Back to the CIO and CSO starting point Security and GRC hub
AI Contracts and Legal Review: What to Check
AI contract review checks what a vendor's written terms promise about output ownership, IP indemnity, data processing, health data, breach notice, and subprocessors. Lightbridge reads those terms as each vendor states them and marks the gaps. Your counsel then decides what to negotiate and what to accept. This page is not legal advice.
Not legal advice. Lightbridge is an advisory and program-management firm, not a law firm. The tables below link the source for each vendor statement, and we fetched those sources on 2026-11-03. Several sources carry their own older or newer dates, which the table notes give. Contract text changes, so counsel should read the current version before you sign. Lightbridge does not recommend a vendor. This page sits in Lightbridge's security and GRC advisory hub and pairs with the AI security questionnaire guide.
Output ownership, IP indemnity, and liability caps: what five vendors state, as read by Lightbridge.
The first table covers the commercial terms. Cells say what the vendor states. Where we did not capture primary text, the cell says so. A gap here is a gap in our review, not a statement about the contract.
| Vendor and source | Output ownership | IP indemnity and stated conditions | Liability cap as written |
|---|---|---|---|
|
Anthropic Commercial Terms | Anthropic states that, as between the parties and to the extent permitted by law, the customer retains rights to Inputs and owns Outputs. It states it assigns its rights in Outputs to the customer, subject to compliance with the Terms. | Anthropic states it will defend and indemnify against third-party claims that paid use of the Services, or Outputs from authorized use, violates third-party IP rights. Listed exclusions: modifications, combinations, customer Inputs, knowing infringement, patents practiced in an Output, and trademark use in commerce. | Anthropic states each party's liability is limited to Fees paid in the previous 12 months, and that the limit does not apply to its Section K indemnification obligations. |
|
OpenAI Services Agreement, effective January 1, 2026 | OpenAI states that, as between the parties and to the extent permitted by law, the customer retains ownership of Input and owns all Output. It states it will not use Customer Content to develop or improve the Services unless the customer explicitly agrees. | Section 13.1 indemnifies against claims that the Services infringe a third-party IP right, excluding combinations, third-party modification, Customer Content, and Customer Applications. It also incorporates a separate Service-Specific Terms indemnity, which OpenAI states is uncapped and not materially reducible without the customer's written agreement. We did not fetch that separate document. Section 13.4 makes the indemnities the sole IP remedy. | OpenAI states each party's total liability is capped at amounts paid in the twelve months before the event. Carve-outs: gross negligence or willful misconduct, indemnification obligations, and customer payment obligations. |
|
Microsoft Customer Copyright Commitment page | Not stated in the documentation we reviewed. | Microsoft states the commitment is a Product Terms provision under which it defends customers against certain third-party IP claims about Output Content. Azure OpenAI customers must implement required mitigations, including a metaprompt and a testing and evaluation report that the customer retains and provides to Microsoft on a claim. For text generation, Microsoft states the protected material text model and the jailbreak model must be on in filter mode, and output retroactively flagged by the asynchronous filter is not covered. For code, the protected material code model must be on in annotate or filter mode. In Copilot Studio, output from a model hosted outside Copilot Studio is not covered unless it runs in Azure OpenAI and meets the mitigations. The Product Terms clause itself: Not stated in the documentation we reviewed. | Not stated in the documentation we reviewed. |
|
Google Cloud Service Specific Terms, indemnified services list | Not stated in the documentation we reviewed. | Google states its indemnification extends to allegations that unmodified Generated Output from a Generative AI Indemnified Service using Google models infringes IP, with five listed exclusions, and only for services not provided free of charge. It states a separate training-data indemnity for allegations about its use of training data to create a Google Pre-Trained Model, which does not cover allegations tied to a specific Generated Output. Its indemnified services list (last modified July 20, 2026) names, among others, the Gemini Enterprise Agent Platform API, formerly Vertex AI API, with generally available versions of Codey, Gemini, Imagen, PaLM, and Veo, and Gemini in Workspace. | Not stated in the documentation we reviewed. |
|
AWS Service Terms, section 50.10 | Not stated in the documentation we reviewed. | AWS states it will defend the customer against third-party claims that Generative AI Output from an Indemnified Generative AI Service infringes IP, and pay any adverse final judgment or settlement. The list we saw names Amazon Nova, Titan, Amazon Q, AWS HealthScribe, Kiro, and others. It does not name third-party models on Bedrock. That is an observation about the list text, not a statement of what the contract excludes. Section 50.10.2 lists eight exclusions, including infringing inputs, disabled filters, breach, fine-tuning, continued use after notice, known infringement, trademark, and Kiro Excluded Models. It states the remedies are sole and exclusive. Section 50.10.3 conditions the obligation on prompt notice, AWS control of the defense, record retention, and cooperation. | Not reviewed for this page: the general liability cap in the AWS Customer Agreement. AWS states in section 50.10.2 that its defense and payment obligations for Generative AI Output are not subject to any damages cap. |
Vendor documents fetched 2026-11-03. The Anthropic and OpenAI terms are the versions fetched on that date. The Anthropic terms show no visible effective date in the fetched text. The Microsoft page shows ms.date 2024-05-21 and a 2026-07-13 update. Google's indemnified services list was last modified July 20, 2026, and its Service Specific Terms show no date in the fetched text. The AWS page metadata shows an update on 2026-10-30.
Data protection terms: DPA role, breach notice, subprocessors, government access, and BAA, as Lightbridge reads them.
The second table covers the data processing addendum and health-data terms. Read it next to your hosting choice and your audit logging plan, because the contract only helps if the data flow matches it.
| Vendor and source | DPA role and transfers | Breach notification as written | Subprocessor notice | Government access | BAA eligibility |
|---|---|---|---|---|---|
|
Anthropic DPA, BAA page | Anthropic states the customer is controller and Anthropic is processor for Customer Personal Data. It defines SCCs as Module Two or Module Three of the EU SCCs, plus a UK Addendum. | Anthropic states it will notify the customer in writing of a Security Breach without undue delay and within 48 hours of becoming aware. | Anthropic states reasonable notice before a new Subprocessor gets access. The customer may object in writing on reasonable privacy or security grounds within 15 days or is deemed to consent. The parties then work in good faith toward resolution. | Not stated in the documentation we reviewed. | Anthropic states its BAA covers only the single organization that accepted it, excludes named features, and does not cover all API features. It states Covered Models require 30-day retention and are not available with zero data retention unless Anthropic expressly authorizes it. |
|
OpenAI DPA, BAA help page | OpenAI states it acts as Data Processor. It states OpenAI Ireland Limited transfers EEA and Swiss Data outside the EEA and Switzerland on the basis of agreements containing SCCs or an Article 45 adequacy decision. | OpenAI states notice "without undue delay." The clause we reviewed gives no fixed hour count. | OpenAI states a 30-day subprocessor objection window. | OpenAI states that, to the extent legally permitted, it will inform the customer of a legally binding law-enforcement disclosure request. | OpenAI states a BAA is required before using the API with PHI, that eligible organizations can accept the standard BAA in the API Platform, and that self-serve enrollment requires an established history of API usage. The endpoint list we saw carried no eligible or ineligible labels, so we make no eligibility claim. |
|
Microsoft Azure HIPAA page | Not stated in the documentation we reviewed. The Products and Services DPA page returned no text to us. | Not stated in the documentation we reviewed. | Not stated in the documentation we reviewed. | Not stated in the documentation we reviewed. | Microsoft Learn states there is no separate contract to sign for a HIPAA BAA, because it is available through the Product Terms by default to covered entities and business associates. It cites the DPA as stating that execution of the volume licensing agreement includes execution of the BAA. The page is a generic Azure page, last updated 2024-10-10, and does not list Azure OpenAI, so model-level coverage is not stated in what we reviewed. |
|
Google Cloud Cloud DPA, HIPAA page | Google states it is a processor. Transfer terms: partly captured, so we make no claim beyond that. | Not stated in the documentation we reviewed. The excerpt we saw describes the content of a notice but gives no fixed time period. | Google states it notifies of a New Subprocessor at least 30 days before processing. The customer may object within 90 days of notice by terminating the applicable agreement for convenience. | Not stated in the documentation we reviewed. | Google states Google Cloud and Workspace support HIPAA compliance within the scope of a BAA and that the customer remains responsible for evaluating its own compliance. It states the Google Cloud BAA includes Google Cloud's entire infrastructure plus a listed set of products. The AI-related entries on that list include Generative AI on Agent Platform, Gemini Enterprise Agent Platform, Gemini Enterprise, Gemini Code Assist, Gemini in BigQuery, and AI Platform Training and Prediction. The page also lists Gemini in Google Workspace and the Gemini App among Workspace services in the BAA, excluding Gemini in Google Chrome. Confirm current scope against the live list. |
|
AWS DPA, HIPAA eligible services | AWS states it acts as processor. It states SCCs apply to transfers to Third Countries (controller-to-processor or processor-to-processor), and do not apply if AWS has adopted Binding Corporate Rules for Processors. | AWS states it will notify the customer of a Security Incident without undue delay after becoming aware, excluding unsuccessful Security Incidents. The text we reviewed gives no fixed hour count. | AWS states 30 days' advance notice by website update for new Sub-processors. Objection options: terminate, stop using the Service, or move data to another Region. | AWS states it gives reasonable notice of governmental disclosure demands unless legally prohibited. | AWS states covered entities and business associates agree not to use HIPAA Eligible Services with PHI without first entering into an AWS business associate agreement. It states generally available features of listed services are eligible unless specifically excluded. Whether specific Bedrock models are listed: Not stated in the documentation we reviewed. |
Vendor documents fetched 2026-11-03. The Anthropic, OpenAI, Google, and AWS DPAs show no visible effective date in the fetched text, though the OpenAI DPA is the January 1, 2026 version. The Microsoft HIPAA page was last updated 2024-10-10. Google's HIPAA page lists its Cloud supported services as last updated 2025-09-17 and its Workspace list as 2026-10-28. The AWS HIPAA page metadata shows an update on 2026-10-26. AWS also states, in section 50.12, that for certain Bedrock models it stores inputs and outputs for up to 30 days solely to detect policy violations (AWS Service Terms). That is a retention fact your DPA review should reconcile with your own retention rules.
What legal should negotiate and what it can accept: Lightbridge's practical sort.
This section is Lightbridge's judgment, not a vendor statement and not legal advice. Whether a vendor will move on any item depends on your size, the paper you are on, and the product tier. Counsel makes the call.
Worth a real conversation
- Change-of-terms rights. Anthropic states in its Commercial Terms that it may update them at any time, effective 30 days after posting or notice, and immediately for changes in law. Ask whether a notice and exit right fits your renewal cycle.
- Indemnity conditions you must operate. Microsoft's commitment depends on mitigations and a retained testing report (Table 1). AWS conditions its indemnity on record retention (section 50.10.3, Table 1). These are operating duties. Someone must own them, or the indemnity may not respond when you need it.
- The gap between headline and exclusions. Map your real use against each exclusion list: fine-tuning, combined outputs, disabled filters, modified output.
- Breach clocks. Anthropic states 48 hours. OpenAI and AWS state "without undue delay" (Table 2). If a regulator or customer contract gives you a fixed window, ask for a number.
- The subprocessor remedy. In Table 2, Anthropic states a 15-day window, OpenAI a 30-day window, and Google a 90-day objection by termination for convenience. These are different protections. Check what you can do if you object and the vendor proceeds.
- BAA scope against your features. Anthropic states its BAA excludes named features and that Covered Models need 30-day retention. If your design depends on zero data retention, read the zero data retention explainer from Lightbridge Automation and confirm the two fit.
Usually fine to accept after a read
- Plain output-ownership language. Where a vendor states you own Output (Anthropic and OpenAI do, in Table 1), confirm the wording and move on.
- A twelve-month fees cap with indemnity carve-outs. Anthropic and OpenAI state this shape in Table 1. Whether it is enough for your risk is a business decision, so size it against your exposure.
Contract terms interact with the route you take to the model. A vendor API, a cloud platform, and self-hosting each change who signs what. Lightbridge compares them on AI access paths. Agents and tool access add their own exposure, covered on AI agent security, and identity controls on AI identity and developer access.
EU AI Act deployer obligations at a high level: what Lightbridge sees in the Official Journal text.
Source: Regulation (EU) 2024/1689, Official Journal 12.7.2024, fetched 2026-11-03. The amendments below come from Regulation (EU) 2026/1744 (Digital Omnibus on AI, dated 8 July 2026; published in the Official Journal 24 July 2026 and in force 27 July 2026, per our review). We read the original text and checked only some provisions against the amending regulation. We did not read a consolidated version.
A deployer is an organization that uses an AI system under its own authority. Most of the heavy obligations fall on deployers of high-risk systems. Article 26 requires those deployers to use the system per its instructions for use, assign competent human oversight, monitor operation, report risks or serious incidents, and keep automatically generated logs for at least six months. Articles 26(7) and 26(9) add two items: employer-deployers must inform workers and their representatives before workplace use, and must use the provider's Article 13 information for GDPR Article 35 assessments.
Article 27 requires a fundamental rights impact assessment before deploying certain high-risk systems. It applies to public-law bodies, private entities providing public services, and deployers of Annex III point 5(b) and 5(c) systems, with point 2 excluded. Paragraph 4 now allows cross-referencing an existing data protection impact assessment. As amended by Regulation (EU) 2026/1744, these obligations apply from 2 December 2027 for Annex III systems, and Article 26 from 2 August 2028 for Annex I systems. Confirm the current dates with counsel.
Article 4 applies more widely. As amended by Regulation (EU) 2026/1744, it requires providers and deployers of AI systems to take measures to support the development of AI literacy of their staff and others using AI systems on their behalf. It does not require a guaranteed level of literacy for any individual.
Article 50(4) is the provision a general assistant user is more likely to meet. It requires deployers of AI systems that generate deep fakes to disclose the artificial generation or manipulation. It also requires disclosure for AI-generated text published to inform the public on matters of public interest, except where the text has undergone human review or editorial control and someone holds editorial responsibility.
Why this belongs in a contract review: Article 26 duties such as log retention and instructions for use depend on what the provider gives you. Ask each vendor for the documents your deployer duties rely on, and check log access against the plan on AI observability and audit logging. For the full Act, read the EU AI Act compliance guide from Lightbridge Automation. Related explainers there cover the NIST AI RMF and the Claude compliance guide.
What this Lightbridge review did not cover, and how to close the gaps.
Sources fetched 2026-11-03 (per-source dates are in the table notes). Treat the blanks in the tables as to-do items. The ones that matter most: the Microsoft Products and Services DPA and Product Terms, the Microsoft, Google, and AWS output ownership terms, the Google liability terms, the general AWS Customer Agreement liability cap, any vendor's government-request policy or transparency report, and the OpenAI Service-Specific Terms that hold its output-level indemnity. We also did not confirm HIPAA coverage for specific models on Azure or Bedrock, and we did not map Google's HIPAA product list to specific models. A vendor's sales team can answer some of these in writing. Get the answer in the contract, not in an email.
When a buyer sends you a questionnaire about these terms, the answers should match the paper. See the questionnaire guide and the templates, plus the resource list.
How Lightbridge helps with AI contract review.
Lightbridge is an independent advisory and program-management firm. We build the review checklist, line up the vendor documents, track open items across legal, security, and procurement, and keep the program moving through delivery. We do not practice law. Your counsel owns the legal conclusions. Where hands-on work is needed, vetted partners deliver under Lightbridge's program management. Lightbridge does not recommend a vendor on this page.
Lightbridge Automation, a sibling practice in the Lightbridge group, offers AI governance consulting and publishes explainers on LLM gateways and the ISO 42001 standard. If a recommendation here points to work a sibling practice would deliver, Lightbridge discloses that upfront and you remain free to take the work elsewhere. For wider strategy, see Lightbridge's AI advisory.
AI contracts and legal review: frequently asked questions answered by Lightbridge
Who owns the output of an AI model under these contracts?
Two vendors state it plainly in the terms we reviewed. Anthropic's Commercial Terms state that, as between the parties and to the extent permitted by law, the customer retains rights to Inputs and owns Outputs. OpenAI's Services Agreement (effective January 1, 2026) states the customer owns all Output. Output ownership text for Microsoft, Google Cloud, and AWS: Not stated in the documentation we reviewed. Ask counsel to read the current terms for the product you plan to buy.
Does an IP indemnity cover everything the model produces?
No vendor we reviewed states that it does. Each lists exclusions or conditions. Anthropic lists exclusions such as modifications, combinations, and customer Inputs. Microsoft states that Azure OpenAI customers must implement required mitigations, including a metaprompt and a retained testing report. AWS conditions its indemnity on prompt notice, AWS control of the defense, and record retention. Google states its output indemnity covers unmodified Generated Output and lists five exclusions. Read the exclusions before you rely on the headline. The tables on this page link each source.
Do we need a BAA to put health data into an AI service?
OpenAI states a BAA is required before using its API with PHI. AWS states covered entities and business associates agree not to use HIPAA Eligible Services with PHI without first entering into an AWS business associate agreement. Anthropic states its BAA covers only the organization that accepted it and does not cover all API features. The tables on this page link each source. Lightbridge cannot say whether your use is covered. That is a question for your privacy counsel and the vendor's current eligibility list.
How fast must a vendor tell us about a breach?
As written, the answers differ (sources are linked in the second table). Anthropic's DPA states notice without undue delay and within 48 hours of becoming aware. OpenAI's and AWS's DPAs state notice without undue delay, with no fixed hour count in the clauses we reviewed. Microsoft and Google breach-timing text: Not stated in the documentation we reviewed. If your own regulators set a clock, ask counsel whether the contract clock fits inside it.
Can we object to a new subprocessor?
The DPAs we reviewed give a window, and the remedy differs (sources are linked in the second table). Anthropic states a 15-day written objection on reasonable privacy or security grounds, with deemed consent otherwise. OpenAI states a 30-day objection window. Google states 30 days' notice and a 90-day period in which the customer may object by terminating the applicable agreement for convenience. AWS states 30 days' advance website notice with options to terminate, stop using the service, or move data to another Region. Microsoft: Not stated in the documentation we reviewed.
Are we a deployer under the EU AI Act?
If your organization uses an AI system under its own authority in the EU or on EU residents, the Act's deployer provisions may apply to you. Article 26 obligations (instructions for use, human oversight, monitoring, log retention of at least six months) apply to high-risk systems only. Most general assistant use falls under other provisions, such as the Article 50(4) disclosure rules for deep fakes and for AI-generated text published to inform the public on matters of public interest. Article 4 on AI literacy, as amended in 2026, is not limited to high-risk systems. Application dates were also amended in 2026, so have counsel confirm the current dates. Lightbridge Automation publishes a fuller guide, linked on this page.
Should legal or security review the AI contract first?
Lightbridge's view: run them together on one checklist. Security reads the DPA and the data flows. Legal reads indemnity, caps, and change-of-terms rights. Procurement owns the paper. The sequence matters less than having one owner who tracks open items across all three. That owner is often the program manager.
Bring your AI contracts to a Lightbridge advisor.
Send the vendor paper you already hold. Lightbridge will help you build a review checklist that your counsel, security team, and procurement can all work from.