an agreement, you don't know who is processing your data — and that can change without notice.

Sample clause
Vendor maintains an up-to-date overview of third parties whose AI models or AI services form part of the Service, including country of establishment and role. Engaging a new AI subcontractor requires prior written notice to Customer; Customer may raise a reasoned objection within 14 days. Vendor imposes the obligations under this addendum on these third parties in full.

5. EU AI Act compliance

The regulation places obligations on the provider of the AI system, but you as a user must be able to demonstrate that your vendors comply. Put the burden of proof where it belongs.

Sample clause
Vendor complies with its obligations under Regulation (EU) 2024/1689 (the AI Act) and provides Customer, upon first request, with the information and documentation Customer reasonably needs for its own compliance, including the risk classification per AI system and, where applicable, the EU declaration of conformity.

6. Exit and data portability

AI features create new lock-in: prompts, configurations, trained variants and generated output. Settle upfront, in the addendum, what you take with you on exit.

Sample clause
Upon termination of the Agreement, regardless of the reason, Vendor provides all Customer Data — including output generated by or with the AI functionality and configurations made by Customer — within 30 days in a common, machine-readable format, and demonstrably deletes it from its systems, including backups, within 90 days.
Note: these sample clauses are a negotiation starting point from a procurement perspective, not legal advice. Have the final addendum reviewed by a lawyer with IT-law expertise — especially for high-risk applications under the AI Act.

How do you get the addendum signed?

  1. Take stock first — which vendors have added AI, and what does the contract currently say? You're negotiating blind without an overview.
  2. Prioritise by risk — start with vendors that process personal data or business-critical data.
  3. Pick the moment — a renewal, expansion or an announced price increase. That's when the vendor wants something from you.
  4. Be reasonable but specific — clause 1 (no training on your data) and clause 2 (advance notice) are acceptable to most vendors; start there.

Would you rather build AI requirements straight into the tender or selection instead of fixing things after the fact? See AI procurement. For ongoing monitoring of new AI features at your vendors — including a flag when an addendum is needed — there is VendorManager.nl.

Frequently asked questions

What is an AI addendum?

An addition to an existing (SaaS) contract that specifically governs AI functionality: data use, model training, transparency, liability, sub-processors, compliance with the AI Act, and exit. The rest of the existing contract remains unchanged.

Can I force an AI addendum onto a running contract?

Legally, that's usually not possible — it's a change that requires both parties' agreement. In practice it works at a renewal, expansion or price change, when you have room to negotiate. Large vendors increasingly have their own AI terms; scrutinise those critically rather than accepting them at face value.

Isn't a data processing agreement (DPA) enough?

No. A DPA governs personal data under the GDPR. An AI addendum also covers non-personal data (business data, prompts, output), model training, AI-specific transparency, and obligations under the AI Act. The two complement each other.

Which clause matters most?

The ban on training with your data (clause 1). That risk is irreversible: once data has been trained into a model, you can't get it back out.

Test your sourcing model

Schedule a no-obligation call with Bob Goosen, or start with the free Sourcing Quickscan.

Schedule a call