A clever client recently asked me to draft an AI disclosure clause for her organisation’s vendor agreements. Her reasoning: with the prevalence of AI technologies like ChatGPT, she wants to know if vendors use AI in producing deliverables. Ultimately, she wants to protect her organisation from legal, regulatory, or contractual risks.

Given her request and international trends, AI disclosure clauses will probably become more prevalent as vendors use AI more frequently in creating their deliverables. You can also notice this trend from the increase in client requests for AI addendums—to their agreements—that contain clauses dealing with data accuracy, bias prevention, transparency, and cyber insurance.

This post identifies the significant risks of not having AI disclosure clauses in your agreements and then shows you how to draft them.

Four risks of no AI disclosure clauses

  1. No awareness. Without a disclosure requirement, you wouldn’t know whether a vendor uses AI to produce the deliverables under a contract with you. Not knowing this information may lead to legal surprises. For example, if you have an obligation under data protection law not to make decisions about your data subjects using AI, you’d need to know if your vendors do the same. The reason is that you’re responsible for your vendors’ processing of the personal data of your data subjects. So, you need to know whether they use AI for automated decisions.
  2. Potential biases. AI systems can unintentionally introduce or perpetuate biases. AI biases can lead to unfair and inaccurate decision-making, especially in hiring, lending, and criminal justice. These biases can perpetuate and even amplify existing social inequalities. They can also lead to mistrust and lack of adoption of AI systems, hindering the development and deployment of beneficial AI applications. Plus, biased AI systems can discriminate against individuals or groups with severe legal and ethical implications. These biases may go unnoticed without a disclosure requirement, leading to inaccurate or unfair outcomes.
  3. Compliance risks. The use of AI may be subject to specific regulations and laws, such as cybercrime laws, and failure to disclose its use could lead to non-compliance and penalties.
  4. Legal risks. Suppose a client is unaware that AI is being used in producing the deliverables, and the AI system is later found to have legal issues such as discrimination. The client could be liable for the vendor’s actions in that case.

How to draft a robust AI disclosure clause

Start with “why”

It seems simple, but before you draft the clause, you need to figure out why you want to have it in place. Your “why” will probably tie in with the risks above. However, the main reason to know and understand your why is that it colours how you draft the clause.

Define AI

You’re dealing with AI. But what exactly is “AI”? For clarity, you should define the term “artificial intelligence” to ensure all parties are clear on the scope of the disclosure requirement.

Explain the purpose for using AI

What will the vendor use the AI for? Content creation? Surveillance? Facial recognition? You need to know the purpose of using AI, as it may activate certain legal obligations. For example, article 5 of the EU’s AI Act prohibits AI systems used for specific purposes.

Indicate the AI types the vendor will use

Provide examples of the AI types the vendor must disclose, such as facial recognition, natural language processing, or predictive analytics. Again, each AI type may activate a general or sector-specific law you must comply with in using AI.

Create an obligation to disclose the use of AI

Specify that the vendor must make this disclosure to you.

State when disclosure must take place

Specify that the vendor must make this disclosure before delivering the deliverables and that the disclosure itself is a deliverable. The thinking here is that you don’t want to be stuck with an AI-generated deliverable that:

  • doesn’t comply with a law,
  • you can’t use, and
  • you’ve already paid for.

State how disclosure must happen

This drafting tip is about form. Preferably, you’d want the disclosure in writing. It may help to confirm the communication medium: e-mail, instant messaging, etc. And, for extra notice, you may require confirmation from your team that they actually received the notice for the disclosure to be valid.

Explaining limits and biases

We also suggest adding the requirement that the vendor provides a detailed explanation of the specific AI techniques and algorithms used in producing the deliverables. This explanation includes potential limitations or biases inherent in the AI system. Further, you may oblige the vendor to implement a process to deal with the limitations and biases. For instance, you may want the vendor to comply with an international standard on preventing bias, like ISO/IEC TR 24027:2021.

Check if the vendor agreement contains a compliance-with-law clause

If the disclosure clause is part of an addendum to the main vendor agreement, we suggest you check if that main agreement has a robust compliance-with-law clause that sets out the following:

  • the vendor will comply with applicable laws,
  • what happens if the vendor doesn’t comply,
  • related warranties and indemnities, and
  • penalties for non-compliance.

Get it signed

Have all parties sign and date it.

Actions you can take next

  • Manage your relationships with vendors by asking us to draft or review your AI-related contracts.
  • Move towards trustworthy AI by consulting with our specialists or attending our public or private workshops.
  • Determine how AI impacts your organisation by asking us for an AI risk assessment.
  • Collect and acquire big data to train AI lawfully by asking us to draft your big data contracts.
  • Stay updated with the latest AI law news by subscribing to our newsletter.
  • Discover more about AI by reading our AI law page.