HubSpot now makes customers answer for what its AI agents do

The change

On September 16, 2026, HubSpot published new versions of its Customer Terms of Service, Product Specific Terms, Acceptable Use Policy, and Privacy Policy. The update adds rules for AI agents, changes how extra credits are billed, and widens the consent duties for recording and notetaking.

Some of these clauses first appeared in a July 1 update that HubSpot rolled back within a week, which we covered in our article on HubSpot's email engagement data. The September version is now the live contract.

What changed

Five changes matter most for a team that runs sales, marketing, or support on HubSpot:

• AI agents. A new clause makes customers responsible for configuring AI agents and their access to data and systems, telling end users when an interaction is automated where the law requires it, supervising the agents, and "all actions AI Agents perform."

• A new AI ban. The Acceptable Use Policy now prohibits using AI agents for automated decision-making, or for any purpose that poses a material risk to health, safety, or fundamental rights, where the law prohibits it.

• Credits. Customers who buy extra HubSpot Credits and go over are now billed per credit for the excess by default, and the account drops back to its previous limit the next month. Automatic upgrades, which raise the credit level for the rest of the term, now have to be switched on.

• Recording and notetaking. The consent and notice duties that used to focus on call recording now cover "phone calls, video conferences, in-person meetings, chatflows, and other electronic communications."

• Privacy Policy. Address lookups can now be sent to Google Maps, the California section names "emails sent through our platform" as a source of activity data, and a new rule says stored public YouTube data is refreshed or deleted within 30 days.

AI agents come with your name on them

HubSpot defines AI agents as systems or workflows that "perform actions or tasks on your behalf in a supervised or autonomous manner." In practice, that covers agents that answer customer questions, research prospects, or update records.

The new clause puts the results on the customer. If an agent emails the wrong person, gives a customer a wrong answer, or changes records it should not touch, the contract treats that as the customer's action. The clause also requires customers to tell people when they are dealing with an automated system where the law requires it. Together with the new ban on automated decision-making where it is prohibited, the terms now expect customers to know which laws apply to their agents before switching them on. AI clauses like this are spreading across vendor contracts, as we saw when Meta rewrote its privacy policy around agentic AI.

A credit default that now works for the customer

Not every change cuts against customers. Under the previous terms, a customer who had bought extra credits and went over was moved to a higher credit level for the rest of the contract term, unless they had switched to pay-as-you-go. That meant one busy month could raise the monthly bill until renewal.

The September terms reverse the default. Going over is now billed only for the extra credits used, "in arrears at our then-current Overages rates," and the account "will return to your previous Limit" the following month. Automatic upgrades still exist, but only if the customer configures them. Customers who have not bought any extra credits are unaffected, since their credit-based features simply pause at the limit. Usage-based billing has been moving in the other direction at other vendors, as we saw when Atlassian added usage-based billing on by default.

Why this matters

For many SaaS companies, HubSpot is where the customer conversation happens: marketing email, sales outreach, support chat, and meeting notes. AI agents now act inside those channels in the company's name, sending messages, answering customers, and changing CRM records without a person approving each step.

The September terms make clear who carries the risk when an agent gets it wrong, and it is the customer, not HubSpot. The same update moves more compliance work to the customer as well: disclosing automation where the law requires it, staying away from prohibited automated decisions, and getting consent before the notetaker joins a video call or an in-person meeting. None of this shows up in the product itself, which is why a change like this is easy to miss without continuous vendor contract monitoring.

Potential impact

For a SaaS company on HubSpot, the update raises four practical questions:

• Which HubSpot AI agents are switched on, who configured them, and who is responsible for checking what they do?

• Where do your chat widgets, support replies, or outreach tell people they are dealing with an automated system, if the law in their location requires it?

• If your team uses the HubSpot notetaker in video calls or in-person meetings, how are participants told and asked for consent?

• If you have bought extra credits, is automatic upgrading on or off, and is that the setting you want?

How Venpo detected it

Venpo monitors HubSpot's legal documents as part of continuous vendor risk monitoring. It flagged all five updated documents on September 17, the day after they were posted, with every inserted and deleted line marked, and each change was checked against the live pages. The redlines are public for the Product Specific Terms and the Privacy Policy, and every monitored document is listed on the HubSpot vendor profile.

Business outcome

Teams that track HubSpot got a plain-English list of the September changes the next day. That leaves time to review AI agent settings, add automation and recording notices where they are needed, and check credit settings before the next busy month. The alternative is learning about the agent clause after an agent does something a customer complains about.

Key takeaway

HubSpot's September terms put AI agents squarely on the customer's side of the contract, from setup to every action they take, while making a busy month of credit usage cheaper to absorb. Both changes live in the contract rather than the product, and the only way to catch edits like these is to track the terms every time they change.