AI vendor liability and risk: who is responsible when AI goes wrong?
Every AI feature in your product runs on someone else’s model. The contracts governing those relationships are where your exposure starts. This guide covers AI vendor contracts, UK liability law, product terms, and how to build a practical AI risk framework.
Every AI feature in your product runs on someone else’s model. Every AI tool your business uses was built under someone else’s terms. The contracts governing those relationships are where your exposure starts. Most AI vendor agreements are designed to protect the vendor. The question is whether your contracts protect you.
Where AI liability sits under UK law
Under current UK law, there is no AI-specific liability framework. Existing principles apply: product liability, negligence, contract law, and, where personal data is involved, UK GDPR. The practical result is that the organisation deploying an AI system carries the primary liability for harm it causes.
The CMA has confirmed this position in its guidance on AI agents: where a business deploys an AI system that causes harm, the deploying business is responsible, even if a third party built the underlying model. The AI does not have legal personality. The vendor’s liability is typically limited by contract. The gap between what the vendor accepts and what the deploying business faces is where the exposure lives.
What AI vendor contracts typically say (and what they miss)
AI vendor agreements vary considerably, but common patterns include: liability caps set at one month’s subscription fees or a similarly low ceiling; broad exclusions for consequential loss, loss of data, and loss of revenue; no warranty that outputs will be accurate, fit for purpose, or free from harmful content; and data use provisions allowing the vendor to use customer inputs for model training or product improvement.
What they less commonly include: clear obligations on the vendor when their system produces harmful or discriminatory outputs; meaningful indemnities protecting the customer from third-party claims arising from the AI’s behaviour; and audit rights over the data processing taking place inside the model.
The UAE AI Office has released comprehensive guidelines on managing AI risks, and the UK government’s investment in AI for NHS services is generating new liability frameworks for health tech suppliers. Across both markets the same gap is emerging: AI deployment is outpacing the contracts and governance frameworks built to manage it. Businesses reviewing their AI vendor agreements now are better positioned than those waiting for the regulatory position to settle.
Your product terms and the AI features inside them
If your product includes AI features, your customer-facing terms need to reflect that. A product that was described and contracted without AI features, but now has them, creates a mismatch between the agreement and the actual product. That mismatch can affect your liability position, your compliance status under UK GDPR where AI processes personal data, and your commercial relationship with customers who care about how their data is used.
Product terms for AI features should accurately describe what the AI does and does not do, limit liability for AI outputs proportionately, address how customer data interacts with the AI, and comply with sector-specific requirements where the product operates in regulated areas.
What an AI vendor risk assessment actually covers
A structured AI vendor risk assessment looks at the vendor contract terms, the data processing arrangements, the potential liability exposure from AI outputs, the applicable regulatory requirements, and the governance and monitoring obligations for the deployment. Frameworks such as the NIST AI Risk Management Framework provide useful structure. The practical output is a clear picture of where your exposure sits and what changes to the contractual or operational arrangement would reduce it.
AI and data protection: the compliance overlap most businesses miss
Where an AI system processes personal data, UK GDPR applies in full. The lawful basis for processing needs to be identified and documented. A data processing agreement needs to be in place with the AI vendor if they are processing personal data on your behalf. Where the AI makes automated decisions with legal or similarly significant effects on individuals, Article 22 UK GDPR may require human review provisions.
Many AI vendor DPAs are generic documents that were not written with the specific processing involved in AI model training or inference in mind. The mismatch between the DPA and the actual data flows is a common source of compliance exposure in AI deployments.
Building a practical AI vendor risk framework
A practical approach to AI vendor risk does not require a complex governance infrastructure. It requires three things: a clear picture of which AI systems the business is using and what data they process; a review of the contractual arrangements governing each AI deployment; and an understanding of where the liability exposure sits and what the remedies are if something goes wrong.
- Inventory your AI vendors and their contract terms
- Check the liability caps against your actual exposure under each agreement
- Confirm data processing agreements are in place and accurately describe the processing
- Review product terms to ensure they reflect the AI features you have shipped
- Identify which AI deployments operate in regulated sectors and what additional obligations apply
Frequently asked questions
Who is legally responsible when an AI system makes a mistake?
Under current UK law, the organisation that deploys the AI system carries the primary liability for harm it causes. The CMA has confirmed that where a business deploys an AI agent that causes harm, the deploying business is responsible even if a third party built the underlying model. AI vendor contracts typically limit the vendor’s liability significantly.
What should I look for in an AI vendor agreement?
Check the liability cap and whether it reflects your actual exposure, what the vendor indemnifies you against, how the data use provisions interact with your data protection obligations, what obligations the vendor has when the system produces harmful outputs, what warranties (if any) are made about accuracy or fitness for purpose, and what happens to your data if the relationship ends.
What is an AI vendor risk assessment?
An AI vendor risk assessment is a structured review of the legal, commercial and technical risks associated with using a specific AI vendor or AI system. It typically covers the vendor contract terms, data processing arrangements, potential liability exposure from AI outputs, applicable regulatory requirements, and governance and monitoring obligations.
How does UK GDPR apply to AI systems that process personal data?
Where an AI system processes personal data, UK GDPR applies in full. Key obligations include having a lawful basis for processing, implementing appropriate technical and organisational measures, and maintaining a data processing agreement with any processor involved. Automated decision-making provisions under Article 22 may also apply where the AI makes decisions with legal or significant effects on individuals.
What should a SaaS business’s product terms say about AI features?
Product terms should accurately describe what the AI does and does not do, include appropriate disclaimers about the accuracy of AI outputs, limit liability for harm from AI outputs proportionate to the product’s risk profile, address how customer data is used in connection with the AI, and comply with sector-specific requirements where applicable.
Concerned about your AI vendor exposure?
We advise scaling SaaS and tech businesses on AI vendor contracts, product terms and data protection obligations. If you have shipped AI features and have not reviewed the contractual stack around them, that is the conversation to have now, before something goes wrong.
Book a call: calendly.com/dhruve-eligaconsultancy
Want updates like this first? Subscribe to Tech Counsel Insight, our newsletter for scaling SaaS and tech businesses.