When it comes to contracting for AI products and AI-enabled solutions, knowing the product and all of its ins and outs is key to protecting your client and your client's data. That was the key theme of the roundtables on AI Contracting that I led during Loeb's AI Summit in New York City on February 11, 2026. Without knowledge of the AI solution and all the pieces—and more importantly, contractual terms—involved, lawyers cannot adequately craft contractual terms protecting client data and ensuring availability and reliability of the AI outputs.

During the two cross-industry roundtables I led, the key takeaways focused around pre-contract diligence to ensure the right terms are in place to protect client data and the negotiation of terms to guard against AI “hallucinations.” The conversations focused around the following:

• No “One Size Fits All” Models. AI contracting can be very simple if a vendor is offering its own in-house stand-alone AI product that it created and controls, but AI contracting can also be very complex. The owner of an AI-enabled solution may be licensing an AI tool or AI model from a third party, and the terms applicable to the AI-enabled solution may incorporate third-party AI licensing and use terms. Additionally, data security terms may be in a DPA and security requirements may be contained in their own schedule, which means the full contract could be three or four interlinked documents. All roundtable participants agreed that understanding the full contractual picture prior to negotiation is key for a lawyer to best protect his or her client.
• Are Data Security Terms Worth the Paper They're Printed On? AI companies want the world when it comes to data usage rights. They want to have unfettered rights to use the data their AI tools collect to develop, improve and train their models. But most corporate entities view data as sacrosanct and do not want to or cannot permit their data to be used this way. The roundtable participants spoke at length about the limits they impose. Many companies simply do not permit data to be used to train LLMs, but some companies are willing to allow their data to be used to improve argentic AI solutions. Again, knowing the complexities of the solution is key to knowing which limitations to impose on data usage rights. Ultimately, though, attorneys at the roundtable spoke about concerns regarding leakage and seepage, as their IT departments are skeptical that AI companies can segregate data or adhere to contractual restrictions on data usage. Until or unless a big AI-related data breach occurs, customers are treating their AI vendors with a degree of skepticism when it comes to data security provisions.
• Accuracy of the AI Output and Avoiding Hallucinations. The roundtable conversations also focused around remedies for poor performance. As AI is still a developing field, pitfalls can arise when the model itself misbehaves. The AI outputs may not be correct, and the AI itself can start hallucinating outputs. The attorneys at my roundtable discussed the importance of negotiating service levels regarding accuracy of outputs, but often, service level credits are not sufficient remedies. Contracts could include requirements that the vendors retrain models and correct output rife with inaccuracies or hallucinations. 

As the AI industry grows and matures at a breathtaking speed, contracting continues to be a chokepoint for some organizations. IT clients want speed, while lawyers need to protect their clients. Facing complex documents and key data security concerns that take some time to negotiate, lawyers are seeking ways to meet their clients' demands while ensuring contracts are up to par. As the roundtables discussed, this tension will continue as AI contracting matures.