Episode Details

A startup that signs an AI vendor’s standard contract without touching the indemnification and data use sections accepts a coverage gap the vendor already knows exists and rarely volunteers to close. That gap sits between what the vendor’s own foundation model provider promises to cover and what the vendor actually promises the startup, and it is the single most expensive clause most founders never read past the first paragraph.

Here is the mechanic almost every founder misses on the first pass through a vendor’s master service agreement. The vendor’s own upstream contract with its foundation model provider, whether that provider is OpenAI, Anthropic, or a major cloud platform, indemnifies the vendor against a narrow category of claims: third party intellectual property infringement arising from authorized, unmodified use of the model’s output. OpenAI’s chief executive announced that protection, branded Copyright Shield, at the company’s developer conference in October 2023, and Microsoft made a parallel commitment covering paying Copilot customers on September 7, 2023. Both promises are real, and both are also narrow. Neither covers a customer’s claim that the output was inaccurate, that it was defamatory, that it violated the vendor’s acceptable use policy, or that a beta feature malfunctioned. When the vendor then offers its own customer, the startup, a broader sounding indemnity for any claim arising from the AI service, the vendor has created an exposure it cannot actually pass upstream. If a claim falls in that gap and the vendor cannot pay it, because the vendor is thinly capitalized or the claim exceeds the vendor’s own liability cap, the startup’s customer has nowhere to go but the startup itself, even though the startup never trained a model or wrote a line of the underlying code.

This is not a hypothetical drafting error. Market data collected across thousands of software as a service contracts in 2026 shows unlimited liability carve outs, the kind that remove the cap entirely for a defined category of claim, rising from roughly one percent of agreements in 2025 to more than ten percent in 2026. Vendors are willing to grant an increased claim allowance. What they are far less willing to do, unless a founder or general counsel actually asks, is match that allowance to what the vendor’s own upstream provider will actually reimburse.

The second clause that decides more than founders expect is the one governing what the vendor may do with the startup’s own customer data, prompts, and generated outputs. Left silent, most vendor terms of service default to broad rights to use that data to improve the underlying model, which for a startup selling a product built on proprietary process knowledge or customer records is a slow transfer of the company’s own competitive position into somebody else’s training set. The market has moved on this point faster than most founders realize. Contracts containing an express prohibition on the vendor training on customer data rose from under one percent in 2024 to fourteen percent in 2026. Express vendor training rights, by contrast, stayed flat at about three percent across the same period. The provision is negotiable specifically because it costs the vendor nothing today. It only costs the vendor something later, if the vendor decides to build a model business on the data already sitting in its logs.

In redlining these agreements for venture backed clients since generative AI vendors became a standard line item in every technology stack, the training restriction is consistently the fastest concession in the entire markup. Ask for it in the first draft, and most vendors return it within a single exchange, because no salesperson wants a contract to stall over a clause the company’s own product team has not yet decided whether it wants to use. The clause that takes longer, and the one worth spending the extra week on, is the survival provision: confirming that the