AI Product Terms + Training-Data License & Acceptable-Use / Disclosure
Combined terms for an AI product covering the training-data license you take from customers, output ownership, an AI acceptable-use policy, and required AI disclosures.
What is an AI Product Terms + Training-Data License & Acceptable-Use / Disclosure?
An AI Product Terms + Training-Data License & Acceptable-Use / Disclosure combines the terms an AI product needs in one document, covering the training-data license you take from customers, output ownership, an AI acceptable-use policy, and required AI disclosures.
Any company shipping an AI model, API, chatbot, or AI-powered feature that ingests user data or content and produces outputs.
AI Product Terms + Training-Data License & Acceptable-Use / Disclosure template, current for 2026
The default posture is that you do not train on customer data unless the customer explicitly opts in. The terms also allocate output ownership and IP indemnity, carry hallucination/accuracy disclaimers and high-risk-use restrictions, track the AI-transparency and disclosure obligations of the 2026 state AI laws and the EU AI Act's transparency rules, set deepfake/biometric limits, and align with privacy law across the ~20-state patchwork. A generic SaaS ToS stops well short of this.
How HDAi does this differently
Unlike a static form, HDAi runs a guided interview and assembles your AI Product Terms + Training-Data License & Acceptable-Use / Disclosure as you answer. When you want it finished, a licensed Hart David Carson attorney reviews it and tailors it to your facts before you sign. The interview and the first draft are automated. The judgment belongs to an attorney.
What you’ll be asked
- Who is the AI product provider (the company offering the AI product)? We need the exact legal name and entity details of the company whose AI product these terms govern. This is the party granting access and taking the training-data license.
- What is the name of the AI product or service? The commercial name of the AI product these terms cover, used throughout the document.
- Briefly describe what the AI product does. A short functional description anchors the scope of the license, outputs, and acceptable-use rules to what the product actually does.
- What is the effective date of these terms? The date the terms take effect governs the contract timeline and any version/notice references.
- Which U.S. state's law governs these terms? Governing law and the venue for disputes are set by the state you choose; it should match where the provider is organized or does business.
- What city and state will be the exclusive venue for disputes? Fixing an exclusive forum avoids fights over where a dispute must be litigated or arbitrated.
- How should the customer be referred to throughout? Pick the label your product uses for the paying/using party so the terms read consistently with your product UI and marketing.
- Is the product offered to businesses, consumers, or both? The audience drives which consumer-protection, arbitration, confidentiality, and disclosure provisions apply and how the acceptance mechanics read.
- Will you use customer inputs/data to train or improve your AI models? The training-data license turns on this answer. How you train on customer data, and if you do at all, sets the scope of the license grant and the opt-out mechanics.
- Should the terms preserve your ability to use data for safety and abuse detection even when a customer opts out of product-improvement training? A customer's opt-out of product-improvement training should not silently disable safety, security, and abuse-detection uses. This carve-out keeps those protective uses available while still honoring the opt-out for model improvement.
- Can customers opt out of having their data used for product-improvement training? Several jurisdictions require you to disclose any opt-out and how it works, and your choice shapes customer trust. It also governs the license carve-out language.
- How does a customer exercise the training opt-out? The template must tell customers the concrete mechanism to opt out so the clause is operative and enforceable.
- Which categories of customer data may be used for training/improvement? Listing exactly which data categories feed training keeps the license grant precise and avoids overreach that regulators or customers may challenge.
- May your personnel or contractors review customer inputs/outputs (e.g., for quality or abuse detection)? Human review is a sensitive disclosure item; customers and regulators expect to be told if staff or vendors may read their content.
- How long do you retain customer inputs and outputs? A stated retention period is expected under privacy law and lets customers understand how long their content persists.
- Do you offer an enterprise zero-retention tier (inputs and outputs not stored once the request is served)? Enterprise buyers increasingly require a zero-retention or ephemeral-processing option in which content is not persisted after the request is served. This adds the tier and its terms.
- Do you offer a data-residency commitment (processing/storage confined to a stated region)? If you can confine processing or storage to a region (for example, the United States or the EU), state it; leave blank if you do not offer a residency commitment.
- Should the terms include a data-protection-addendum hook with controller/processor roles and cross-border transfer mechanisms (e.g., SCCs)? For B2B products that process personal data, a DPA hook allocates controller/processor roles and incorporates standard contractual clauses or an equivalent transfer mechanism for cross-border data flows.
- List any third-party AI model providers or subprocessors you rely on (optional). Disclosing downstream model providers/subprocessors is increasingly required and lets customers assess where their data flows. If you populate this, we will add an upstream acceptable-use flow-down option.
- Should customers be bound to the acceptable-use policies of your upstream model providers? Where you rely on third-party foundation models, those providers impose their own usage policies. Flowing those obligations down protects you from breaching upstream terms because of a customer's use.
- Will you commit to notice before a material model version change or deprecation? Enterprise buyers depend on model stability. A version-change and deprecation notice commitment tells customers how much lead time they will get before behavior changes or a model is retired.
- Who owns the outputs the product generates for a customer? Output ownership is the single most negotiated AI term. Your choice sets whether you assign rights to the customer or license them, which drives the IP section.
- Include a disclaimer that outputs may not be unique and similar outputs may be generated for others? Because generative models can produce similar results for different users, a non-uniqueness disclaimer prevents customers from assuming exclusivity in their outputs.
- Will you offer an IP indemnity for outputs (defend the customer if an output is claimed to infringe)? An output indemnity is a major commercial reassurance for enterprise buyers but carries real risk; whether you offer it changes the indemnification section and its interplay with the liability cap.
- What license does the customer grant you over their inputs to operate the product? Even if you don't train on data, you need a license to process inputs to deliver the service. The breadth of this grant is a core customer concern.
- Should the customer represent that they have the rights/consents to submit their inputs? This representation shifts the risk of unlicensed or non-consented input data to the party who controls it, and is standard in AI terms.
- Include a mutual confidentiality section? For B2B and negotiated deals, a standalone confidentiality section protects each party's non-public information with standard exclusions, a care standard, and a compelled-disclosure carve-out.
- Which uses does your Acceptable-Use Policy prohibit? Your AUP defines the guardrails you can enforce against. Selecting the specific prohibited categories lets us write an enforceable, product-appropriate policy.
- What enforcement actions may you take for AUP violations? Spelling out your enforcement ladder makes actions defensible and gives customers notice of consequences.
- Will you offer an appeal/reinstatement process for enforcement actions? An appeal path improves fairness and is expected under emerging platform-accountability rules for consumer-facing products.
- Which AI disclosures will the terms require or make? AI disclosure obligations now come from multiple US and EU laws (e.g., California bot and generative-AI transparency rules, state deepfake statutes, the EU AI Act Article 50). Selecting these builds the required disclosure section.
- Which AI-specific legal regimes should the AI-Laws compliance and role-allocation clause track? This wires Section 9 to the concrete 2026 regimes that apply to your product. Selecting them defines 'AI Laws' and allocates provider/deployer duties so each party carries the obligations it actually controls.
- Which professional-advice domains should the 'not professional advice' disclaimer cover? Naming the specific domains customers might misuse the product for strengthens the disclaimer and reduces reliance risk.
- Will you require human oversight for high-risk or consequential uses of outputs? A human-in-the-loop requirement both reduces your liability and aligns with emerging AI governance expectations for automated decisions.
- What is the minimum age to use the product? AI products raise heightened minor-safety concerns; a clear age gate supports COPPA/state compliance and your AUP.
- May you name or logo the customer as a reference customer (with revocable consent)? A reference-customer clause lets you identify the customer in marketing materials, typically subject to the customer's brand guidelines and a right to revoke.
- How should liability be capped? The liability cap is a core risk-allocation term; the structure you pick determines your maximum exposure.
- What is the fixed liability cap amount (USD)? We insert this dollar figure as your capped exposure.
- Should disputes go to binding arbitration with a class-action waiver? Arbitration with a class waiver limits class exposure (important for consumer products) but must be drafted carefully; your choice sets the dispute-resolution section.
- What email or address should receive legal notices to the provider? A working notice address makes the notices clause operative, so claims and requests reach you.