Overview
A fintech startup deploys a machine learning tool to automate loan approvals. Months later, a customer challenges a rejection, alleging bias. The startup and its vendor argue over who is responsible for the model’s outputs, who controls the training data, and who must answer to regulators. The contract is silent on every question that suddenly matters.
Most organisations treat AI and machine learning contracts like any other software deal. They overlook the unique risks: models that evolve over time, training data that may not be fully owned, and outputs that can cause unexpected harm. The fine print rarely addresses liability for algorithmic errors, the right to audit datasets, or what happens when the law changes.
Applying the TCL Framework exposes the hidden layers of risk. Technical clauses must clarify how data is sourced, what audit rights exist, and how changes to the model are managed. Commercial terms define pricing, milestones, and use rights for derivative models. Legal provisions allocate ownership, limit liability for unpredictable outcomes, and set out remedies for regulatory breaches. Only this three lens approach captures the full spectrum of exposure.
India’s regulatory landscape is evolving rapidly, with the Digital Personal Data Protection Act, 2023 governing the use of personal data in training and deployment. The Copyright Act, 1957 and recent guidance from the MeitY shape rights in algorithms and datasets. With draft AI regulations under discussion, contracts must anticipate shifting requirements and new compliance burdens.
Key Takeaways
- Contracts must specify training data ownership usage rights and restrictions to avoid infringement.
- Liability clauses should address algorithmic errors bias and accountability under Indian legal frameworks.
- Model ownership and intellectual property rights must be clearly defined to prevent disputes.
Key Considerations
Training Data Rights
Provenance verification, license compliance, consent adequacy, and ongoing obligations regarding data used to train the model.
Model Ownership Architecture
Distinguishing between the algorithm, the trained model, fine-tuned versions, and outputs - each may have different ownership implications.
Performance Specifications
Defining accuracy, precision, recall, and other metrics in ways that are measurable, meaningful, and appropriate to the use case.
Algorithmic Accountability
Explainability requirements, bias testing obligations, and audit mechanisms that address emerging regulatory expectations.
Liability Framework
Allocation of responsibility for model outputs, including scenarios where the AI produces incorrect, biased, or harmful results.
Continuous Learning Provisions
Addressing models that continue to learn from production data, including data rights, model drift, and version control.
Applying the TCL Framework
Technical
- Understanding the model architecture and its inherent limitations
- Assessing training data provenance and potential bias sources
- Evaluating model explainability and audit capabilities
- Understanding deployment environment and integration requirements
- Assessing ongoing maintenance and retraining requirements
Commercial
- Aligning development milestones with payment structures
- Negotiating rights allocation that reflects actual value contribution
- Structuring ongoing fees for models that improve over time
- Addressing competitive restrictions appropriate to the technology
- Balancing exclusivity desires against development economics
Legal
- Drafting warranties appropriate to probabilistic systems
- Structuring liability caps and exclusions for AI-specific risks
- Addressing intellectual property in training data, models, and outputs
- Incorporating emerging AI regulatory requirements
- Establishing dispute resolution for technical disagreements
“An AI contract that applies traditional software licensing principles is a contract that will fail when it matters most. The probabilistic nature of AI systems, their dependence on training data, and their capacity for autonomous decision-making require a fundamentally different contractual architecture.”
Common Pitfalls
Traditional IP Frameworks
Applying conventional software IP provisions without addressing the unique characteristics of trained models and their relationship to training data.
Deterministic Warranties
Providing or accepting warranties of accuracy without accounting for the probabilistic nature of AI outputs and the impossibility of guaranteeing specific results.
Training Data Blind Spots
Insufficient attention to training data provenance, creating downstream liability for IP infringement, privacy violations, or bias.
Static Specifications
Defining performance requirements without accounting for model drift, data distribution changes, and the need for ongoing monitoring and retraining.
Regulatory Assumptions
Failing to anticipate evolving AI regulations and build flexibility for compliance with emerging requirements like the EU AI Act.
Every AI/ML negotiation has a turning point.
The difference between a contract that protects and one that exposes often comes down to three or four clauses. Identifying those clauses requires experience across the technical, commercial, and legal dimensions.
Emerging AI Regulation
AI regulation is rapidly evolving globally and in India. The EU AI Act establishes risk-based requirements that will affect Indian companies serving European markets. India's own AI regulatory framework is developing through MeitY initiatives and sector-specific guidance. The DPDPA applies to personal data used in AI training and inference. Sector regulators including RBI, SEBI, and IRDAI have issued or are developing AI-specific guidance for their respective domains. Contracts must be structured to accommodate these evolving requirements and allocate compliance responsibilities clearly.
Practical Guidance
- Conduct thorough due diligence on training data provenance before development begins.
- Define performance metrics collaboratively with technical teams to ensure they are both achievable and meaningful.
- Build in testing and acceptance protocols that address real-world performance, not just benchmark datasets.
- Address model versioning and the rights implications of updates and improvements.
- Include provisions for ongoing monitoring, bias testing, and compliance with emerging regulations.
- Consider escrow arrangements for model weights and training data to protect against vendor failure.
Frequently Asked Questions
Related Practice Areas
Need Assistance with AI/ML?
Our team brings deep expertise in technology & digital matters.