AI-aware procurement and contracts

Standard technology contracts often say nothing about how a supplier may use the organisation's data, who owns outputs, or what happens when the underlying model changes. Settling these terms at procurement is far easier than trying to add them once the service is in use.

Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).

1. OPM-04.1 Standard AI contract terms exist and are used in every relevant procurement.
2. OPM-04.2 The terms used in each procurement are informed by the supplier risk assessment (RSK-09).
3. OPM-04.3 The terms cover data use and rights, and intellectual property in inputs and outputs.
4. OPM-04.4 The terms require notice of model changes and the transparency information the organisation needs, including what it must publish about the use.
5. OPM-04.5 The terms set security requirements and the split of security responsibilities between the parties.
6. OPM-04.6 The terms give incident notification, access to the logs the organisation needs, and a right to audit or accepted independent assurance.
7. OPM-04.7 The terms cover operational resilience and exit, including data format, retention, return and deletion.
8. OPM-04.8 The terms allocate responsibility and liability for AI outputs and any harm they cause.

• What does your standard contract say about the supplier's use of your data?
• Will the supplier tell you before changing the model behind the service?
• Who owns the outputs, and what happens to your data when the contract ends?

• Standard AI contract clauses or schedule
• A sample of recent AI contracts showing those terms

1. Draft a standard AI contract schedule covering data use and rights, intellectual property in inputs and outputs, notice of model changes, transparency information needed for publication, and exit.
2. Add security terms: security requirements and the split of responsibilities, incident notification, access to logs, a right to audit or accepted independent assurance, and operational resilience.
3. Make the exit terms state data format, retention, return and deletion, and set out who is responsible and liable for AI outputs and any harm they cause.
4. Require the supplier risk assessment (RSK-09) to be done first and use its findings to decide which terms need strengthening.
5. Make the schedule a required part of every procurement that involves AI, and brief the people who run procurements.

Common pitfalls

• Using the schedule only for large purchases while AI features arrive through renewals of existing products.
• Accepting a supplier's standard terms on model changes, which often allow change without notice.
• Leaving liability for wrong or harmful outputs unaddressed.

Starter artefacts

• Standard AI contract schedule
• Procurement checklist for AI

Accountable

delivery lead

Contributors

risk lead, data owner, security lead

Depends on

OPM-02, RSK-09

Roadmap step

5

Lifecycle

acquire_build

direct: this control at Level 3 meets the item. partial: it covers part of it.