AI Contracts: Defining Training, Anonymization, and Data Use

The training segment discusses the provision restricting AI model training and improvement using customer inputs and outputs. Vendors may seek to use this data to enhance systems but that it can create risks of data resurfacing in third-party outputs. Kate Aishton and Matt Kohel critique typical drafting issues: “training” is undefined and can include retraining and fine-tuning; restrictions should address any AI/ML model including third-party models; and allowing use of “aggregated” or “anonymized” data without clear standards can enable re-identification, profiling, and misuse across jurisdictions (including GDPR). They recommend defining de-identification precisely (e.g., NIST, HIPAA techniques), separating vendor layers from underlying LLMs, aligning “improve” vs. “train,” planning for auditability, involving product/engineering in negotiations, and pushing back on broad “derived from” language that may capture trade secrets and proprietary insights.