Private equity and portfolios
AI vendor contracts at portfolio companies: data terms to check
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
AI vendor contract data terms decide whether a portfolio company's records end up training a vendor's models for free. Check eight clauses in every AI-enabled tool: training rights, default settings, retention, output ownership, derived data, subprocessors, confidentiality and unilateral changes. A vendor that already trains on support or CRM records can weaken a later licensing deal.
Key takeaways
- AI features inside existing tools such as helpdesk, CRM and call recording often arrive under separate product terms that change the data deal.
- Training rights, default settings and derived-data definitions matter more than headline privacy language.
- Records handed to a vendor for training without limits can be harder to license with exclusivity later.
- Review terms company by company, then keep one central register so the sponsor sees the whole picture.
- Admin console settings work as part of the contract in practice, so record them with dates.
Why AI vendor terms belong on the sponsor's agenda#
AI vendor terms belong on the sponsor's agenda because they quietly decide who else may learn from a portfolio company's records. When a company switches on an AI reply assistant in its helpdesk, a conversation intelligence tool on sales calls or a coding assistant in its repositories, the vendor may gain rights to use prompts, files and outputs well beyond delivering the feature.
Those rights can conflict with promises the company made to its own customers, and they can erode the value of records the group might later license. Holdco counsel is often the only person positioned to see the pattern across companies, because each portfolio company tends to review AI tools one purchase at a time, if it reviews them at all.
The eight data terms to check#
The eight data terms below cover most of the risk in AI-enabled software contracts. Read them together, because a favorable training clause can be undone by a broad definition of usage data elsewhere in the same document set.
| Clause | What to look for | Position to aim for |
|---|---|---|
| Training on customer data | Whether inputs, files or outputs may train or improve the vendor's or a third party's models | No training on company content without written opt-in |
| Defaults and opt-out mechanics | Whether training is on by default and how an opt-out is recorded | Off by default, with the opt-out confirmed in the order form rather than only a toggle |
| Retention and deletion | How long prompts, transcripts and outputs are kept, including logs and backups | Defined retention and deletion on request and at termination |
| Output ownership | Who owns generated summaries, code and drafts, and any license back to the vendor | Company owns outputs; vendor license limited to providing the service |
| Derived, aggregated and usage data | Rights to create statistics, embeddings or de-identified data from company content | A narrow definition that excludes content and embeddings of content |
| Subprocessors and model providers | Which outside model providers receive data and on what terms | Listed subprocessors, flow-down terms and notice of changes |
| Confidentiality and security | Whether prompts and outputs count as confidential information | Explicit inclusion, with security commitments matching the core service |
| Unilateral changes | Whether online AI terms can change without notice or consent | Notice of material changes and a right to opt out or terminate |
Where AI data terms hide#
AI data terms rarely sit in one document. The signed master agreement may barely mention AI, while the operative language lives in documents incorporated by a link or accepted by an administrator with a click.
Capture the version and date of each document you rely on. Vendors often update online AI terms more frequently than the core agreement, so a review done at signing can be out of date by the next renewal.
Public episodes show why dates matter. On August 7, 2023, after backlash over March 2023 changes, Zoom added a sentence to Section 10.4 of its terms saying it would not use audio, video or chat customer content to train its AI models without consent. In May 2024, TechCrunch reported backlash after Slack's privacy principles were found to allow customer data to train Slack's machine-learning models unless an organization emailed Slack to opt out; Slack responded that it does not use customer data to train its generative AI large language models.
Terms can also differ by contract type for the same product. GitHub's Terms of Service grant GitHub a license to use AI-feature inputs and outputs to train AI models, with an opt-out in account settings, while customers under a GitHub Customer Agreement or volume licensing agreement are excluded from that training license. Confirm which paper each portfolio company actually signed.
- AI or generative features addendum, sometimes labeled product-specific terms
- Data processing agreement and its subprocessor list
- Online terms of service and acceptable use policy referenced in the order form
- Order forms and renewal quotes, which can move a customer onto a newer terms version
- Admin console settings for model training, data sharing and retention
- Trust or security pages that describe practices but may not be binding
How free vendor training can undercut later licensing#
Free vendor training undercuts later licensing because AI developers who license records pay for uniqueness and, sometimes, exclusivity. If a helpdesk vendor already holds rights to train on years of a company's support conversations, the company may be unable to tell a licensee that those records have not been used elsewhere.
The issue surfaces in contract representations. A typical license asks the supplier to confirm it can grant the license and to disclose prior grants. A broad vendor training clause makes that disclosure longer and less attractive, and it may rule out an exclusive arrangement entirely.
There is a customer-facing risk as well. Many B2B customer agreements confine the company's use of customer data to delivering the service it sells. Letting a vendor train on that data may sit uneasily with those promises, which is a question for counsel to assess contract by contract.
Running the review across a portfolio#
A portfolio review works best as a short, repeatable routine that each company runs and the holdco summarizes. The goal is a living register of tools and terms, not a one-off memo that ages the moment a vendor updates its online terms.
Triage findings by what can be fixed today and what has to wait for renewal. The table shows the usual responses.
- Step 1: list AI-enabled tools at each company from SSO, expense and accounts payable records, not only IT's list.
- Step 2: pull every governing document and the current admin settings for each tool.
- Step 3: rate each tool against the eight clauses as acceptable, needs change or unknown.
- Step 4: switch off training settings that can be changed now and record the date.
- Step 5: queue contract changes for renewal and escalate tools that touch customer content.
- Step 6: add results to a group register that holdco counsel reviews on a regular cycle.
| Finding | Immediate action | Typical owner |
|---|---|---|
| Training allowed, toggle available | Turn it off, screenshot the setting, date the record | Company IT lead |
| Training allowed, no opt-out offered | Limit which data flows into the tool and negotiate at renewal | Company CEO with holdco counsel |
| Usage data defined to include content | Request a narrower definition or a side letter | Holdco counsel |
| Terms not located or unclear | Ask the vendor for the current AI terms in writing | Company finance or procurement |
Illustrative: a helpdesk AI feature at a software holdco#
Illustrative: three vertical software companies, serving trucking fleets, self-storage operators and specialty contractors, sit under one fictional holding group. During a routine review, holdco counsel finds that the self-storage company enabled an AI reply assistant in its helpdesk the previous year, and the feature's product terms let the vendor use conversations to improve its models unless an administrator opts out.
The company switches the setting off, records the date and asks the vendor to confirm in writing how earlier conversations were handled. Counsel notes in the register that ticket history before the opt-out date may be subject to the vendor's prior rights. When the group later scopes a licensing package, it starts with the two companies whose ticket archives never passed through that feature and treats the third company's earlier records as a disclosed exception.
How SourceX reviews vendor terms#
In the SourceX five-step transaction, vendor terms are read during the Rights step, alongside customer contracts and privacy notices, before any preparation work begins. Any earlier grant to a vendor, such as a training right that ran until an opt-out date, becomes a disclosed item in the SourceX Evidence Packet, and records affected by it can be carved out of scope. Export limits and confidentiality terms found in the same review shape what Preparation can include.
Frequently asked questions
Does opting out now cover data the vendor already used?
Usually not automatically. An opt-out typically applies going forward. Ask the vendor in writing how earlier inputs were handled, whether they were used for training and whether they can be deleted. Keep the answer and its date, because that history matters for later licensing disclosures.
Do enterprise plans always exclude training on customer data?
No. Many vendors offer stronger commitments on higher tiers, but terms differ by vendor, plan and feature, and they change over time. Check the specific product terms and the admin settings that apply to the plan each portfolio company actually holds, rather than relying on marketing pages.
Should the sponsor impose a group AI tool policy?
A short group standard helps: which clause positions are acceptable, who can approve exceptions and where the register lives. Day-to-day tool choices can stay with each company, while external data licensing and any tool that trains on customer content are good candidates for central approval.
What about AI tools employees adopt on their own?
Unsanctioned tools often carry the most permissive terms of all. Pair the contract review with a plain acceptable use rule and a list of approved tools, so employees know where company records may and may not go, and check expense reports for new subscriptions.
Who negotiates changes with large vendors?
Usually the portfolio company, because it holds the contract. The holdco can help by sharing a standard position and, where several companies use the same vendor, coordinating requests so the vendor hears one consistent ask instead of several different ones.
Sources
- On August 7, 2023, after backlash over March 2023 changes to its terms, Zoom added to Section 10.4 of its Terms of Service the sentence: "Notwithstanding the above, Zoom will not use audio, video or chat Customer Content to train our artificial intelligence models without your consent." Source
- TechCrunch reported on May 17, 2024 that Slack drew user backlash after its privacy principles were found to allow customer data to be used to train Slack's machine-learning models unless an organization emailed Slack to opt out, and Slack responded that it does not use customer data to train its generative AI large language models. Source
- GitHub's Terms of Service (Section J, AI features) grant GitHub and its affiliates a license to use AI-feature inputs and outputs to train AI models, which users can opt out of in account settings, and customers under a GitHub Customer Agreement or volume licensing agreement are excluded from this training license. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.