Enterprise SaaS Contracts: Hidden AI Training Licenses

Enterprise SaaS contracts have become a focal point of concern due to their potential to secretly grant AI vendors sweeping rights to train models on sensitive data, including source code, financial records, legal documents, and customer information. Most companies are unaware of this exposure, which stems from standard clauses buried in these contracts.

Introduction to the Risk

The Federal Trade Commission (FTC) issued a notice to companies in February 2024, emphasizing that businesses cannot unilaterally revise their privacy commitments to enable AI training without informing their users. This risk originates from contract language written before the existence of generative AI, where provisions allowing vendors to improve, build, or enhance their products can now extend to AI training and fine-tuning, unless customers explicitly negotiate limits.

What does this mean for companies? Essentially, their data, once thought to be securely stored and processed, can now be used to train AI models that may serve other customers or the vendor’s own products, potentially leading to data privacy issues and competitive intelligence concerns.

Can companies protect themselves from these unseen risks? The answer lies in understanding the fine print of their SaaS contracts and negotiating better terms that protect their data and intellectual property.

Standard SaaS Clauses and AI Training Licenses

In traditional SaaS arrangements, customer data is stored, processed, and returned. However, in AI engagements, vendors may seek to use this data or its derivatives to train, fine-tune, or improve AI models that could be used for other customers or the vendor’s products. Most agreements signed in the past few years do not draw a clear distinction between these uses.

An analysis by TermScout, a contract certification platform, found that 92% of AI contracts claim data usage rights beyond what is necessary for service delivery, significantly exceeding the market average of 63%. Many of these contracts allow vendors to use customer data for competitive intelligence purposes, indicating a substantial exposure beyond just document sharing.

A model trained on proprietary workflows or deal structures can absorb commercially valuable patterns and reproduce them in products sold to the vendor’s other customers, leading to potential intellectual property and data privacy breaches.

Case Studies and Implications

The design software company Figma was hit with a proposed class-action lawsuit in November 2025, alleging that the company used customer designs and intellectual property without permission to train its generative AI tools. Figma denied using customer data to train models without explicit authorization, but the incident highlights the risks associated with AI training and data usage.

After customers expressed concerns that updated terms granted Adobe broad rights over their content, the company clarified its policies and committed not to train AI systems using customer data. However, Adobe does use a licensed image collection to train its Firefly generative AI engines and shares the generated revenue with image providers, showing the complexity of AI data usage and revenue models.

How can companies navigate these complex issues? Understanding the terms of their SaaS contracts and ensuring they have negotiated adequate protections for their data and intellectual property is crucial.

AI Vendors and Liability

AI vendor transactions introduce distinct risks that traditional SaaS frameworks were not designed to address. The gap in intellectual property protection is significant, with only 33% of AI vendors offering protection from third-party IP claims, lower than the market average of 58%.

This means most enterprise customers have no contractual recourse if a vendor’s model produces infringing output from their data, leaving them to absorb compliance risks while AI vendors cap their liability.

As companies push back against vendor rules that create ambiguity around permissible AI use, compliance concerns are deterring investment in AI workflows that might later violate operational policies or data privacy regulations.

What Should You Do About SaaS Contracts and AI Training?

Given the risks and complexities associated with SaaS contracts and AI training, companies must take a proactive approach to protect their interests. This includes carefully reviewing contract terms, negotiating explicit limits on data usage, and ensuring they understand how their data will be used for AI training and other purposes.

Additionally, companies should seek legal counsel experienced in AI and data privacy to navigate these evolving landscapes. By taking these steps, companies can mitigate the risks associated with SaaS contracts and AI training, protecting their data, intellectual property, and competitive advantage.

Understanding and negotiating SaaS contracts is no longer just about ensuring service delivery; it’s about protecting your company’s future in the age of AI.

What does the future hold for SaaS contracts and AI training? As AI technology continues to evolve, the importance of clear, protective contract terms will only grow. Companies must stay ahead of these developments to safeguard their interests and thrive in a rapidly changing business environment.

SaaS Contracts and AI Training – Disclaimer

This article does not replace professional advice. Outcomes may vary based on individual circumstances. Consult a qualified legal or financial advisor for specific guidance on SaaS contracts and AI training.