AI Terms (AI Addendum)

What are AI terms?

AI terms (often called an AI addendum) are the part of a vendor's contract that covers its AI features. They say what happens to the text you type in, who owns what the AI produces, which outside model providers are involved, and whether your data can train AI models.

Two words come up again and again. "Input" is what you or your users send to the AI, such as a prompt or a file. "Output" is what the AI sends back. Some AI terms, such as Atlassian's, treat both as your customer data.

AI terms often sit outside the main terms of service, on a separate page or in a product-terms section. Atlassian keeps a separate AI Terms page that says it controls over its customer agreement. HubSpot puts its AI rules in a "HubSpot AI" section of its Product Specific Terms. This is why AI terms are easy to miss: they are a form of service-specific terms.

What it looks like in a vendor's terms

A typical clause reads like this:

Input and Output are Customer Data. We may use third-party model providers to generate Output, and we will not allow them to use Input or Output to train their models. Output may be inaccurate, and Customer is responsible for reviewing Output before use. These AI Terms control over the Agreement for AI features.

• "Input and Output are Customer Data": the same protections as the rest of your data apply, as defined in the main agreement and DPA.
• "Third-party model providers": another company's model may process your data. That company is an AI subprocessor.
• "Will not allow them to train": a promise about the model provider. Read closely whether the vendor makes the same promise about itself.
• "Customer is responsible": if the AI gets something wrong and you use it, the risk is yours.
• "Control over the Agreement": when the AI terms and the main contract disagree, the AI terms win for AI features.

Atlassian's AI Terms say Atlassian "must not permit its subcontractors to use Input or Output" to train or improve their models, and state that they control over the main agreement if the two conflict (Atlassian AI Terms).

A real change we caught

Venpo flagged a change in which Replit dropped its no-training promise for Pro customers. Under its new Pro Agreement, Replit may train its models on your code and prompts unless you opt out in settings, while Enterprise customers keep the old promise. A single sentence in AI terms can decide whether your code and prompts end up in a training set.

Why it matters to you

• Training on your data. AI terms are where a vendor says whether it, or its model provider, can use your data for AI training. A promise about one may not cover the other. HubSpot's help article on AI model training says its third-party providers will not train on customer data, while HubSpot itself uses customer data to build AI models unless a super admin opts out (HubSpot Knowledge Base).
• Your customers' data. If your own customers' data passes through a vendor's AI feature, your promises to them depend on these terms.
• Who carries the risk. HubSpot warns that "AI Output may not be accurate or reliable" and makes customers responsible for reviewing it (HubSpot Product Specific Terms). Atlassian makes customers responsible for supervising its AI agents (Atlassian AI Terms).
• Terms that move. AI terms are new, and vendors revise them as features change. Atlassian's agreement lets it modify its terms and policies, with commercially reasonable efforts to post changes 30 days ahead (Atlassian Customer Agreement, section 20.9).

What to check

• Find where the AI terms live: a separate AI page, a section of product terms, or the DPA. Save a copy.
• Check whether the no-training promise covers the vendor itself, its model providers, or both. Look for an opt-out and who has to request it.
• List the model providers named in the terms and on the subprocessor list.
• Read who owns the output and who carries the risk if it is wrong or infringes someone's rights.
• Check whether AI features are on by default for your account, and whether an admin can turn them off.

Responsible AI Policy

A responsible AI policy is a public statement about how a vendor intends to build and use AI. It often lists values such as fairness, transparency and human oversight.

It is not the same as a contract promise. Atlassian's Responsible Technology Principles are framed as a pledge to "guide our work, decision-making, and communications." The page does not present them as terms you can enforce. A promise that binds the vendor belongs in the AI terms, the DPA or the main agreement.

Some vendors also publish an AI code of conduct that sets rules for you, the customer. Microsoft's Enterprise AI Services Code of Conduct says it applies in addition to the Microsoft Product Terms and that customers must follow the most current version (Microsoft Learn). So check which way a document points: a statement of the vendor's values, or a rulebook for your own use.

When a vendor tells you "we never train on your data," look for the same words in a binding document. If they are only in a blog post or principles page, the vendor can change them more easily. For one example, read about the sentence GitBook deleted from its AI policy.

How Venpo helps

Venpo watches vendors' AI terms, product terms, privacy policies and subprocessor lists, and emails you a plain-English alert when a training promise, model provider or opt-out changes. The Fine Print Scan answers one direct question for each vendor: does it train AI on your data?