"In the end, I think the law is going to look at human systems."
98 percent of the procuretech companies we track mention AI somewhere on their website. Suppliers are adding AI features to software you already buy. Those features often run under contract terms written before anyone worried about model training or software that can place an order by itself.
David Tollen is a technology contracts attorney, expert witness, and founder of Sycamore Legal and Tech Contracts Academy, and he joined our panel at Catalyst San Francisco in May. We picked the conversation back up on the record, with David explaining which parts of SaaS contracting AI changes, which it leaves alone, and where buyers tend to overreach.
Most of What You Know Still Works
"And it's really the same with AI. Maybe I'd bump it down a little bit lower and say 80 to 85."
David tells the people he trains that 85 to 90 percent of on-premise know-how carried over when software moved to the cloud. For AI, he trims that figure slightly. The new work sits in a short list: training rights, outputs that may infringe someone's IP, and agentic systems that take action on their own.
The harder part is noticing the AI in the first place, because suppliers sometimes add it without much fanfare. Ask your suppliers directly whether new features use AI, and read release notes with that question in mind.
You Can't Hand the Blame to the Software
"You may have an indemnity from the supplier of the AI or the forklift, but you're the first line of defense, and you're the first one who's going to get sued by the injured person."
David expects messy three-way disputes. One example is an agent that buys 10 times the supplies it was supposed to, with the customer blaming the AI supplier. For now, supplier contracts start from the position that monitoring is the customer's job.
That matches what I saw in financial services, where we could outsource the work but kept the accountability. Build your AI governance on the same assumption.
Old Clauses Carry New Meaning
"I think both sides need to get clear: 'Access to our data to improve the system,' does it or does it not mean training? Because if it's training, that means the information in your inputs could end up in outputs for other people."
Many SaaS agreements let suppliers access customer data to improve their systems, and most buyers signed that language without much worry. Some suppliers now rely on it to train models, so settle the meaning in writing.
David also points out that better de-anonymization tools have weakened the comfort buyers took from aggregated and anonymized data terms. Privacy law rarely forgives an honest attempt that fails.
Write the AI Addendum Before You Need It
"You want terms that require really good information about what you're getting and what it does. Ideally, its test history, what kinds of issues have come up."
Sophisticated buyers are attaching AI addenda to existing contracts, sometimes before any AI is live. David's version requires notice when AI is added for your team's use, along with testing records, training data details, and alerts when performance declines. A secure in-house AI tool can help you find which contracts need the addendum first.
He also warns against overreach. A clause banning suppliers from using any AI internally is as unworkable as old bans on open source, and your IP warranty already covers infringing deliverables however they were made.
Check AI Drafts the Way You Check Human Ones
"Contracts are less like a bell curve and more like a pyramid with the good stuff at the top, and the base is lower-quality contracts. So the first question on using the AI is, are you overtrusting it?"
Models trained on everything absorb our common mistakes, then present them with full confidence. David finds that legal-specialist tools overcompensate with kitchen-sink clauses that bog down a deal, while raw foundation models leave gaps.
He still uses AI to spot issues across thousands of contracts and to draft clauses faster. That works only when the reviewer knows the subject well enough to recognize a bad clause.
Negotiation Battles Prevent Disputes
"These battles that we sometimes trigger in contract negotiation are very productive because they resolve things in advance. People don't even know about the issues until the other side mentions them."
Business teams often feel their deals get stuck in legal or procurement. David testifies in contract disputes, and he often finds the signed contract answered the question three years earlier, had anyone looked.
When a stakeholder says they're ready and just need a signature, his answer is that they have 20% of the terms. Use that framing when stakeholders treat negotiation as delay.
Links: