Model Vendor Indemnity Clauses in AI Contracts

A buyer deploys a major vendor's model, an output triggers a third-party IP claim, and the indemnity clause that looked protective turns out not to apply. This is the recurring pattern behind enterprise AI indemnity in 2026, the most fluid contract clause category in a market where training data sourcing, model output IP, and customer liability for AI-generated content all remain legally unsettled. Vendors sell capability and contractually discard accountability, and the indemnity clause is their primary instrument for doing it while preserving the appearance of coverage. The transfer of downstream liability to the buyer happens at signature, well before the buyer has experienced any harm.

The stakes have sharpened because AI now sits inside legal, financial, medical, and operational decisions where a bad output causes real damage, not a theoretical one. The 2025 Bartz v. Anthropic copyright lawsuit settled for $1.5 billion over training data sourced from shadow libraries, and multiple active suits against major vendors continue to test the boundaries. A clause that once read as boilerplate now determines whether a vendor or a buyer funds the defense, the settlement, and the judgment. That allocation deserves scrutiny proportionate to what it now controls.

How the three structural axes of an AI indemnity clause determine what is actually covered

Every AI indemnity clause sits on three axes: IP scope, liability cap, and output accuracy. Weakness on any one of them can make the whole clause worthless in practice, and vendors routinely score well on one axis while being disqualifying on another. The three must be assessed separately because they fail separately.

The first axis is IP scope, and output liability allocation varies sharply across enterprise AI contracts at $1M and up in annual commitment. A significant share is vendor-indemnified, roughly a third is customer-carried, and about a quarter sits in a mixed arrangement. The customer-favorable construction requires coverage of both training data sourcing and output generation, not just one. If a vendor indemnifies output IP but says nothing about how its models were trained, it has left the larger exposure untouched, since training data infringement claims can dwarf any single output dispute.

The second axis is cap structure. A large share of contracts fold AI indemnity inside the general liability cap, typically 12 to 24 months of fees, and only a minority provide a dedicated super-cap or uncapped IP indemnity. Without an explicit carve-out from that general cap, the indemnification covers nothing beyond the small sum typical of these contracts. The carve-out, not the indemnity itself, is the provision that determines whether the clause has any real value for a claim of genuine size.

The third axis is hallucination liability, where the market posture is uniform. No major AI vendor offers contractual indemnification for factual errors in outputs. The customer bears all responsibility for output accuracy. The exposure is not abstract. Hallucinated content used in marketing material can attract FTC Act and state consumer protection liability, and in professional deployments a hallucination that harms a client produces malpractice exposure owed by the professional, not the vendor, even when the model caused it. A buyer scoring a vendor as strong on axes one and two will find axis three offers nothing at all.

What the major vendors actually promise — and the conditions that quietly void those promises

Microsoft's Copilot Copyright Commitment defines the customer-favorable benchmark. It covers copyright and patent claims arising from Copilot output, sets no separate indemnity cap, and obligates the vendor to defend the customer in third-party claims. Anthropic updated its Commercial Terms to include expanded copyright indemnity, committing to defend customers from copyright infringement claims for authorized use of services or outputs. These programs are real, and they are the strongest positions in the market.

The conditions attached to them are where coverage dissolves. The modification-exclusion problem is the most common: most AI vendor MSAs offer indemnification for AI outputs that infringe third-party IP but void that indemnification when output is "modified," and any human edit before publication counts as modification. An enterprise that reviews, rewrites, or fact-checks an output before publishing, which is ordinary editorial practice, has just voided its own coverage. What an enterprise actually publishes is rarely covered. Procurement should redline the exclusion to preserve indemnification for ordinary editorial revisions and distinguish editing from substantive transformation.

The pass-through trap is quieter and equally destructive. These indemnities run from the model provider to the provider's direct customer. Where a buyer's AI vendor holds the model-provider account, which is the common arrangement, the indemnified party is the vendor, not the buyer. The buyer has no privity with the model provider and no claim under its indemnity. The clause to look for is a pass-through in the buyer's own agreement with its vendor, and without one the vendor's celebrated indemnity is protection for someone else.

What spend tier a buyer is at determines which protections are even negotiable

The protections that make an indemnity meaningful are gated by spend tier. A buyer at standard or low-tier contract value is not negotiating from the same menu as one at seven figures, and much of the framework above only applies at contract values that carry leverage. This is a diagnostic fact, not a prescription. It means evaluation must start earlier, before signing anything, because the clause set a buyer can secure depends heavily on the tier at which they are buying.

The practical implication is sharpest at the bottom of the market. A startup using a consumer-tier or free-tier product operates under terms that may differ substantially from enterprise terms, including terms that permit the vendor to use inputs for model training. Major providers' API and enterprise terms state they do not use customer data to train models, but consumer or free-tier products often work differently. A team running proprietary data through a consumer plan may be feeding the vendor's training pipeline without knowing it, because the clause that would stop it sits in an enterprise agreement they never saw. The next section covers what any buyer at any tier should demand in writing, regardless of whether a vendor concedes it.

Eight clauses the 2022 SaaS template does not contain and the 2026 contract should

The 2022 SaaS skeleton is missing a set of clauses that are now achievable in 2026 negotiations and address exposures the older template never contemplated. Each one closes a specific gap. The training-data carve-out prohibits the vendor from using customer data, inputs, outputs, prompts, fine-tuning data, and derived data, to train or modify any model, in perpetuity, surviving termination. Without "in perpetuity," the restriction expires when the contract does. California AB 2013, effective January 1, 2026, requires generative AI developers to publicly disclose training data sources, which is now the regulatory floor, and any warranty a buyer accepts should meet or exceed it. The IP indemnity carve-out from the liability cap keeps the aggregate AI indemnity obligation outside the general cap set elsewhere in the agreement. This is achievable against major vendors in enterprise negotiations, and it is the single clause with the largest dollar impact. Audit rights require the vendor to maintain compliance records and, on reasonable notice, provide a SOC 2 Type II report or equivalent, an executive attestation, and reasonable cooperation with an algorithmic audit. Output ownership and modification rights secure an assignment of all rights the vendor holds in outputs, not just a license, restrict the vendor from reusing outputs except for narrow safety purposes, and clarify whether the vendor retains any license to use outputs for training or quality assurance. A hallucination notification protocol negotiates notification obligations when the vendor becomes aware of systematic hallucination patterns affecting the customer's use case, plus credit or refund obligations when the service degrades materially. Full liability for hallucinations is not currently achievable, but meaningful remedies beyond a bare disclaimer are.

The EU regulatory trigger clause addresses obligations under the EU AI Act. GPAI obligations took effect August 2, 2025, with Commission enforcement beginning August 2, 2026. Any model released on or after August 2, 2025 must comply immediately, while models already on the market before that date have until August 2, 2027. The contract should require vendors to provide the copyright policy and public training-data summary the Act mandates.

The insurance gap that opens when the contractual indemnity fails

Contractual indemnity and insurance coverage address different failure modes, and a gap in one is not patched by strength in the other. The insurance layer is currently narrowing around AI in ways that compound the contractual problem. The Insurance Services Office's new exclusion form removes generative AI-related bodily injury, property damage, and personal and advertising injury claims from general liability policies, and a separate narrowing is underway inside technology errors and omissions forms. Berkley's PC 51380 D&O form excludes any claim "based upon, arising out of, or attributable to" any actual or alleged use, deployment, or development of any AI system, including chatbot communications, failure to detect AI-produced materials, and regulatory actions related to AI oversight. The scope is broad enough to capture most modern software products.

Affirmative coverage is emerging but specific. CFC's June 2026 policy update names model hallucination, AI-generated content, and model drift as novel AI exposures to be addressed across seven product lines including technology E&O. Beazley added its own affirmative AI endorsement inside cyber and technology E&O policies on September 17, 2026. These are targeted responses, not general reinstatements.

The failure modes map to coverage lines in ways that matter for procurement. Security, privacy, and data-theft events fall under cyber. Faulty outputs, hallucinations, and negligent deployment fall under technology E&O. Measured underperformance or model drift falls under performance-warranty or parametric AI coverage. Bodily injury and property damage falls under CGL or product liability. Mixed-cause events may require dedicated allocation provisions. Buyers selling AI-enabled products to enterprises should expect technology E&O and cyber to be the two non-negotiable required policies, with enterprise per-occurrence requirements typically in the low millions and federal government contractors facing higher requirements driven by FedRAMP, NIST, or DFARS. Enterprise customers are beginning to require AI-specific coverage confirmation before signing, and a startup that cannot produce it either walks away from the deal or absorbs the exposure inside its own contract terms. A gap in AI output coverage is not a line item. It is an unfunded liability on the balance sheet from the day a customer's lawyer sends a demand letter.

How to read any AI vendor's indemnity clause before signing

Evaluating an AI vendor's indemnity is not a pass/fail exercise. It is a structured gap assessment against the three axes, the eight missing clauses, and the insurance layer, applied in sequence. Begin by identifying the pass-through gap. If the model provider account is held by the vendor rather than the buyer, the major-vendor indemnity programs do not run to the buyer, and a written pass-through in the buyer's own agreement is the only thing that connects them.

Next, check the modification exclusion. If the indemnity voids on any modification of output, and the team edits AI output before publishing, which it should, the indemnity is effectively decorative. Redline the exclusion to apply only to substantive transformation, not ordinary editorial revision. Then map the eight missing clauses against what the vendor has agreed to: training-data carve-out, model change notification, audit rights, AI BOM, output ownership, hallucination notification, liability cap carve-out, and regulatory compliance obligations. Treat each gap as a residual risk that must be negotiated, accepted consciously, or insured against.

Finally, confirm the insurance layer independently. A gap in AI output coverage is not patched by a well-drafted vendor indemnity. Because of the ISO CG 40 47 01 26 exclusion and the carrier-side AI narrowing, standard policies may not respond to the exact claims the indemnity was meant to address. Confirm with a broker who reads the policy language, not one who issues standard forms, that the coverage actually responds to the failure modes in the deployment. Buyers deploying AI into enterprise or government contracts should confirm they can meet the AI-specific coverage requirements before signing, not after, because a coverage gap discovered post-signature is an unfunded liability, not a negotiating point.

This is not a one-time exercise. Model change notification clauses exist precisely because the model a buyer contracted for may be replaced by a materially different one without notice, shifting training data, capability, and exposure underneath a contract that remains in force. The evaluation process is ongoing, not a pre-signature ritual.