Artificial intelligence is increasingly built into SaaS products and technology services.
For international providers offering AI-enabled services in the European Union, the EU AI Act is part of the legal framework. But many of the most immediate issues are also contractual.
What happens to customer data? Can it be used to train AI models? Who owns the output? What happens when the AI functionality changes? And who bears the risk if the output is wrong?
These issues should be addressed clearly in the customer agreement.
AI features may process customer documents, personal data, confidential information, source code or other sensitive content.
The contract should make clear what happens to that information.
In particular, providers should determine whether customer data is used only to provide the service or may also be retained, reused to improve the service, or used to train or fine-tune AI models.
Where third-party AI providers are involved, their role and their own use of the data should also be understood.
For EU customers, these questions may raise both contractual and GDPR issues.
A standard confidentiality clause may not be enough if users can submit sensitive information directly to an AI tool.
Providers need to ensure that their contractual commitments match the way the service actually works: where information is processed, whether it is retained, whether it is reused and which third parties may have access to it.
Customers are increasingly likely to ask these questions during contract negotiations.
The provider therefore needs clear answers that are consistent across the contract, its technical documentation and its arrangements with its own AI suppliers.
Simply stating that the customer “owns the output” does not necessarily resolve the intellectual property issues raised by generative AI.
The agreement should distinguish between customer inputs, generated outputs, provider technology and any third-party rights that may be involved.
This is particularly important where customers intend to publish AI-generated content or integrate generated code, images or other material into their own products.
The contract should therefore explain what the customer is allowed to do with the output and what guarantees the provider is actually able to give.
Not every AI-enabled SaaS service is subject to the same requirements under the EU AI Act.
The applicable obligations depend on the type of AI system, its intended use and the role performed by each company.
International providers should therefore avoid treating “AI Act compliance” as a generic contractual clause.
Where the Regulation requires information, documentation, transparency or cooperation between the parties, the agreement should provide the mechanisms needed to meet those requirements.
AI services evolve quickly. Models may change, new features may be introduced and third-party AI providers may be replaced.
The agreement should therefore address material changes where they may affect customer data, security, compliance or the nature of the service.
Liability provisions also deserve attention.
Providers may legitimately require customers to review AI-generated results before relying on them. But a blanket disclaimer transferring every risk associated with AI to the customer may not be consistent with what the service is actually designed and marketed to do.
As with any SaaS agreement, the allocation of risk should reflect the respective roles and responsibilities of the parties.
For international SaaS and technology providers, adding AI to a service does not necessarily require rewriting the entire customer agreement.
It does require answering a few basic questions clearly:
What happens to customer data? What can the customer do with the output? Which AI Act requirements apply? How can the AI functionality change? And how is liability allocated?
Those answers can then be integrated into the provider’s existing contractual framework.
The aim should be to address the specific risks created by AI without unnecessarily redesigning the provider’s global SaaS model.
Companies also need to consider how AI is used internally by their own teams.
For more: Using Generative AI in the EU: Do Companies Need an Internal AI Policy?
Withlaw assists international SaaS and technology providers offering AI-enabled services in France and across the European Union, including with:
Our objective is to help providers address EU-specific AI requirements while preserving, wherever possible, their existing contractual and operational model.