Your SaaS Has AI Features. Does Your Acceptable Use Policy Reach Your Upstream Provider's Rules?

Your product calls a third-party AI model. A customer uses your product in a way the model provider's rules prohibit. Your provider usually has no contract with that customer. It has a contract with you.

This post is about that gap. It looks at what two providers' published business terms say about your customers' use, and lists the questions a SaaS company's own customer-facing terms have to answer. It is written for founders who build on a model provider's API and sell the result to their own customers.

The short answer

A provider's rules do not necessarily bind your customer directly. Your agreement with the provider can require you to ensure that your customers follow those rules and can make you responsible for their conduct. Your customer-facing terms and acceptable use policy should address the upstream requirements relevant to their use of your product.

Five questions to answer, in order:

1. What did you agree to upstream, and which documents does that agreement pull in?
2. Do your customer-facing terms address the upstream requirements relevant to your customers' use?
3. Can you act on a violation quickly, before the provider acts on you?
4. What happens when the provider changes its rules?
5. Who pays if something goes wrong?

How a provider's rules reach your customers

The chain has three links. Your provider agreement sets your obligations. Those obligations can include responsibility for your users. Your customer-facing terms should establish the corresponding obligations for your customers. Two examples show how the first two links read in practice. Both quote standard online business terms, which a negotiated agreement or a cloud marketplace listing may replace.

Anthropic. Its Commercial Terms of Service (effective June 17, 2025) start from the premise that the customer will build a product on top of the service. Section A.1 gives permission to use the services "to power products and services Customer makes available to its own customers and end users" and defines those customers and end users as "Users."¹ From there, the terms tie your Users to the provider's rules:

• Your agreement requires compliant use by Users. Section D.2 says "Customer and its Users may only use the Services in compliance with these Terms, including (a) the Usage Policy," along with a supported-regions policy and service-specific terms, "each of which is incorporated by reference into these Terms."¹
• You pass things down. Section D.3 says the customer "must notify its Users" that factual assertions in outputs should not be relied on without independent checking.¹
• The provider can suspend. Section I.3.a lets the provider suspend access if it reasonably believes or determines that "Customer or any User is using the Services in violation of Sections D.1 (Compliance), D.2 (Policies and Service Terms) or D.4 (Use Restrictions)."¹
• The risk can land on you in money. Section K.2 requires the customer to defend specified Anthropic parties against third-party claims related to the customer's or its Users' use of the services in violation of the Usage Policy, the Service Specific Terms or section D.4. It also provides indemnification for specified judgments and awards. Section K.3 excludes defense and indemnification obligations to the extent the underlying allegation arises from the indemnified party's fraud, willful misconduct, violations of law or breach of the agreement.¹

OpenAI. Its Services Agreement (effective January 1, 2026) applies to the API and to other business and developer services.² It makes the same connection in different words:

• Responsibility for end users. Section 3.2 says "Customer is responsible for all activities that occur under its Account, including the activities of End Users with an End User Account or who access the Services through a Customer Application."²
• A promise about what you will let them do. Section 3.3 says "Customer will not, and will not permit End Users to: (a) use the Services or Customer Content in a way that violates applicable laws or OpenAI Policies," and "OpenAI Policies" is defined to include the Usage Policies.²

Both providers place obligations on you concerning your users' conduct. The quoted provisions do not, by themselves, establish a direct contract between the provider and your customer. That is why your own customer-facing terms matter.

Whose version of the rules applies

Which version applies depends on your provider agreement, its update provisions and any applicable order form—not simply the latest version posted online.

• OpenAI says the applicable version of its policies is "those in effect on the most recent effective date between either the Agreement, Customer's most recent Order Form, or Services renewal." Section 16.13(a) also allows updates: changes OpenAI determines materially affect customer rights or obligations generally require at least thirty days' notice, subject to an exception for legal compliance; other updates take effect when posted. Continued use or access after an update takes effect constitutes acceptance under that provision.² The Usage Policies page itself is dated: effective October 29, 2025.³
• Anthropic's Usage Policy page, read on October 13, 2026, shows a version labeled effective November 12, 2026, and links an earlier version, archived and labeled effective September 15, 2025.⁴ Its Commercial Terms incorporate "the Usage Policy" by reference in section D.2.¹

A posted future-effective version should not be treated as already applicable merely because it appears on the policy page. Check the effective date and your agreement's update provisions.

If your customer-facing policy copies a provider's list of prohibited uses, it is a snapshot. If it points at the provider's policy, it seeks to incorporate a document you do not control and that your customers may not have read. Check how your terms identify that document, obtain customer agreement and handle later changes. Decide which approach you are taking, and write down who watches for changes. For the dependency problem more generally, see API dependency and vendor terms.

Five questions for your own terms

1. Is there a customer-facing acceptable use policy at all? A terms-of-service page may cover payment, ownership and liability and say nothing about prohibited uses. If you only have the terms, read them for any clause that addresses misuse. See do you need terms of service for what that document usually does and does not cover.

2. Does it address the upstream requirements relevant to your customers' use? Make a list from the provider's terms: the usage policy, any region limits, any use restrictions, and any notice you must give users. Then check each item against your own terms. Distinguish requirements your customers must follow from obligations you must perform yourself.

3. Can you act fast? If your provider can suspend your access over one customer's conduct, consider whether your terms permit prompt, proportionate restrictions on that customer's access, consistent with your other contractual obligations. Read your suspension and termination clauses for whether they allow action on a suspected violation, with what notice, and whether you can limit one customer's access without ending the whole contract.

4. What happens when the rules change? A customer-facing policy that cannot change without each customer's signature may leave you unable to pass through a provider's changes promptly. Check how your terms handle updates and how a customer is told. If your agreement is a negotiated enterprise contract, changes may need the customer's agreement, so the process should be settled in the contract and not discovered during an incident.

5. Who pays? Anthropic's terms, as quoted above, allocate some third-party claims to you. Whether your own customer indemnifies you for the same events is a drafting question, along with whether any liability cap or exclusion applies to that indemnity. See how much should your liability cap be and what an AI product's customer contract must say.

Whether a customer's conduct falls inside a provider's rules is a question for a lawyer on the specific facts and the specific version of the specific document. This post does not answer it for any customer or use.

Other places the upstream rules show up

• Your customer's own diligence. Enterprise customers ask which models you use and what the provider's terms say about their data. If your security questionnaire answers and your terms disagree, see security questionnaire commitment drift.
• Your subprocessors. A model provider that handles customer data is often a subprocessor. See subprocessor obligations when you use AI vendors.
• Your pilots. A pilot may give a customer access before a full commercial agreement is signed, but the applicable provider requirements still need to be addressed in the pilot terms. See what to put in a SaaS pilot agreement.
• A provider change. If you switch providers, the upstream requirements you need to address in your customer-facing terms may change. See switching AI vendors.
• Your overall AI position. See our AI legal checklist for startups and AI governance contracts.

A checklist before your next release

• You have a current copy of each upstream agreement and each policy it incorporates, with the date you read it.
• Your customer-facing terms or acceptable use policy address the upstream requirements relevant to your customers' use, and you separately track your own compliance obligations.
• You have checked whether your terms permit prompt, proportionate restrictions on an individual customer's access for a suspected violation, consistent with your other contractual obligations and applicable notice requirements.
• Any notice your provider requires you to give users is in the product or the terms.
• You know how your terms change and how customers are told.
• Your indemnity and liability terms were read against the upstream indemnity, not in isolation.
• Someone owns watching the provider's policy page for new versions.

What this post does not cover

It does not cover how a court would read any of these clauses, whether a particular use breaks a provider's rules, any provider other than the two quoted, negotiated enterprise terms, terms from a cloud marketplace or reseller, consumer products, or sector rules for regulated industries. No statutes are cited. Each depends on documents and facts this post does not have.

How we can help

Accord & Shield Legal drafts and reviews SaaS terms, acceptable use policies and AI-related contract terms for technology companies in Arizona, California and Texas. To better understand the scope of your matter, you can schedule an initial consultation.

This article is general information, not legal advice. Reading it does not create an attorney-client relationship. How any of these points applies to your product depends on your agreements and your facts; consult an attorney about your situation.