Join our subscribers
No silver bullet for AI contracts - what buyers need to do instead
Monday, October 12, 2026
The contractual question a lot of buyers will want to know is what uses of your data you are authorizing. Does the provider only process your data to deliver the specific service? Or can it also reuse your data to develop and improve its products? And do those restrictions apply consistently across all features? That last question is worth really exploring.
My interviews ranged from extreme worry about this topic, to more pragmatic shoulder shrugging. For instance, Dr Ilia Kolochenko, CEO of application security company ImmuniWeb and a practising lawyer in Washington DC, said:
The vast majority of software and technology vendors are either wilfully, negligently or otherwise acting as Trojan horses for your data. Because every single AI vendor I've been dealing with - or almost every one - has clauses in their contract saying that we may, we might, or we will use your data, part of your data, excerpts of your data, derivatives of your data. So we have a broad spectrum on the scale.
Some openly say, 'we take everything and we use it for training, and we pay you zero, you waive any and all claims and rights whatsoever.' Some are more delicate. They say, 'well, we might be using certain data that you lawfully provide to us, and with certain notice we might be using your data to improve our customer support and some other relevant and legitimate purposes.'
It isn’t just an IT job, either. Kolochenko said that the CIO, the general counsel and the CISO all need to be at the table when negotiating AI deals:
When you ask your lawyers to do legal stuff, they will do legal stuff, but they’ll certainly miss a lot of analytics, a lot of data ownership. So make sure that your CIO, or whoever is in charge, will be sitting at the table. Make sure that your cybersecurity folks will be sitting at the table. The more diverse, the more inclusive the team you have, the better it is.
Share less - Kolochenko's simplest advice: only share what the vendor actually needs. Read Full Article
CSO: Ransomware consultant said he would decrypt data, is accused of paying ransoms instead
Computerworld: Ransomware consultant said he would decrypt data, is accused of paying ransoms instead