AI Risk Shifting to Customers; Contracts Matter

For years, business customers expected software vendors to defend IP infringement claims and cover losses. As AI companies entered the market, these protections became standard.

That assumption is increasingly unreliable.

The pace of litigation involving AI systems is accelerating, with over 100 copyright infringement cases already filed. Insurers are tightening coverage policies, while vendors are reducing indemnity provisions. As a result, businesses using AI tools are taking on more risks that vendors previously covered.

When it comes to AI tools, the standard contracting playbook doesn’t work.

Original Contracting Model

In 2023, AI companies seeking enterprise adoption began offering protections similar to traditional software indemnities. Microsoft, Amazon, and Google each announced AI copyright indemnity or copyright shield programs to reassure enterprise customers concerned about training-data disputes and AI-generated outputs.

The basic assumption was straightforward: the vendor built and trained the model and controlled the underlying systems, and therefore should bear the primary legal risk of infringement claims.

For a time, broad indemnity language was an important selling point for enterprise AI adoption. Other standard protections included insurance requirements, warranties on lawful training practices, and limits on vendor disclaimers.

The Market Is Changing

The legal landscape has shifted rapidly. AI companies now face mounting lawsuits from publishers, authors, artists, software developers, and other rights holders. Claims increasingly target not only training data but also generated outputs that allegedly reproduce copyrighted material, mimic protected styles, or produce infringing code.

At the same time, insurers are reassessing AI exposure across cyber, technology E&O, media liability, and related policies. Some policies now include: AI-specific exclusions; narrower definitions of covered services; intellectual property carveouts; restrictions on generated outputs or training data; and requirements for documented AI governance controls.

As insurers narrow coverage, vendors are shifting more risk onto customers. An increasing number of AI agreements:

exclude claims arising from customer prompts or fine-tuning data; deny indemnity if outputs are modified or combined with customer content;

shift responsibility for high-risk uses to customers; and

cap liability while disclaiming warranties regarding accuracy, infringement, or regulatory compliance.

Some agreements also exclude coverage for uses in regulated industries or third-party model components. Those exclusions can erode much of the protection businesses thought they were buying.

Businesses To Do

This does not mean businesses should stop using AI tools. It does mean they should stop treating AI contracting like ordinary SaaS contracting.

Contracts, governance, cybersecurity, privacy, insurance, and operational controls increasingly work together as part of a broader risk-management strategy.

Indemnities

Many AI indemnities do not provide nearly as much protection as customers assume. Key questions include:

• Are generated outputs covered?

• Are there exclusions tied to prompts, fine-tuning, or customer modifications?

• Are a vendor’s indemnification obligations capped by the limitation-of-liability clause?

• Who controls the defense and settlement of claims?

• Can the vendor unilaterally change model functionality or usage rules?

Operational Protections

As broad indemnities narrow, focus more on other obligations. Depending on the use case, you may want:

• Commitments to lawful training-data sourcing practices;

• Human review requirements for sensitive workflows;

• Audit and transparency rights;

• AI-specific insurance coverage;

• Notification obligations for investigations or security incidents; and

• Governance or data-security obligations.

These become more important when traditional indemnities no longer provide complete protection.

Review Insurance Coverage

Take an inventory of how your business uses AI (tools, data, risk allocation in contracts related to those tools).

• Map coverage areas to types of AI risk.

• Review the increasing number of AI-specific exclusions; your current coverage may not match your prior coverage.

• Talk with your insurance professional about whether new or updated AI-specific coverage is warranted.

Address Internal AI Governance

• Internal governance matters. Regulators, insurers, courts, and enterprise customers increasingly expect documented AI governance practices.

• Do not turn a blind eye to employees using personal AI tools not approved by the company.

• Written AI usage policies, employee training, approval requirements for high-risk uses, restrictions on confidential or regulated data inputs, and documentation procedures are increasingly important.