Your support tool now summarizes tickets. Your CRM drafts follow-up emails. Your payroll software "detects anomalies". None of these features came with a new contract: they arrived in an update, under an agreement signed three years ago for software that stored data and displayed it.
Our position: your vendor contract was written for software, not for AI. It says where your data is hosted. It rarely says whether that data trains a model, who runs the model, where your prompts go, what happens when the model misbehaves, or what you get back when you leave. It is a position, not legal certainty: some vendors have already updated their terms, and your counsel remains the reference for your own contract.
In September we gave you the ten questions to ask vendors that use AI. A questionnaire informs; a contract binds. This is the contract side.
1. Training on your data
This is the clause everyone thinks they have, because the vendor's trust page mentions it. Take Slack, which is fairly transparent on the subject: its privacy principles state that it does not train generative AI models on customer data without affirmative opt-in consent, but that its "global" models, used for things like recommendations, may use customer data unless the workspace owner requests an opt-out by email. Status: confirmed by Slack, which reworded these principles in 2024 after criticism reported by the trade press.
The lesson is not about Slack. It is about where the rule is written: a web page the vendor can change, not a clause you signed. The clause that holds says three things: no training or "service improvement" on your data without your written consent; that consent is not a condition of using the service; and the rule covers inputs, outputs, user feedback and telemetry, not just "content".
2. AI subprocessors
Behind your vendor's assistant there is often a model provider, sometimes a gateway, sometimes an indexing service. These are subprocessors in the full sense. OSFI's Guideline B-10 expects agreements for high-risk and critical arrangements to set parameters on subcontracting, to have the institution informed in writing and on a timely basis, and, depending on risk, to reserve its right to refuse a subcontractor. B-10 applies to federally regulated financial institutions; the logic holds for any organization.
The clause that holds: model providers are named in the contractual subprocessor list, with advance notice before any change of model, model provider or processing region, and a right to object. Without it, your vendor can switch models on a Tuesday, and your data changes hands with it.
3. Where your data and your prompts live
Your contract probably says "data hosted in Canada". It rarely says where the model processes your prompts, where conversation logs, outputs and the indexes built from your documents are kept, or for how long. Hosting can be in Montreal and inference in Virginia.
In Quebec this is not a detail. Section 17 of the private sector privacy act, as amended by Law 25, requires a privacy impact assessment before communicating personal information outside Quebec, or entrusting someone outside Quebec with holding or using it on your behalf. The Commission d'accès à l'information adds that the communication must be covered by a written agreement that takes the assessment's results into account. A prompt that contains a customer's name and goes to a model hosted elsewhere is a communication. Federally, the Office of the Privacy Commissioner reminds organizations that they remain accountable for information transferred to a third party for processing, and that the contract is the primary means of ensuring comparable protection.
The clause that holds: the region where prompts, outputs, logs and indexes are processed and stored is named, with a retention period, and any change requires advance notice.
4. Incident notification
Your notification clause probably covers "any security breach of our systems". An AI incident does not always look like that: a leak at the model provider, an exposed gateway key, a prompt injection that surfaces one customer's data in the answer given to another. B-10 expects the contract to require notice of incidents at the third party or at a subcontractor that impact or could impact the services. The NIST AI RMF points the same way: contingency processes for failures or incidents in third-party data or AI systems deemed high-risk (GOVERN 6.2).
The clause that holds: a deadline in hours, a scope that includes the model provider, the gateway and abnormal model behaviour on your data, and the minimum content of the notice.
5. Exit and portability
The day you leave, what do you get back? B-10 expects data and records to be returned in a format that allows the institution to sustain operations, without unreasonable expense. With AI the list grows: your data, but also logs, indexes, assistant configurations, and the prompt libraries your teams built. And what must disappear: your data in the model provider's logs, and in any model fine-tuned with it.
The clause that holds: return in a usable format, deletion certified in writing, including at subprocessors, and a transition period during which the service continues.
What regulators already say
The EU AI Act sets the principle for high-risk systems: the provider of the system and the third party supplying a model, tool or component specify by written agreement the information, technical access and assistance needed (Article 25(4)). In March 2025 the EU's public buyers community published model contractual clauses for procuring AI, non-binding and adaptable by private buyers. And ISO/IEC 42001 dedicates an Annex A control objective to third-party and customer relationships. Nothing forces you to copy these texts; they spare you the blank page.
This week's test: thirty minutes, one contract
Take the contract of the vendor that processes the most personal information for you and has added an AI feature since signing. Search for five words: "training", "subprocessor", "region", "incident", "return". For each: the clause exists, exists without covering AI, or does not exist. Three or more "does not exist": that contract goes to the top of your renewals.
With the large SaaS publishers, you will not negotiate everything. The clause then becomes a setting (training opt-out, processing region), evidence to file, or a reason to choose differently.
What do you think?
Too early to demand these clauses, or already too late for the contracts you signed? Have you ever obtained a clause on training or on prompt location from a vendor? Tell us in the comments which of the five was the hardest to negotiate.
Where FortaRisks fits
Our free vendor security questionnaire already covers subprocessors, data location and incident notification, with CSV export; the vendor risk readiness check places your program in a few minutes. Forta Suppliers tiers your third parties by inherent risk, compares what they declare with an external scan of their attack surface, and sends a first alert within 48 hours. Data hosted in Canada.
Sources: Commission d'accès à l'information du Québec, privacy impact assessment guide (version 3.1, April 2024, in French) · OSFI, Guideline B-10 on third-party risk management · Office of the Privacy Commissioner of Canada, guidelines for processing personal data across borders · NIST, AI Risk Management Framework (AI 100-1) · Regulation (EU) 2024/1689 on artificial intelligence · European Commission, updated EU AI model contractual clauses (MCC-AI) · ISO/IEC 42001:2023 · Slack, privacy principles: search, learning and AI