Your Enterprise Customer Sent an AI Addendum. What Is It Asking You to Promise?

The master agreement was signed a year ago. Since then your product has gained AI features: a summarizer, a drafting assistant, a classifier running behind a dashboard. Now the customer's procurement or legal team has sent an "AI addendum" and wants it signed before renewal.

An AI addendum is a set of promises about how your AI features handle the customer's information, who owns what they produce, and who carries the risk when they get something wrong. Each promise may be easy to agree to in the abstract. What matters is whether your product, and the AI providers underneath it, can keep it.

This post walks through the requests that tend to appear in these addenda and the questions to answer on your side before you sign. It is the vendor's view of the negotiation we cover from the buyer's side in our seven contract questions to ask before connecting an AI tool. The focus is contract practice, with brief summaries of selected legal requirements; this post does not say whether any particular request should be accepted.

1. "You will not use our data to train or improve AI models"

This is often the first request, and the one most likely to collide with how the product is built. Before answering it, pin down four things:

• What "our data" means. Your contract may already distinguish customer content, usage data, aggregated or de-identified data, telemetry and model outputs. A training restriction drafted around one term can reach, or miss, the others. Our guide to diligence-grade contracts explains why those distinctions matter when a company is later sold.
• What your product does. Do you train or fine-tune on customer content? Do you use it only to generate a response? Do you keep prompts and outputs, and for how long?
• What your privacy commitments already say. In a staff blog post addressing consumer privacy commitments, FTC staff cautioned that quietly changing terms to permit previously undisclosed uses of already-collected data, including AI training, may be unfair or deceptive.¹ That discussion concerns consumer privacy commitments, not whether a particular B2B addendum must be accepted. Our post on privacy policies for California-facing SaaS covers the notice side.
• Where personal information is involved, what the CCPA regulations allow a service provider to do with it. The regulations limit a service provider's retention, use and disclosure of personal information collected under its written contract with a business to listed purposes, and require that processing to be reasonably necessary and proportionate to those purposes. One listed purpose is internal use to build or improve the quality of the services it provides to the business, provided it does not use the personal information to perform services on behalf of another person. The service provider must also comply with its contract.²

How a particular training or improvement practice fits within those limits depends on the facts, and it is a question to resolve before you promise anything in either direction.

2. Promises about the AI providers you rely on

If your features call a third-party model, many of the customer's requests depend on terms you do not control: retention, training, where data is processed, and security commitments. Before you sign, compare the addendum line by line against your providers' current terms. A promise stronger than your upstream contract gives you is a promise you may be unable to keep. We cover the subprocessor side in what your customer contract says about AI subprocessors, and the way upstream rules reach your customers in our post on your AI provider's acceptable use policy.

3. Who owns the outputs, and what you may do with them

Addenda often address ownership of AI-generated output, and sometimes restrict the vendor's use of outputs as well as inputs. Ownership of AI-generated material raises questions that contract language alone may not settle; our post on who owns AI-generated code and content covers them. On the vendor side, the practical question is narrower: does anything in your product, support or improvement process depend on keeping or reusing outputs?

4. Accuracy, review and disclaimers

Some addenda ask the vendor to warrant that AI output will be accurate, unbiased or suitable for a particular use. Compare any such request with what the feature is designed to do and with the disclaimers in your existing terms. Decide which checks sit with you and which sit with the customer's own people, and whether the addendum describes that division the same way your documentation does. Our post on customer contract terms for AI products covers how those terms are commonly drafted.

5. Indemnity and the liability cap

An addendum may ask you to defend the customer against claims arising from AI output, including intellectual property claims. Before agreeing, look at how the request interacts with the indemnities, exclusions and cap already in your master agreement, and with any indemnity you receive from your own AI providers. Our post on what an AI provider's promise to defend you asks of you covers the upstream side, and our guide to how much your liability cap should be explains how caps and carve-outs work together.

6. Notice before you add or change AI features

An addendum may ask for notice, and sometimes a right to opt out, before new AI functionality touches the customer's data. Check this against your modification clause and your release process. If you already ship AI features through ordinary product updates, a new notice commitment may change how you release them. Our post on security questionnaire commitments covers what happens when a promise drifts from the product.

7. Cooperation with the customer's own obligations

If a customer's use of your product is covered by California's automated-decisionmaking technology regulations, the applicable cooperation duties depend on your role. A service provider or contractor must assist the business in responding to a verifiable consumer request to access automated decisionmaking technology.³ Separately, a business that makes automated decisionmaking technology trained using personal information available to another business to make a covered significant decision must provide all facts available to it that are necessary for the recipient-business to conduct its own risk assessment.⁴ An addendum may ask you to commit to that cooperation in writing. Our post on California's automated-decision rules for SaaS vendors covers those provisions and the January 1, 2027 compliance date for the ADMT-specific requirements; that date should not be treated as a blanket deadline for the separate risk-assessment requirements.

Before you sign: a short checklist

1. List every AI feature the addendum could reach, and the data each one uses.
2. Pull the current terms of every AI provider behind those features.
3. Map the addendum's definitions against your master agreement, data processing terms and privacy notice. Our guide to enterprise SaaS contracts and DPAs covers how those documents fit together.
4. Mark each request as one you can keep, can keep with changes, or cannot keep.
5. Decide who in your company approves exceptions and who tracks the commitments after signature.

How we can help

Accord & Shield Legal reviews and negotiates SaaS agreements, data processing terms and AI-related contract terms for technology companies in Arizona, California and Texas. To better understand the scope of your matter, you can schedule an initial consultation. The consultation is evaluation-only; no legal advice is provided. Representation begins only after an engagement agreement is signed and any required retainer is received. Please do not send confidential or sensitive documents before we confirm that we can assist.

---

This article is general information, not legal advice. Reading it does not create an attorney-client relationship. How any of these terms applies to your business depends on your agreements and your facts; consult an attorney about your situation.