AI Governance & Contracts

Your employees may already be using AI at work, even if your company has never formally approved it.

An internal AI policy establishes clear rules around how AI can and cannot be used within your organization.

SBLS drafts AI policies tailored to your business, including provisions addressing:

• Approved and prohibited AI tools
• Acceptable and prohibited uses
• Confidential and proprietary information
• Customer and client data
• Personal and sensitive information
• Use of personal AI accounts and devices
• AI-generated and AI-assisted work product
• Intellectual property considerations
• Human review requirements
• AI-generated communications and content
• Employee responsibilities
• Approval of new AI tools
• AI note-taking and recording tools
• Documentation and recordkeeping
• Reporting and escalation procedures
• AI-related incidents and unauthorized use

Your AI policy can also be coordinated with your existing confidentiality agreements, employee policies, acceptable use policies, information security requirements, vendor procedures, and other internal documents so that the rules governing AI do not operate in isolation.

Before drafting policies or adopting additional AI tools, it can be helpful to understand how AI is already being used across your organization.

SBLS can review your company's current AI practices and identify areas where additional policies, contractual protections, or internal controls may be appropriate.

Depending on the business, the assessment may consider:

• AI tools currently being used
• How employees are using those tools
• Information being entered into AI systems
• Customer, employee, or proprietary data processed through AI
• Use of AI in higher-risk business decisions
• Existing AI policies and procedures
• Employee use of personal or unapproved AI accounts
• AI vendor relationships
• Existing contractual obligations involving confidentiality and data
• Human review and approval processes
• Internal documentation and recordkeeping

Following the assessment, SBLS can provide recommendations for policies, contracts, and other legal measures based on the company's existing AI use.

Before giving an AI platform access to company information, customer data, proprietary materials, or internal systems, your business should understand the contract governing that relationship.

AI vendor agreements can address far more than price and access to the software. They may determine what happens to information entered into the platform, whether that information can be retained or used for model training, who owns outputs, what happens after termination, and how responsibility is allocated if something goes wrong.

SBLS reviews and negotiates agreements involving AI and technology vendors, including:

• SaaS agreements
• AI vendor agreements
• Enterprise agreements
• Terms of Service
• Data processing agreements
• AI addenda
• Acceptable use policies
• Licensing agreements
• Technology service agreements

Our review may address provisions involving:

• Ownership and use of company data
• Model training and fine-tuning rights
• Confidentiality
• Intellectual property and AI-generated outputs
• Data retention and deletion
• Security obligations
• Subprocessors and third-party providers
• Incident and breach notification
• Representations and warranties
• Indemnification
• Limitations of liability
• Termination rights
• Documentation and audit rights
• Allocation of responsibility for AI-generated actions or outputs

Where negotiation is available, SBLS can negotiate directly with the vendor on your behalf.

The legal review of an AI tool should not necessarily end after the initial contract is signed.

Businesses adopting multiple AI tools may benefit from a defined process for evaluating new vendors and determining which tools employees are permitted to use.

SBLS can help businesses develop an AI vendor approval framework addressing issues such as:

• Requests to adopt new AI tools
• Legal review requirements
• Vendor documentation
• Data and confidentiality considerations
• Contract review
• Approved and prohibited tools
• Changes to vendor terms
• Periodic review of approved tools
• Removal of tools that no longer meet company requirements

This framework can become part of the company's broader AI governance process as its use of AI expands.