What should an AI vendor contract say about our data?

By Hugh Donatello, LAN Service Group · Published October 20, 2026 · Updated October 20, 2026

✓ Vendor terms checked on October 20, 2026 against OpenAI's Services Agreement, Data Processing Addendum, enterprise privacy page, plan comparison and sub-processor list, and Anthropic's Commercial Terms of Service, Data Processing Addendum, two Privacy Center articles and Claude plans page. No prices are stated on this page.

Short answer

It should say, in writing, that the vendor will not train on your data, how long it keeps your data and how you delete it, that you get notice before it adds sub-processors, where your data is stored, how fast it reports a breach, that you own the outputs, how much notice you get before terms change, and how you export your data and have it deleted when you leave. This page gives plain-English wording for each.

Why the contract matters more than the product page

When a small business buys an AI tool, the promises that protect its data are not on the product page. They are in three documents: the terms of service or services agreement, the data processing addendum (DPA), and the vendor's privacy or data-use page for business customers. If a promise is only in a blog post, a sales email or a feature list, it can change without your agreement, and it may not cover the plan you bought. Check whether the main terms incorporate the privacy page; if they do not, treat its promises, like a plan table's, as weaker than the signed terms.

This page is about what those documents should say. It is the companion to CIO Support's AI tool vetting checklist, which you use before staff start using a tool to decide whether to approve it, approve it with limits, find out more first, or say no. Here the question is narrower: when you sign up, renew or sign an order form, which clauses should be in the paper, and what does each one protect? The NIST Cybersecurity Framework 2.0 describes the same idea in general terms: 'Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties' (GV.SC-05).

Self-serve AI plans are usually sold on click-through terms that a small business cannot negotiate. That does not make this list less useful. Use it to read the published terms for the exact plan you will buy, write down what is and is not there, and decide whether the gaps are acceptable for the data you plan to put in. If you are buying an enterprise plan with a signed order form, you may be able to ask for the missing clauses; OpenAI's pricing page, for example, lists custom legal terms for eligible ChatGPT Enterprise customers.

The 8 clauses, in plain English

The wording below is CIO Support's plain-English summary of what to ask for. It is not contract drafting, and a lawyer should turn it into language that fits your agreement. Numbers in square brackets are placeholders for you to decide, not industry standards.

AI vendor contract clauses: plain-English wording to ask for and why each matters
Clause	Plain-English wording to ask for	Why it matters	NIST CSF 2.0 outcome it supports	Source
1. No training on customer data	The vendor will not use our inputs, outputs or uploaded files to train or improve its models or services unless we opt in in writing. Any exception, such as feedback a user submits, is named, and our admin can switch it off.	Content used for training leaves your control in a way deletion may not undo. The exceptions matter as much as the rule: a feedback button can send a whole conversation to the vendor.	GV.SC-05 (requirements integrated into contracts with suppliers)	[11]
2. Retention and deletion	The vendor keeps our content only as long as needed to provide the service or as our admin setting specifies. Content we delete is removed from its systems within [number] days, and the contract names any exceptions, such as legal holds.	Without a stated retention period you cannot answer a customer, auditor or regulator who asks where their data is and when it will be gone.	GV.SC-05	[11]
3. Sub-processor notice	The vendor publishes the list of other companies that process our data, gives us at least [number] days' notice by email before adding one, and lets us object. Each sub-processor is bound by terms at least as protective as the vendor's own.	Your data can travel to a cloud host or support contractor you never chose. Notice and a right to object are how you find out before it happens.	GV.SC-07 (supplier risks monitored over the course of the relationship)	[11]
4. Data location	Our content is stored in [country or region]. The vendor tells us where it may be processed and gives notice before that changes.	Some customer contracts, government contracts and privacy laws restrict where data may be stored or processed. Storage and processing locations can differ, so ask about both.	GV.SC-05; GV.OC-03 (legal, regulatory and contractual requirements understood and managed)	[11]
5. Breach notification window	The vendor notifies us in writing within [number] hours of becoming aware of a security breach that affects our data, including business content as well as personal data, and gives us the details we need to respond.	Your own obligations to customers and regulators may start when you learn of a breach. A vague 'without undue delay' gives you no fixed date, and a commitment that covers only personal data may say nothing about your contracts or pricing files.	GV.SC-08 (suppliers included in incident planning, response and recovery)	[11]
6. Output ownership	As between us and the vendor, we keep all rights in what we put in and we own the outputs; the vendor assigns to us any rights it has in the outputs.	You want to use AI-assisted drafts, code and reports in your business without the vendor claiming them. The contract settles the question between you and the vendor only; it does not decide whether an output can be protected by copyright or whether it resembles someone else's work.	GV.SC-05	[11]
7. Terms-change notice	The vendor gives us at least [number] days' written notice, by email, before any change to the terms, the DPA or the data-use policy takes effect. Changes do not apply retroactively, and if a change reduces our data protections we may terminate.	Every other clause on this list is only as good as the vendor's right to change it. If updates take effect on posting, you have to keep checking the website.	GV.SC-07	[11]
8. Exit and export	Before the contract ends we can export our content in a usable format. Within [number] days after it ends, the vendor returns or deletes our data, including sub-processor copies, and confirms deletion on request.	Leaving a vendor should not mean losing your records or leaving copies behind. Plan the exit before you sign, while you still have leverage.	GV.SC-10 (plans cover activities after a partnership or service agreement ends)	[11]

Wording and placeholders are CIO Support's, not a NIST list or a vendor's contract. NIST outcome IDs are from NIST CSWP 29 (CSF 2.0), February 26, 2024.

What two vendors' published terms say

To show what these clauses look like in real terms, the table below compares OpenAI's and Anthropic's published business terms, quoted or closely paraphrased from each vendor's own pages. Checked on October 20, 2026. It is not a rating of either vendor. Which documents apply depends on your plan and how you signed up, terms change, and an order form you sign may override what is published, so re-read the current pages before relying on any row.

OpenAI vs Anthropic: published business terms for each clause (checked on October 20, 2026; no prices shown)
Clause	OpenAI (Services Agreement, DPA, enterprise privacy page, plan table)	Anthropic (Commercial Terms, DPA, Privacy Center, plan table)	Source
1. No training on customer data	Services Agreement 4.2: 'OpenAI will not use Customer Content to develop or improve the Services, unless Customer explicitly agrees to such use.' The enterprise privacy page adds that data a customer explicitly opts in to share, for example through OpenAI's opt-in feedback mechanisms, may be used to train its models; an admin setting to turn feedback off is not listed on the OpenAI pages cited here.	Commercial Terms B: 'Anthropic may not train models on Customer Content from Services.' The Privacy Center adds that feedback or bug reports a user submits may be used for training; a Team or Enterprise Owner can turn off the feedback button with the Rate chats setting.	[1] [3] [6] [8]
2. Retention and deletion	Enterprise privacy page (ChatGPT Business): 'Your workspace admins can control how long your data is retained.' Deleted or unsaved conversations are removed within 30 days, unless longer retention is required by law or reasonably necessary to protect the services or any third party from harm. The same page's commitments list names only Enterprise, Healthcare and Edu for retention control, so confirm for Business.	Plan table: custom data retention controls No on Team, Yes on Enterprise. Commercial Terms E.4: Confidential Information, which includes Customer Content, is destroyed promptly on request, except where kept to comply with law or in automated back-ups.	[3] [10] [6]
3. Sub-processor notice	DPA 2.9: notice of changes 'via blog post, notification within the Services or other reasonable means', or by email if you subscribe; you may object within 30 days of receiving notice. If the objection is not resolved within 30 days, either party may terminate the affected services, and pre-paid fees for the period after termination are refunded.	DPA C.3: 'reasonable notice of the new Subprocessor' before it gets access to Customer Personal Data; you may object, on the basis of reasonable data privacy or data security concerns, within fifteen (15) days, or you are deemed to consent. The parties then work together in good faith; the DPA does not state a termination right for an unresolved objection.	[2] [5] [7]
4. Data location	Plan table: 'Data residency in US, EU, UK, JP, CA, KR, SG, IN, AU, UAE' is No on ChatGPT Business and Yes on ChatGPT Enterprise.	Privacy Center (commercial products): 'Note that data is stored in the US.' By default traffic may be routed to select countries in the US, Europe, Asia and Australia, unless otherwise agreed or at your instructions. Anthropic may also process data for internal processes, such as safety review, product support or incident response, in countries where it or its affiliates operate.	[4] [9]
5. Breach notification window	DPA 2.7: notice 'without undue delay after becoming aware of any Personal Data Breach'. The DPA defines Customer Data as personal data, so this covers personal data; no fixed number of hours is stated.	DPA G.1: notice in writing 'without undue delay, but in any event within 48 hours'. A Security Breach is defined by reference to Customer Personal Data, so this also covers personal data.	[2] [7]
6. Output ownership	Services Agreement 4.1: as between the parties and to the extent permitted by applicable law, Customer 'retains all ownership rights in Input' and 'owns all Output'; OpenAI assigns to Customer its rights, if any, in Output.	Commercial Terms B: as between the parties and to the extent permitted by applicable law, Customer 'retains all rights to its Inputs' and 'owns its Outputs'; subject to Customer's compliance with the Terms, Anthropic assigns to Customer its rights, if any, in Outputs.	[1] [6]
7. Terms-change notice	Services Agreement 16.13: 'at least thirty days' notice' for updates OpenAI determines in its sole judgment materially affect your rights or obligations (less where needed to comply with law); 'Any other updates will be effective on the date OpenAI posts' them. Updates do not apply to an order form signed with OpenAI before OpenAI notified you of the update, with exceptions. If you do not agree with an update, the agreement says you may stop using the services or terminate under its Section 11.	Commercial Terms M.3: updates take effect '30 days after the updates are posted by Anthropic or Customer otherwise receives Notice'; updates made in response to changes to law or regulation take effect immediately. 'Changes will not apply retroactively.'	[1] [6]
8. Exit and export	Enterprise privacy page: ChatGPT Business workspace admins 'can view, access, export, and delete end user conversations'. Services Agreement 11.3: on termination OpenAI 'will delete all Customer Content from its systems within thirty days', unless legally required to retain it or agreed otherwise in writing; it may also keep Abusive Customer Content as required by law or as reasonably necessary to protect the services or any third party from harm. DPA 2.11: after the agreement ends, OpenAI returns or deletes Customer Data, which that DPA defines as personal data, at your instruction, unless law requires it to be kept.	DPA H.1: within 30 days of termination, if you ask within that period, Anthropic returns a copy of all Customer Data or provides self-service to do so, and deletes all copies, including at Subprocessors, with exceptions for legal requirements, disputes and combating harmful use.	[3] [1] [2] [7]

Checked on October 20, 2026 against OpenAI's Services Agreement (PDF, ONLINE v.010126), Data Processing Addendum (effective January 1, 2026), enterprise privacy page (updated January 8, 2026), ChatGPT business plan table and sub-processor list, and Anthropic's Commercial Terms of Service (effective June 17, 2025), Data Processing Addendum (effective February 24, 2025), two Privacy Center articles and the Claude plans page. Section numbers are the vendors' own. 'Customer Data' is a defined term in both DPAs: OpenAI's defines it as personal data processed on the customer's behalf, while Anthropic's defines it as all data submitted through the services and separately defines 'Customer Personal Data'.

Reading the gaps

The comparison shows the pattern to look for with any vendor, not just these two. Both vendors' published terms answer all eight questions in some form, but the details differ in ways that matter: one gives a fixed breach window and the other does not; one gives 15 days to object to a new sub-processor and the other 30; one vendor's Enterprise plan offers eligible customers a choice of data residency region and its Business plan does not. Neither breach commitment, as published, is written for business content that contains no personal data.

Check what each promise covers. A DPA usually governs personal data, while your contracts, pricing and plans may be covered only by the main terms' confidentiality clause. Check whose judgment decides: 'material' changes decided in the vendor's sole judgment give you less certainty than a fixed notice period for every change. Check the plan: retention controls and data residency often sit only on the enterprise tier.

When a clause is missing or weak, you have three choices. Ask for it in the order form if you are on a negotiated plan. Limit what goes in: if there is no fixed breach window or data location commitment, keep confidential and regulated data out of the tool. Or choose a different plan or vendor. Record the decision and the date in your approved-tools register, so the next review can see what you accepted and why.

Where each clause usually lives

Training use and output ownership are usually in the main terms of service or services agreement, often in a section called Customer Content. Sub-processor notice and breach notification are usually in the DPA. Deletion at the end of the contract can sit in either document: check the main terms for all your content and the DPA for personal data, and note how each DPA defines the data it covers. Retention settings, export and data location are often on the vendor's privacy page for business customers or in the plan comparison table. Terms-change notice is near the end of the main terms, in a section called Updates, Amendment or Modification.

Read the effective date on each document and keep a dated copy or PDF of the version you accepted. If the vendor changes its terms later, a dated copy is how you show what you signed up to, and comparing it with the new version shows which of the eight clauses moved. CIO Support's vetting checklist covers the rest of the vendor pages to read before use.

Where this fits in your AI policies

Contract clauses are one part of AI governance. Your AI governance policy should say who reviews AI vendor terms and who approves a tool; the vetting checklist turns that into a repeatable check before use; and these clauses are what you look for, or ask for, in the paper. Re-check the terms of each approved tool at least every quarter, whenever the vendor gives notice of a change, and whenever you move to a different plan.

This page is general guidance, not legal advice. Contract terms interact with your other agreements and with the laws that apply to your business. If a tool will receive protected health information, controlled unclassified information or other regulated data, have counsel review the agreement before any of that data goes in. Neither NIST nor any vendor named here publishes or endorses this list.

Common follow-up questions

What is the most important clause in an AI vendor contract?

In CIO Support's view, for most small businesses the commitment not to train on your data, with any exceptions named, matters most, because content used for training is hard to get back. Deletion at the end of the contract and a fixed breach notification window come next.

Can a small business negotiate AI vendor terms?

Usually not on self-serve or click-through plans; you accept the published terms. On enterprise plans with a signed order form there may be more room. OpenAI's pricing page, for example, lists custom legal terms for eligible ChatGPT Enterprise customers. Either way, read the published terms for your plan and record what they say.

What is a data processing addendum (DPA)?

A DPA is the part of a vendor contract that sets out how the vendor processes personal data on your behalf: sub-processors, security, breach notification, help with data subject requests, and return or deletion when the contract ends. OpenAI and Anthropic both publish one for their business services.

Who owns AI outputs under a vendor contract?

Under both OpenAI's Services Agreement and Anthropic's Commercial Terms, as checked on October 20, 2026, the customer owns the outputs as between the customer and the vendor, to the extent applicable law permits. That settles the question with the vendor only; it does not decide copyright protection or third-party rights.

How fast should an AI vendor tell us about a breach?

Ask for a fixed number of hours in writing, and check that it covers your business content, not only personal data. Anthropic's DPA, for example, says within 48 hours for breaches involving customer personal data; OpenAI's DPA says without undue delay.

Is this page legal advice?

No. It is general guidance from CIO Support for small businesses reading AI vendor terms. Have a lawyer review any contract you will rely on, especially if regulated data is involved.

Need help with this?

LAN Service Group helps small and mid-size businesses read AI vendor terms, set up company accounts and an approved-tools register, and bring the right questions to counsel before they sign, as a fractional CIO or as their managed IT provider, fully outsourced or co-managed alongside in-house IT staff.

Talk to LAN Service Group LAN Service Group AI services → (888) 281-7243