The consulting firm advising on your market entry. The developers building your platform. The outsourcing team handling your back office. The agency writing your communications. They are all using AI — to research, to draft, to code, to analyse. In most cases, they are using it on your work, with your data, without any contractual framework governing how.
This is not a future problem. The contracts you already have with these suppliers were written when AI was a consideration for a narrow category of technology procurement. That is no longer the world. AI is now simply how professional work gets done, across every service category, at every price point. And the standard MSA, professional services agreement, or outsourcing contract was not drafted with this in mind.
Where Existing Contracts May Fall Short
The core issue is that standard service contracts were designed for a different model of service delivery. AI is not a conventional tool in the way that software platforms or research databases are. It processes your information, generates substantive work product, and operates under a separate vendor’s terms — a combination that raises questions earlier tools simply did not.
Subcontracting. Most service agreements restrict subcontracting without consent, on the basis that you have engaged a specific provider and want control over who does the work. When a supplier uses AI to perform a material part of the engagement, such as drafting, analysis, or code generation, the AI vendor becomes, in a meaningful sense, involved in delivering the service. Whether that falls within or outside existing subcontracting provisions depends on precise drafting, but it is a question those provisions were almost certainly not written to answer.
Intellectual Property. In many jurisdictions, AI-generated content does not attract the same copyright protection as human-authored work; meaning deliverables produced with significant AI involvement may not be protectable at all, regardless of what the parties intended. There is also a risk running the other way: AI systems can reproduce elements of third-party material embedded in their training data, potentially creating infringement exposure for the client who uses or publishes the output.
Data and confidentiality. A confidentiality obligation is only as effective as the supplier’s practical ability to honour it. When a supplier processes your information through an AI tool, that ability is partial. They control what goes in; they do not fully control what the AI vendor’s systems do with it afterwards — how long it is retained, who can access it, or whether it is used to train or refine the model. Many AI services use customer inputs for training purposes unless the user has actively opted out, a step many suppliers have not taken.
Quality. The professional standard a supplier owes you does not change because AI is involved in producing the work. What is less clear is how that standard is applied in practice. AI generates outputs that look complete, structured, and fluent, and that appearance can reduce the depth of review that follows. The relevant question is how the AI-generated content has actually been reviewed and validated before it reaches you, and against what criteria. Most contracts do not address this.
The Case for a Standard AI Use Schedule
The practical response is not to renegotiate every existing service agreement. It is to introduce a standard AI Use Schedule, a short addendum that sits alongside the main contract and sets out the terms on which AI may be used in delivering services to you.
The schedule operates at two levels. A baseline set of provisions applies to any engagement where the supplier uses AI, regardless of sector or subject matter. Additional provisions can then be layered on where the nature of the services requires enhanced protections, for example in relation to HR and people-related services or work carried out in regulated industries.
At the baseline, the schedule should address the following.
Permitted usage. The schedule should specify which AI tools the supplier is authorised to use on the engagement, which require prior client approval, and what notification is required before a new tool is introduced. Knowing that a supplier uses AI generally is not the same as knowing it is being used on your specific work, with your specific information.
Data and training. Client information provided in the course of an engagement should not be used to train, fine-tune, or otherwise improve an AI model without the client’s explicit consent. Many AI services permit this by default, and the obligation to opt out falls on the user of the service rather than the client. The schedule should reverse that position, placing responsibility on the supplier to ensure that no client data enters a training pipeline. It should also confirm that any AI tool used to process client personal data is identified as an approved sub-processor under the applicable data processing agreement, and that the supplier has taken the steps required to bring that processing within the agreed data protection framework.
Change notification. Where the supplier changes which AI tools are used during the engagement, they should be required to notify the client in advance. A tool introduced partway through may have materially different data handling practices, retention periods, or output characteristics from the one originally in place, and the client should have the opportunity to assess that change before it takes effect.
Quality and verification. The professional standard the supplier owes the client does not change because AI was involved in producing the work. The schedule should require that AI-generated content is subject to meaningful human review and validation before delivery. That review should be sufficient to identify errors, inconsistencies, or outputs that fall below the agreed standard. The supplier remains accountable for the quality of what is delivered, regardless of how it was produced.
Audit. The client should have the right to request, on reasonable notice, information about which AI tools are being used, how client information is being handled within those systems, and what records are being maintained. The schedule should require the supplier to keep adequate logs of AI tool usage and data handling to support that right in practice.
What to Do Now
AI is already embedded in day-to-day service delivery, often without customers having much visibility into how it’s being used. Yet many supplier contracts still don’t deal with it in any meaningful way.
An AI Use Schedule is a practical way to close that gap. It doesn’t require you to rewrite every supplier agreement, but it does give you a clear framework for managing how AI is used in the services you receive.
For new contracts, consider making an AI Use Schedule part of your standard contracting process. For existing agreements, start by identifying the supplier relationships that matter most, for example, those involving sensitive data, business-critical services, or longer-term engagements.
Book a free call with our lawyers if you’d like to discuss how an AI Use Schedule could work in your organisation, or you’d like help drafting one.
Picture from FreePik
