The AI Clauses Missing From Your Vendor and Client Contracts: What a New York Business Law Attorney Adds First

Most commercial agreements signed in the last few years say nothing about artificial intelligence, and the silence is not neutral. It defaults ownership questions to law that may give you nothing and leaves infringement risk wherever old indemnity language happens to land. A New York business law attorney reviewing a stack of vendor and client agreements finds the same gaps, and closing them rarely takes more than a page.

Who owns the work your vendor produced with AI?

Possibly no one, and an assignment clause cannot transfer rights that never existed. Since its March 2023 registration guidance, the U.S. Copyright Office has held that material generated by artificial intelligence without sufficient human authorship cannot be registered, and that applicants must disclose AI-generated content. Its January 2025 report on copyrightability reaffirmed that prompting alone does not make someone the author of an output.

Your agency delivers a logo or a body of website copy, and the contract calls it a work made for hire with all rights assigned to you. If the deliverable was substantially machine generated, you own the file but hold no exclusive right to stop a competitor from using something nearly identical. Ask for a warranty describing how the work was produced, and require disclosure of AI use rather than a prohibition nobody will honor.

Does your NDA stop a vendor from training its model on your data?

Usually not. A standard nondisclosure agreement restricts disclosure to third parties and limits use to the purpose of the engagement, and a vendor can plausibly read model training or product improvement as inside that purpose. Closing the gap takes an express prohibition on using your confidential information or usage data to train, fine tune, or develop any model, plus a commitment not to retain inputs beyond a stated period.

Enterprise tiers of the major platforms generally exclude customer content from training by default while consumer tiers often do not, so which version your vendor uses matters as much as the terms it signed. New York also never adopted the Uniform Trade Secrets Act, so protection rests on common law requiring reasonable measures to maintain secrecy, and information flowing into a system you never asked about is hard to call reasonable after the fact.

Who pays if an AI output infringes someone else’s work?

Whoever your indemnity says, and older indemnities rarely contemplated machine generated output. Several large providers, including Microsoft, Google, OpenAI, and Adobe, have publicly committed to defending enterprise customers against third party intellectual property claims arising from their AI outputs. Those commitments are conditional, generally requiring the customer to keep content filters enabled and not to have knowingly sought infringing material.

None of that protection reaches you through an intermediary. If a design firm uses a covered tool for your campaign, the platform’s commitment runs to the design firm, not to your company. Ask whether your vendor carries an upstream indemnity and whether its indemnity to you covers AI assisted deliverables. Errors and omissions and cyber policies have also begun adding artificial intelligence exclusions at renewal.

What does New York City require if you use AI in hiring?

New York City Local Law 144 requires an employer or employment agency using an automated employment decision tool for a candidate or employee in the city to obtain an annual independent bias audit, publish a summary of the results, and give candidates notice at least ten business days before the tool is used. Such a tool is software that issues a simplified output substantially assisting a hiring or promotion decision. Penalties run to $500 for a first violation and $500 to $1,500 for each subsequent violation, with continuing violations counted daily.

The obligation sits with the employer, not the software company, which is why the vendor contract has to carry its weight. It should require the vendor to supply the data the auditor needs, to notify you before model changes that would trigger a new audit, and to indemnify you if its representations about the tool prove wrong.

What should your client contracts say about your own use of AI?

Say what you do and get permission for it, because the alternative is a client finding out later. Disclose at a level of detail you can live with, commit to human review of anything that goes out the door, and confirm that client confidential information will not be entered into public tools. Regulated clients want more. Financial institutions under 23 NYCRR Part 500 received New York Department of Financial Services guidance in October 2024 on artificial intelligence and cybersecurity risk, and those expectations travel downstream into vendor questionnaires.

The clauses a New York business law attorney adds first

• A no training and no retention restriction covering confidential information, inputs, and outputs
• An AI use disclosure and human review warranty, keyed to defined categories of deliverables
• An intellectual property representation covering third party infringement and the protectability of the deliverable
• An indemnity that survives the general liability cap for third party IP and regulatory claims

Contracts written before generative tools became ordinary equipment allocate risks their drafters never saw, and the fix is usually a page of language rather than a renegotiation. If your business licenses AI software, buys creative work from vendors who use it, or sells services clients assume are made by people, the agreements deserve a read against what the tools now do. A New York business law attorney can review your vendor and client templates, close the gaps that matter in your industry, and settle ownership and indemnity questions before a dispute makes them expensive.