What to Consider in Contracts with AI Providers?

The Four Points

1. Data Processing Agreement

As soon as personal data is transmitted – and this is almost always the case when real business data is involved.

2. No Training with Your Data

Usually guaranteed for business customer tariffs, often not for free and private use tariffs. This is the most important difference between a private account and a business tariff.

Check this commitment in writing – not in an advertising statement.

3. Processing Location

Where are the servers located? If processing occurs outside the EU, a suitable basis for the third-country transfer is required. Several providers now offer processing within the EU.

4. Subcontractors

Does the provider use third-party services? This chain must be disclosed.

Additional Regulations

• Retention Period of the transmitted content with the provider
• Deletion after contract termination
• Logging: Who in the company transmitted what

The Practical Mistake

Employees use private accounts for business content. This allows customer data to reach a provider uncontrollably, without a contract and often with training. A mere prohibition does not help; instead, a provided, verified access is necessary – otherwise, people will find a way around it.

This text does not replace legal advice.