Private equity and portfolios

Updating SaaS terms for AI: clauses to add across acquired products

By SourceX Editorial · Reviewed by Noah Loul · October 9, 2026

Short answer

To add AI clauses to SaaS terms across acquired products, start from a group baseline covering AI features, outputs, training on customer content, aggregated data, model providers, customer controls and change notice, then adapt it per product. Roll changes out through each contract's own amendment route, usually at renewal, and never assume one notice binds every customer.

Key takeaways

Audit each acquired product's terms before drafting, because click-through terms, negotiated MSAs and order forms change by different routes.
The training clause should state plainly whether customer content trains any model, and under which plan or setting.
An aggregated data clause should define its de-identification standard rather than rely on the word aggregated.
Outside model providers belong in the subprocessor list and data processing terms, not only in product documentation.
Renewal is the cleanest moment to move negotiated customers onto new AI language.

Which AI clauses should SaaS terms include?#

SaaS terms for AI generally need clauses on seven subjects: AI features, outputs, use of customer content for training, aggregated and de-identified data, outside model providers, customer controls and notice of changes. Two more are often missed: retention of prompts and outputs, and a clause separating the vendor's own operational records from customer content.

For a holding company, drafting is the easier half. The harder work is that each acquired product arrived with its own terms, its own customer mix and promises made by a previous owner. A group baseline gives consistency; product schedules carry the differences.

Audit what each acquired product's terms say today#

Auditing current terms tells counsel which route each change must take and where the real gaps are. Many acquired products have terms written before AI features existed, so the gaps tend to repeat from product to product.

Audit what each acquired product's terms say today
What the terms say today	Typical gap	Action
Nothing about AI or machine learning	Silent on training, outputs and model providers	Add the baseline AI clauses through the next permitted amendment
A broad license to use data to improve the services	Unclear whether training is covered; customers may read it narrowly	Clarify, and do not rely on it for new uses without counsel review
Usage data clause with no de-identification standard	No test for when data stops identifying a customer	Define aggregation and de-identification, and prohibit re-identification
Click-through terms with a unilateral change right	Notice method may not reach active administrators	Confirm the notice route the clause requires and keep proof of delivery
Negotiated MSA where order forms override	Customer-specific limits on data use	Track per customer and update at renewal

The clause checklist#

The clause checklist below sets out what each clause should state and the drafting point most often missed. Treat it as a structure for counsel to work from, not finished contract language.

The clause checklist
Clause	What it should state	Drafting point to check
AI features	Which features use AI, and that they are optional where true	Reference a feature list that can change without amending the contract
Outputs	Who owns outputs and that outputs may be inaccurate	Customer responsibility for reviewing outputs used in decisions
Training on customer content	Whether customer content trains any model, shared or customer-specific	Plan-tier differences and how opt-in or opt-out works
Aggregated data	Permitted uses of de-identified, aggregated data	Definition of de-identified and a ban on re-identification
Model providers	That outside providers process content as subprocessors	Provider limits on training and retention flow down
Prompt and output retention	How long AI inputs and outputs are kept	Consistency with the product's general deletion terms
Customer controls	How administrators switch features on or off	Effect of switching off on content already processed
Notice of changes	How customers learn about new AI uses	Advance notice for any expansion of training or sharing
Vendor operational records	That the vendor's internal records are not customer content	Carve out customer content embedded in tickets and attachments

Where each clause should live#

Each AI clause should live in the document that already governs its subject, so customers find it where they expect and amendments follow existing routes. Training, aggregated data and output terms usually sit in the main subscription terms or an AI addendum; model providers belong in the data processing addendum and the subprocessor list.

An AI addendum suits groups with many negotiated agreements, because it can be signed without reopening the whole contract. Product documentation and the trust page explain how features work, but they should repeat contractual commitments rather than create new ones. Adobe is a public example of closing that gap: in a June 10, 2024 blog post it said it does not train generative AI on customer content and would add that statement to its Terms of Use as a legal obligation. Where privacy laws such as GDPR or CCPA may apply, counsel will also check that the privacy notice and processing terms say the same thing.

A rollout plan that follows renewals#

A rollout plan that follows renewals moves every customer onto the new language without a single group-wide event that invites mass renegotiation.

Keep a register of which customer holds which version. Without it, the group cannot answer the simplest later question: may this product use this customer's data for this purpose.

Classify each product's contracts as click-through, standard order form or negotiated MSA.
Approve the group baseline and a schedule for each product's differences.
Update click-through terms first, using the notice method each current clause requires, and keep proof of delivery.
Attach the AI addendum to every new negotiated deal immediately.
Flag negotiated agreements in the contract register and add the addendum at each renewal.
Update the subprocessor list, trust page and questionnaire answers on the day the terms change.
Brief customer success and sales on the change and the approved short answer.

Positions large customers will push back on#

Large customers most often push back on the aggregated data clause, broad output disclaimers and any training they did not choose. Expect requests for a no-training commitment, deletion of AI inputs on request and notice before a model provider changes.

Decide fallbacks before renewal season starts. Many groups accept a no-training commitment for enterprise accounts, keep the aggregated data right with a tighter de-identification definition, and offer notice of provider changes rather than a veto. Record every concession in the register so product teams know which accounts carry special terms.

Illustrative: four acquired products, one baseline#

Illustrative: a fictional software holdco owns four vertical products serving towing companies, self-storage operators, specialty contractors and equipment rental yards. Its general counsel finds one product on click-through terms with a unilateral change right, two on standard order forms, and one whose largest customers signed negotiated MSAs with no data use language at all.

Counsel drafts a group baseline and an AI addendum, updates the click-through product first with the notice its terms require, and attaches the addendum to renewals for the rest. Two large equipment rental customers ask for a no-training commitment, which the group accepts and records. By the end of the renewal cycle, the register shows the version every customer holds.

How SourceX uses product terms in a license review#

SourceX uses product terms as the starting point of the Rights step in the SourceX five-step transaction. Before any records are scoped, the terms each product's customers accepted are reviewed to separate customer content, which is excluded unless permissions clearly allow it, from the vendor's own operational records.

Clear terms make that review faster and its result easier to document. The licensing rights and permitted use recorded in the SourceX Evidence Packet trace back to the clause versions in force, which is one more reason the contract register matters.

Frequently asked questions

Can we change SaaS terms in the middle of a contract?

Sometimes. Click-through terms often include a change clause with a notice requirement, while negotiated agreements usually need a signed amendment. Whether a unilateral change is enforceable depends on the clause, the notice given and the governing law, so counsel should confirm the route for each product.

Do existing customers need to consent to AI training on their content?

That depends on the current terms, any negotiated limits and the privacy laws that may apply to the content. Many vendors sidestep the question by not training shared models on customer content at all, or by offering training only as an explicit opt-in.

Does an aggregated data clause allow licensing data to AI developers?

Not automatically. Clauses differ on permitted purposes, recipients and de-identification standards. Some are limited to operating and improving the service; others are broader. Any outside licensing should be reviewed clause by clause with counsel, and it usually focuses on the vendor's own records instead.

Should every acquired product use identical terms?

A shared baseline helps, but identical terms are rarely practical. Products differ in data types, customer size and legacy commitments. Most groups keep common AI clauses and attach product schedules for features, providers and customer-specific limits.

What about customers who never accept the updated click-through terms?

Inactive administrators are a common gap in click-through updates. Check what the change clause says about notice, send it to the contacts the contract names and record delivery. Where notice cannot be confirmed, treat the earlier terms as still governing that account until renewal or a signed acknowledgment.

Sources

In a June 10, 2024 blog post, Adobe stated that it does not train generative AI on customer content and said it would add that statement to its Terms of Use as a legal obligation. Source

Related resources

See if your company qualifies

A short company assessment. No data uploads are needed.

Start a guided assessment of your products Talk to SourceX