What you actually buy when you sign a generative AI contract

A contract for a generative AI model settles three things: what the model learned from, what you may do with its output, and what the provider may do with your input. Buyers negotiate price and uptime, then sign those three layers as presented. Since 2 August 2025 the AI Act, Regulation (EU) 2024/1689, has given buyers a lever on the first layer, because providers of general-purpose AI models now carry documentation duties you can ask about before signature.

Layer one: what the model learned from

Obligations for general-purpose AI (GPAI) models have applied since 2 August 2025. A GPAI provider must keep technical documentation, give downstream users the information they need, operate a policy to comply with EU copyright law including reservations of rights, and publish a summary of the content used for training. For a buyer this changes the conversation. Ask for the documentation and the training-content summary by name, and attach what you receive to the contract file. A provider who cannot produce them is showing you how it handles the rest of its obligations.

Layer two: output, ownership and who pays for infringement

Most contracts assign output rights to the customer. Check what that assignment is worth. Purely machine-generated work may fall outside copyright protection in the EU. In that case your exclusivity rests on the contract and on confidentiality, and both need to hold. Record this in your chain of title for anything you build a product or a brand on.

Then the indemnity. Providers increasingly offer to cover third-party IP claims over output. The details decide whether the promise reaches you: which service tiers it covers, whether it survives your edits, which filters and settings it requires, where the cap sits, and what it excludes. And an indemnity moves money, nothing else. If a court stops your campaign, the provider’s cheque does not restart it.

Picture the moment this turns real. A cease-and-desist letter arrives over a campaign visual. Counsel opens the contract and finds an indemnity covering unmodified output on an enterprise tier the company never bought. That reading belongs before signature.

Layer three: what the provider may do with your data

Prompts, uploads and fine-tuning sets carry trade secrets, client material and personal data. The contract plus the admin settings decide whether the provider may store them, have humans review them, or use them to improve and train models. Defaults differ sharply between consumer and enterprise tiers. Confirm retention periods, human review and deletion on exit, and write the chosen settings into the order form, because a screenshot of a toggle is thin evidence three years later.

The red flags repeat across drafts: a broad licence to your inputs for service improvement without an opt-out, an indemnity confined to unmodified output on selected tiers, silence on training-data provenance, a right to amend terms unilaterally mid-term, and no deletion commitment at exit. One of these is a negotiation point. Three are a pattern.

What we recommend now

Five moves for the next two weeks.

Pull the three generative AI contracts your business relies on most and map each against the three layers, one page per contract.
Request the GPAI documentation and training-content summary from each provider and file the answers with the contract.
Open the admin consoles: switch training on your inputs off where you can, note the retention settings, and confirm the configuration in writing.
Read each indemnity against your real usage: tier, edits, filters. Close the gaps through an upgrade, changed usage rules, or a renegotiated clause.
Extend the AI register: next to each system record the model and version, provider, tier, output-rights clause, indemnity scope, input-data settings, documentation received and the next review date.

When the next vendor letter arrives, that register answers in five minutes what you bought, from whom, and on which terms.

Sources: Regulation (EU) 2024/1689 (AI Act) · European Commission: Regulatory framework for AI

This material is provided for general information and does not constitute legal, investment, tax, audit or other regulated professional advice. Its application depends on the facts, jurisdiction and current law. Verify the current status of the cited sources and obtain appropriate advice before acting.