How to write an AI training clause into your customer terms

Where should an AI training clause live?#

An AI training clause belongs in the agreement that governs customer data, usually the master subscription agreement or online terms, with matching changes in the DPA and privacy notice. A clause in one document that contradicts another creates the ambiguity it was meant to remove.

Map every document that touches customer data before drafting, including order forms and negotiated riders, and decide which one wins in a conflict.

The six decisions every clause must make#

Every AI training clause must make six decisions: which data is in scope, what de-identification standard applies, whether third parties may receive anything, how customers opt out, how much notice they get and whether the clause reaches data already collected. Leaving any one open is how service improvement wording ends up in disputes.

Illustrative sample wording for each decision#

The illustrative sample wording below shows one way to express each decision. It is a drafting starting point to adapt with counsel, not a recommended or complete clause, and defined terms must match your own agreement.

Choose one of the two third-party options; including both creates the ambiguity the clause is meant to remove.

• 1Illustrative scope: Provider may use Service Data, meaning usage metrics, configuration settings and system logs generated by Customer's use of the Services, and De-identified Content to train and evaluate machine learning models used to provide and improve the Services.
• 2Illustrative de-identification: De-identified Content means Customer Content from which Provider has removed or transformed names, contact details, account identifiers and other information reasonably capable of identifying Customer, its users or any individual, verified through documented automated and manual review. Provider will not attempt to re-identify De-identified Content.
• 3Illustrative third-party option A: Provider will not disclose De-identified Content to any third party for training models that are not used to provide the Services.
• 4Illustrative third-party option B: Provider may license De-identified Content to third parties for model training under written terms that prohibit re-identification and redistribution.
• 5Illustrative opt-out: Customer may opt out of the uses in this Section through account settings or by written notice, effective for data collected after the opt-out takes effect.
• 6Illustrative timing: This Section takes effect on the date stated in Provider's notice to Customer and applies only to data collected on or after that date.

Why the clause should not reach backward#

An AI training clause should not reach backward because records collected under earlier terms were shared on the understanding those terms created. Applying new rights to old data is the change most likely to draw objections from enterprise customers and scrutiny from regulators.

Even where online terms include a unilateral update right, a retroactive expansion of data use can be challenged as unfair or inadequately disclosed, and consumer protection law may apply to how the change was communicated. For old records, the cleaner routes are a signed addendum from each customer that wants to participate, or leaving those records out of training altogether.

Public backlash shows the cost of vague wording. After criticism of changes it had made to its terms in March 2023, Zoom added a sentence to Section 10.4 of its Terms of Service on August 7, 2023 stating that it will not use audio, video or chat Customer Content to train its AI models without consent. A precise clause from the start avoids having to clarify under pressure.

The forward-only rule also makes engineering simpler. Each account carries an effective date and a permission status, and the training pipeline reads both.

Rolling the clause out to existing customers#

Rolling the clause out to existing customers is a contract operation as much as a drafting task, because each customer's current paper sets how a change can be made. Plan it like a pricing change, with a customer list, a notice and a record of every response.

• 1Sort customers by paper: online terms, standard MSA, negotiated MSA, MSA with a no-training rider.
• 2Confirm the change mechanism for each group: notice under an update clause, or a signed amendment.
• 3Send notice with the redline, the effective date, the opt-out route and a plain-language summary.
• 4Record acceptances, objections and opt-outs in the contract system or CRM, not in email threads.
• 5Give engineering an account-level flag for permission status and effective date.
• 6Update the trust center, security questionnaire answers and sales materials on the same day.

Illustrative: a print shop software company rewrites its terms#

Illustrative: a fictional print shop management software company wants an AI estimating feature trained on job tickets, and its old terms only allowed use of customer data to improve the Services. Counsel rewrites the clause using the six decisions.

Scope covers service data and de-identified job specifications, with customer names, contact details and uploaded artwork excluded. The company picks third-party option A, so nothing goes to outside developers, and adds an opt-out and an effective date after advance notice. Customers on negotiated MSAs receive an addendum; those with no-training riders keep them and are flagged.

The estimating feature trains only on accounts whose flag allows it. Separately, the company reviews whether its own engineering and support records could be licensed, a question the customer clause does not affect.

How the clause shapes any later data license#

The clause shapes any later data license because it decides whether customer-derived records can ever be in scope. A company that chose internal use only has closed that door for the data the clause covers, while a licensing option still requires de-identification, written recipient terms and a clean opt-out record.

In the SourceX five-step transaction, the Rights step reads the clause, the DPA and every rider before scoping records. The SourceX Evidence Packet then records the permitted use and licensing rights the clause supports, so an AI developer can see exactly what the customer terms allowed.