Why 2026 Changes the Contract Drafting Landscape

Artificial intelligence is now embedded in ordinary commercial operations. Firms no longer merely license software. They deploy systems that learn from data, change over time, and influence decisions with legal and financial consequences. This shift creates a category of exposure that older service agreements were never built to handle.

The timing matters. The European Union’s AI Act, Regulation (EU) 2024/1689, brings most of its obligations into effect from 2 August 2026, including duties tied to high-risk systems and the mandated availability of regulatory sandboxes. Any contract signed in 2026 that touches AI without addressing these duties leaves a gap. That gap sits between what the parties agreed and what the law now demands.

International contracts feel this pressure first. A single AI-enabled transaction can trigger multiple data protection regimes at once, each attaching through its own connecting factors, regardless of the chosen seat or governing law. A liability structure written for static software does not map onto a model that updates weekly and produces outputs no party fully predicted.

What an AI Clause Actually Does

An AI clause is a dedicated contractual provision that allocates risk, defines duties, and sets standards for any AI system used in performing the agreement. It converts abstract compliance principles into enforceable terms. The central idea is direct. Accountability for AI systems should be written into the contract at negotiation, not left to later litigation or regulatory action.

A workable clause covers a defined set of domains. These include data ownership and model training rights, treatment of confidential information contained in prompts and outputs, human oversight guarantees, security controls for AI-specific threats, liability caps calibrated to algorithmic harm, and governance of model updates. Each domain reflects a failure mode that generic terms miss.

The clause also names the AI. It identifies which systems fall within scope, who supplies them, and where they sit in the value chain. Model providers often cascade their terms down to deployers and then to end users. Without a clear definition, a contract can import obligations and disclaimers that neither party read.

The Liability Gap in Standard Terms

Research into standard contracts for generative AI services shows where the risk concentrates. A survey of 20 standard contracts from 13 leading providers, spanning US firms such as Anthropic, Google, Microsoft, and OpenAI, alongside European and Chinese providers such as Alibaba, DeepSeek, and Mistral, found recurring patterns that favour the provider. Services are typically offered on an as-is basis, with broad exclusions of warranty and wide disclaimers of liability.

Studies of provider terms confirm this pattern across the market. Ownership of outputs is usually assigned to the user, yet the risk of copyright infringement in those outputs is left with the user as well. Providers position themselves as neutral intermediaries, passing risk downstream while retaining control over how their systems behave. Exclusion, limitation, and indemnity clauses of this kind may be wholly or partly invalid in consumer contracts in many jurisdictions, but business-to-business parties enjoy fewer automatic protections.

That imbalance is the reason a bespoke AI clause matters. If a commercial party accepts a provider’s standard terms without negotiation, it inherits the provider’s risk allocation. The AI clause in the downstream contract is the mechanism to redistribute that risk between the actual contracting parties, rather than accept a default written by a third party.

Data, Confidentiality, and Training Rights

Prompts and outputs carry data. In an international deal, that data can be personal data under the GDPR, confidential business information, or protected professional material at the same time. The AI Act and the GDPR operate together here, and a contract that ignores either invites parallel exposure.

The core questions are practical. Can the vendor use the customer’s data to train or improve its models? Are prompts retained, and for how long? Do embeddings or derivative representations of confidential inputs persist inside the model after the contract ends? A clear clause answers each point with a rule, not a hope. Data minimisation and retention limits belong in the text, not in a policy that changes without consent.

Training rights deserve express treatment because the default often runs against the customer. Where terms are silent, providers may treat submitted content as fair use for improving the service. A contract that states no training on customer data without written consent closes that door. It also gives the customer a documented position if a dispute arises later.

Human Oversight and Explainability

The AI Act ties several obligations to human agency. High-risk systems, listed under Annex III, attract duties that assume a human remains able to understand, supervise, and intervene. A contract can turn that legal expectation into a measurable commitment.

Human oversight guarantees state who reviews AI outputs, at what stage, and with what authority to override. They matter most where the AI influences decisions with legal effect, such as credit, employment, or eligibility. Explainability terms require the vendor to provide information sufficient to interpret an output and to support an audit. Without such terms, a customer facing a regulator may be unable to explain how a decision was reached.

These provisions also protect the vendor. Clear allocation of oversight duties prevents a customer from claiming reliance on automation that the contract never promised. The clause defines the boundary between what the system does and what the human operator must still do.

Model Updates and Performance Drift

A traditional software warranty assumes a stable product. AI systems break that assumption. A model can change through retraining, fine-tuning, or a provider-side update, and its behaviour can drift without any change to the contract. Performance that met the specification in January may fail it in July.

An AI clause should govern this directly. It can require notice before material model changes, set performance standards that survive updates, and reserve the customer’s right to test after each change. Warranty terms can be structured as a limited warranty tied to defined performance metrics, rather than an as-is disclaimer that leaves the customer without recourse.

Regeneration risk and model contamination belong here too. Where a model has ingested data it should not have, outputs may reproduce that data or infringe third-party rights. The contract should allocate responsibility for such events and require the vendor to remediate identified contamination within a fixed period.

Cross-Border Enforcement and Dispute Resolution

International contracts must decide where disputes go and which law governs. AI complicates both. Data processed in a distributed transaction can engage several mandatory data protection regimes at once, each attaching independently of the parties’ chosen forum. A clause that picks a single seat does not switch off the others.

Arbitration is now a live compliance question rather than a neutral default. Arbitrators using AI tools to review documents or draft awards may themselves be deployers of regulated high-risk systems under the AI Act. Counsel submitting AI-generated research faces binding professional responsibility standards, reflected in guidance such as ABA Formal Opinion 512, including duties around accuracy and disclosure. A dispute resolution clause can address permitted AI use, disclosure obligations, and responsibility for hallucinated authorities.

Cross-border parties should also plan for evidence. The clause can require each side to preserve logs, prompts, and model version records, which are the materials a tribunal will need to reconstruct what the system did. Without preservation duties, the key evidence may be gone by the time a claim is filed.

Drafting the Clause: A Practical Checklist

A usable AI clause reads as a set of clear commitments. First, define the AI systems in scope and their suppliers. Second, allocate data ownership and prohibit training on customer data without consent. Third, set retention and deletion rules for prompts, outputs, and derived representations.

Fourth, guarantee human oversight for decisions with legal effect and require explainability information sufficient for audit. Fifth, impose notice and testing rights for model updates, and tie warranties to defined performance metrics rather than an as-is standard. Sixth, calibrate liability caps to algorithmic harm, and reject blanket indemnities that shift all risk to the customer.

Seventh, address cross-border compliance by mapping the data protection regimes likely to attach and by naming the governing law and forum with open eyes about mandatory rules elsewhere. Eighth, require preservation of logs and model version records to support any future dispute. Each item converts a known failure mode into an enforceable term.

What This Means for 2026 and Beyond

The regulatory calendar has removed the option of delay. With the bulk of the AI Act’s obligations applying from 2 August 2026, contracts written in 2026 sit inside the new regime from the moment they take effect. A generic clause that ignores algorithmic risk exposes both parties to compliance failure and to disputes that standard terms cannot resolve.

The direction of travel is consistent across the United States, the European Union, and other markets moving toward AI-specific rules. Vendor contracts built for static software are being re-engineered for continuously evolving models, layered sub-processor chains, and automated decision systems under growing statutory scrutiny. The AI clause is the instrument that carries that shift into individual deals.

Parties that draft it well gain more than compliance. They gain certainty about who bears which risk, clarity about how the system may change, and evidence they can rely on if a dispute arises. For international commercial contracts in 2026, that clause has moved from optional to close to essential.