By business type

Terms & Conditions Generator for AI companies

Written for training data, prompts and outputs, the EU AI Act and the questions enterprise buyers actually ask.

Generate your terms and conditions Read the terms and conditions guide

AI terms carry two clauses that ordinary SaaS terms do not need: who owns the output, and what happens when the output is wrong. Both are commercially significant, and both are read closely by anyone building on top of you.

AI companies face a disclosure problem no template handles: the same data can be an input, a training corpus, an output and a log, and each of those has a different legal character. A prompt containing personal data is processing; retaining it is storage; training on it is a new purpose; and generating an output about a person is processing again, with an accuracy obligation attached.

Regulators have moved fast here. Data protection authorities have opened and settled investigations into training data provenance, lawful basis for web scraping, the accuracy of model outputs about real people, and the adequacy of opt-outs. The EU AI Act adds a transparency layer of its own: people must be told when they are interacting with an AI system, synthetic content needs marking, and general-purpose model providers face documentation duties.

Commercially, the questions that actually decide deals are narrow and specific: do you train on customer data, how long do you retain prompts, which model providers are in the chain, can data be processed in a specified region, and can the customer opt out of everything above. A policy that answers those five questions plainly beats one that is comprehensive but evasive.

What a terms and conditions for an AI company has to cover

Output ownership and the licence the customer receives, including the position on similar outputs to other users
Accuracy disclaimers that are honest about hallucination without disclaiming the service itself
Prohibited uses tied to real harms, and the enforcement route
Input warranties: the customer confirms they have the right to submit what they submit
Indemnity position on output-related claims, in whichever direction you are prepared to commit

How an AI company actually moves personal data

Prompts and inputs

Users paste anything into a prompt box, including personal data about third parties. Retention of prompts, and who inside the company can read them, is the first question in every review.

Outputs and generated content

Outputs about identifiable people are personal data. That brings accuracy, rectification and erasure obligations to content the model produced rather than content anyone stored.

Training and fine-tuning corpora

Scraped data, licensed datasets, and customer content if you use it. Provenance, basis and opt-out routes all need documenting, and the answer materially affects enterprise sales.

Human review and evaluation

Rating pipelines and red-teaming expose staff or contractors to user content. It is legitimate processing but it needs disclosing, because users assume nobody reads their prompts.

Model provider sub-processing

Calls to OpenAI, Anthropic, Google or an inference host move customer content to a third party with its own retention window and its own training position.

Telemetry, logs and abuse monitoring

Safety and abuse systems retain content longer than the product does, which is defensible but has to be described rather than discovered.

Third parties the draft will ask you about

OpenAI · Anthropic · Google Cloud Vertex · AWS Bedrock · Pinecone or Weaviate · Modal or Replicate · Scale or Surge for human evaluation · Datadog

The rules that apply

Lawful basis for training data

Scraped and licensed corpora containing personal data need a basis, and legitimate interests requires a documented balancing test that engages with the individuals’ expectations.

GDPR Article 22 and automated decisions

Where an AI system makes decisions with legal or similarly significant effects, the individual has rights to information, human intervention and challenge.

EU AI Act transparency duties

Disclosure when a person interacts with an AI system, marking of synthetic content, and documentation obligations for general-purpose models, phasing in on a set timetable.

Accuracy and rectification

A model that produces false statements about a real person engages the accuracy principle, and "the model generated it" is not a defence regulators have accepted.

Model provider chain

If you route customer content to a third-party model, that provider is a sub-processor with its own retention and training terms that flow through to your customers.

What the generated terms and conditions contains

Who the contract is with and how it is formed
Your legal entity, and the exact moment acceptance happens - account creation, checkout, or continued use.
The service, the licence and its limits
What you are actually providing, what the user may do with it, and what they may not.
Price, payment, renewal and cancellation
Billing cycle, auto-renewal, price-change notice, and how either side ends the arrangement.
Acceptable use and enforcement
The behaviour that gets an account suspended, and the process you follow before you suspend it.
User content and intellectual property
Who owns what, the licence you need to run the service, and the takedown route for infringing material.
Warranties, liability and indemnity
Disclaimers that survive local consumer law, and caps that are actually enforceable rather than theatrically broad.
Governing law, jurisdiction and disputes
The law that applies, the courts that hear it, and any pre-litigation steps you require.

The AI compliance document set

Write the training position first
One paragraph, in plain language: whether customer content trains models, whether there is an opt-out, and what happens to data already used.
Set and publish retention windows
For prompts, outputs, logs and abuse-monitoring copies - which are usually different from each other.
Document training data provenance
Sources, licences, and the legitimate interests assessment for anything scraped.
Build a rectification route for outputs
A way for someone to report a false generated statement about themselves, and a documented response.
Publish the model provider chain
Which providers process customer content, in which regions, with what retention and training terms.
Add AI Act transparency where it applies
Interaction disclosure, synthetic content marking, and the documentation duties for general-purpose models.

Where this usually goes wrong

Silence on training

If the policy does not say whether customer content trains models, buyers assume the worst answer and regulators treat the omission as a transparency failure.

An opt-out that only covers future data

If a user opts out, the honest position on data already in a training set has to be stated - including where removal is not technically possible.

No accuracy or rectification route for outputs

People have complained to regulators about false generated statements. Having no process is worse than having an imperfect one.

Undisclosed human review

Users are consistently surprised that humans read prompts. Disclosure costs almost nothing; discovery costs a great deal.

Retention windows set by the model provider, not by you

Provider defaults - often thirty days for abuse monitoring - become your retention period unless you configure otherwise, and your policy should reflect what is actually configured.

Treating the AI Act as a future problem

The transparency obligations arrive on a schedule, and the documentation they require takes longer to assemble than the deadline suggests.

Frequently asked questions

Do I need to disclose that I train on user data?

Yes. Training is a distinct purpose from providing the service, it needs its own lawful basis, and both regulators and enterprise buyers treat silence as an answer. The disclosure should be specific enough to act on, not a general reservation of rights.

Are AI outputs personal data?

Where they relate to an identifiable person, yes - which means accuracy, rectification and erasure obligations apply to generated content, not just to stored content.

What does the EU AI Act require of my privacy documentation?

Transparency where people interact with an AI system, marking of synthetic content, and documentation for general-purpose models. It sits alongside GDPR rather than replacing it, and the obligations phase in on a published timetable.

Is a model provider a sub-processor?

If customer content is sent to it, yes. That brings a contractual chain, a transfer question, and an obligation to tell your customers who is in the chain and on what terms.

Can users ask to be removed from a training set?

They can ask, and you have to answer honestly. Where removal from an already-trained model is not technically feasible, say so and explain what you can do instead - exclusion from future training, output filtering, or deletion of the source record.

Are terms and conditions legally binding?

They are when the user had a genuine opportunity to read them and took a positive step to accept. Clickwrap - a ticked box next to a visible link - holds up far more reliably than a "by using this site you agree" line in the footer.

What is the difference between terms of service and terms and conditions?

Nothing substantive. "Terms and conditions" is the more common phrasing in the UK and Commonwealth markets, "terms of service" in the US and in SaaS. The clauses do the same job.

Can I limit my liability to zero?

No. Most consumer regimes void attempts to exclude liability for death, personal injury or fraud, and unfair-terms rules strike out caps a court considers unreasonable. A cap that is drafted to survive review is worth more than one that is struck out entirely.

Do I need terms if I sell nothing?

If users can register, post, comment or upload, yes - the terms are what let you moderate, suspend and remove content without being in breach of contract yourself.