AI SaaS Terms And Conditions: UK Checklist

Maya runs a small AI customer support platform for ecommerce brands. A week before launch, her first enterprise customer asks a simple question: if the AI gives the wrong answer to one of their shoppers, who is responsible?

That one question opens up a lot. Can customers upload confidential data? Can Maya use prompts to improve the model? Who owns the output? What happens if the API is down for two hours during a sale?

If you're launching an AI tool, your AI SaaS terms can't just say customers get access to software and pay a monthly fee. Your terms need to deal with the specific risks that come with inputs, outputs, data use and reliance on AI-generated content.

Do AI SaaS Terms Need To Be Different From Standard SaaS Terms?

Yes, AI SaaS terms need extra clauses because AI tools create outputs that can be wrong, incomplete, biased or used in ways you didn't intend.

Standard SaaS terms and conditions usually cover access to software, payment, support, intellectual property and liability. That's a good start, but AI software terms in the UK should also explain how your system handles user prompts, uploaded material, generated outputs and model improvement.

The reason is practical. A customer may treat an AI output like a final answer, even if your product is designed to assist rather than decide. If your terms don't draw that line clearly, you may be left arguing about whether you promised accuracy, legal compliance or a particular business result.

Your terms should usually cover:

• Inputs: what customers can upload, whether they need permission to upload it, and whether it can include personal data or confidential information.
• Outputs: who can use them, whether they're guaranteed to be accurate, and what checks customers must carry out.
• Data use: whether inputs or outputs are used to train or improve your model.
• Human review: when customers need to apply their own judgement before relying on output.
• Prohibited uses: what customers must not use the tool for, especially high-risk or unlawful use cases.

The UK doesn't currently have one single AI Act like the EU. Instead, AI businesses need to think about existing UK laws, including UK GDPR, the Data Protection Act 2018, consumer protection laws if you sell to consumers, intellectual property law and sector rules that may apply to your customers.

Who Owns The User Inputs And AI Outputs?

It depends on what your terms say, what rights already exist in the material, and whether the output is capable of being protected by intellectual property rights.

For user inputs, the cleaner position is usually that your customer keeps ownership of the content they upload. Your business then gets a licence to use that content only for the agreed purposes, such as providing the service, maintaining security and improving performance if your terms clearly allow it.

For outputs, the position can be more complicated. UK copyright law, including the Copyright, Designs and Patents Act 1988, protects certain original works, but AI-generated material can raise difficult questions about authorship and originality. So rather than simply saying the customer owns everything, your terms should spell out what commercial rights the customer gets to use the output.

For example, you might say:

• the customer can use outputs for their internal business purposes;
• the customer is responsible for checking outputs before publishing or relying on them;
• your business keeps ownership of the platform, models, algorithms, prompts, templates, workflows and system improvements;
• customer inputs won't transfer any rights in your underlying technology; and
• outputs may not be unique, so another user may receive similar or identical content.

That last point matters. If your AI app generates marketing copy, code snippets or product descriptions, customers may assume exclusivity. If two customers receive similar output, you don't want a dispute about who owns it.

You should also protect your own brand. If you're building goodwill in your product name or logo, trade mark registration through the UK IPO can help you stop copycats and improve your position with investors or acquirers.

Can You Limit Liability For AI Outputs?

Yes, you can limit liability for AI outputs in many B2B contracts, but your liability clause needs to be clear, fair and realistic.

In England and Wales, the Unfair Contract Terms Act 1977 can apply to business contracts, especially where you're using standard terms. Some exclusions and caps need to be reasonable. You also can't exclude liability for death or personal injury caused by negligence, and you can't exclude liability for fraud.

For an AI SaaS product, your terms should avoid overpromising. If the tool assists with drafting, analysis, recommendations or predictions, say that outputs are generated by an automated system and may contain errors. Then explain what the customer must do before relying on them.

A Worked Example

Say Maya charges a customer GBP 600 per month for her AI support tool. Her terms say liability is capped at the fees paid in the 12 months before the claim. If the customer has used the tool for a full year, the cap is GBP 7,200.

One month, the tool suggests the wrong returns policy to a shopper. The customer says they lost GBP 25,000 because of complaints and refunds. Maya's position is much stronger if her terms clearly say:

• the customer is responsible for configuring approved answers and reviewing high-impact outputs;
• the tool doesn't guarantee legal, financial or customer service outcomes;
• the customer must not rely on outputs without appropriate human review; and
• liability is capped, subject to the usual non-excludable liabilities.

An AI output liability clause should be specific. A vague statement that the software is provided as is may not be enough, especially if your sales materials make strong claims about accuracy, automation or cost savings.

Keep your marketing and your contract aligned. If your website says your AI makes compliance decisions with 100% accuracy, but your terms say customers shouldn't rely on outputs, those documents are pulling in different directions.

What Data Protection Terms Do You Need For An AI Tool?

You need data protection terms if your AI tool collects, stores, analyses or generates personal data, which many AI SaaS products do.

UK GDPR and the Data Protection Act 2018 are central here. The first question is whether you're acting as a controller, processor or both. For example, if a customer uploads its customer support tickets and you process them only to provide the service, you're likely acting as a processor for that data. If you use product analytics to decide how to improve your platform, you may be a controller for that analytics data.

Your customer contract should match that reality. If you're a processor, your customer agreement should include a data processing agreement with the Article 28 terms required by UK GDPR.

That usually means covering:

• the subject matter, duration, nature and purpose of processing;
• the types of personal data and categories of data subjects;
• your confidentiality and security obligations;
• approved sub-processors, including hosting and AI infrastructure providers;
• international transfers, using the UK IDTA or UK Addendum where needed;
• assistance with data subject rights, security incidents and audits; and
• deletion or return of personal data when the contract ends.

You should also be very clear about model training. If you want to use customer inputs to train or improve your AI system, don't bury that in vague wording. Say whether training is enabled by default, whether customers can opt out, and whether confidential information or personal data is excluded.

If there's a personal data breach, UK GDPR expects controllers to report certain breaches to the ICO within 72 hours of becoming aware. If you're a processor, you must notify your customer without undue delay. Your terms should set out who does what, and how quickly.

What Should Your Acceptable Use And Suspension Clause Say?

Your acceptable use clause should tell customers what they can't do with the tool, and give you a clear right to suspend access when there's a serious risk.

This is especially important for AI tools because your customer controls the prompts and use cases. You may not see every harmful use until it has already happened.

A good acceptable use clause for app terms and conditions usually bans customers from using the service to:

• break the law or help someone else break the law;
• generate malware, phishing content or instructions for cyber abuse;
• harass, discriminate against or defame people;
• make automated decisions about individuals where human review or extra legal safeguards are needed;
• upload content they don't have rights to use;
• scrape, copy or reverse engineer your platform;
• overload your systems or bypass usage limits;
• submit special category personal data unless your agreement clearly allows it; or
• use outputs in regulated areas, such as medical, legal, financial or employment decisions, unless your product is designed and contracted for that use.

Your suspension wording should be practical, not heavy-handed. You might allow immediate suspension where use creates security risk, legal risk, harm to other users or a breach of third-party platform rules. For less urgent issues, you may give notice and a chance to fix the problem.

Keep records when you suspend access. Save the prompts, outputs, logs, customer messages and the reason for suspension. Without a clear paper trail, you may struggle to justify the decision if the customer refuses to pay or claims losses.

What Should An AI SaaS Terms Template Include?

An AI SaaS terms template should include the usual SaaS clauses, plus AI-specific wording on inputs, outputs, training, data use and reliance.

Templates can be useful for spotting issues, but they often miss the details that matter most to your product. A lawyer should tailor your terms before you use them, especially if your tool handles personal data, produces customer-facing content or supports regulated decisions.

Here is a practical outline you can use to brief your legal team:

1. Parties And Account Setup: say who the customer is, who can create user accounts, and who is responsible for authorised users.
2. Subscription Plans: set out fees, billing cycles, usage limits, overage charges, upgrades, downgrades and renewal rules.
3. Access Licence: grant a limited right to use the platform during the subscription, subject to the terms.
4. Inputs: explain what customers can upload and confirm they need all rights, permissions and notices.
5. Outputs: state what customers can do with generated content, include any AI output disclaimer, and explain whether outputs may be similar for different users, and what review is required.
6. AI Reliance Clause: say the tool assists users, doesn't replace professional judgement, and doesn't guarantee accuracy or business outcomes.
7. Data Processing: add UK GDPR processor terms, controller terms and model training permissions where relevant.
8. Acceptable Use: ban unlawful, harmful, infringing, high-risk or security-threatening uses.
9. Uptime And Support: set service levels, maintenance windows, support hours and any service credits. For example, if you promise 99.5% monthly uptime, say exactly how downtime is measured and what remedy applies.
10. Third-Party Providers: identify dependencies such as cloud hosting, large language model APIs, payment processors and analytics tools.
11. Confidentiality: protect business information, technical information, customer data and pricing.
12. IP Ownership: protect your platform, code, model configuration, prompts, documentation, branding and improvements.
13. Liability Cap: cap recoverable losses where legally allowed, and list the liabilities that aren't capped or excluded.
14. Termination: explain when either side can end the contract, what happens to data, and whether fees are refundable.
15. Governing Law: choose the law of England and Wales if that's the legal framework you want your contract to use.

If you sell to consumers as well as businesses, you'll also need to think about the Consumer Rights Act 2015 and consumer cancellation rules. Many AI SaaS platforms are B2B only, but if individuals can sign up with a personal email and pay by card, your terms and checkout flow may need extra consumer wording.

Key Takeaways

• AI SaaS terms should deal directly with inputs, outputs, training data, human review and acceptable use.
• Your IP clause should protect your platform while giving customers clear commercial rights to use outputs.
• Liability caps can help, but they need to be reasonable and aligned with your pricing, marketing claims and product risk.
• If personal data flows through your tool, you need UK GDPR terms that match whether you're a controller, processor or both.
• Uptime, support, subscriptions, renewals and third-party API dependencies should be written clearly so customers know what they're buying.
• A tailored contract is much safer than a generic SaaS template, especially where AI outputs could affect real business decisions.

If you'd like help with your AI SaaS terms, data processing terms, IP clauses or liability wording, you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.