AI Clauses in Contracts: What to Add in 2026

Why AI clauses became standard in 2026

Two things changed at once. Regulation arrived, and AI stopped being a novelty in ordinary commercial work.

On the regulatory side, the EU AI Act's transparency obligations under Article 50 became applicable on August 2, 2026. The European Commission's Digital Omnibus package pushed the compliance deadline for most high-risk AI systems out to December 2027, and to August 2028 for high-risk systems embedded in regulated products — but it left the transparency duties on their original date. Those duties are the ones that touch everyday commercial work: telling people when they are interacting with an AI system, marking synthetic content in a machine-readable way, and labeling deepfake-style media depicting real people.

On the practical side, AI is now inside the delivery of almost every professional service — copy, code, design, research, translation. Contracts drafted before 2023 simply have no vocabulary for it. That silence is where disputes start: the client assumed a human wrote it, the contractor assumed nobody cared, and nobody wrote down which assumption governs.

Clause 1: AI use disclosure — who has to say what

An AI use disclosure clause states whether AI tools may be used to perform the work, and what has to be disclosed if they are. There are three common positions, and the right one depends entirely on the client's risk tolerance.

Draft it in the affirmative. A clause that says "Provider may use generative AI tools in performing the Services, provided that Provider discloses on request the tools used and remains solely responsible for all Deliverables" is clearer, and far more enforceable, than a vague ban nobody can police.

Clause 2: Who owns AI-generated work?

This is the clause most contracts get wrong, because it is written as though the answer were obvious.

Under U.S. law, copyright protects human authorship. The U.S. Copyright Office has taken the position that material generated by AI without sufficient human contribution is not copyrightable, while human-authored elements of a work — the selection, arrangement, and creative modification a person actually contributes — can be. The practical consequence is uncomfortable: if a deliverable was largely machine-produced, an assignment clause may be assigning rights that never existed.

A workable AI ownership clause does three things at once. It assigns whatever copyright and other IP rights do subsist in the deliverable. It grants a perpetual, worldwide, royalty-free license to everything else in the deliverable, including material that is not protectable. And it has the provider represent that the deliverable does not knowingly incorporate third-party material that would restrict the client's use. That last piece matters more than the first two — the realistic risk is not "who owns it" but "can someone else stop us from using it."

Clause 3: Can you paste a contract into ChatGPT?

Often, not without permission. A standard NDA permits disclosure to employees, contractors, and advisors who need to know and are bound by equivalent obligations. A consumer AI service is none of those things. If the provider's terms let it retain submissions or use them to improve models, calling it "not a disclosure" is a hard argument to win.

The fix is a carve-out that names what is allowed rather than pretending it does not happen:

• Name the tools, or name a standard ("enterprise-tier AI services configured to disable training on submitted content").
• Require zero-retention or no-training settings where the provider offers them.
• Exclude specific categories outright — personal data, source code, unreleased financials, anything covered by a separate regulatory regime.
• Keep liability with the disclosing party, so the carve-out permits the use without waiving the consequences of misuse.

If you handle personal data of EU or UK residents, this clause interacts with your data processing agreement. Adding an AI subprocessor is a DPA question, not just an NDA question.

Clause 4: Accuracy, review, and who pays for a hallucination

AI systems produce confident, fluent, wrong answers. A fabricated citation in a research memo or an invented API in delivered code is a defect, and the contract should say plainly whose defect it is.

A human-review warranty solves it in one sentence: the provider warrants that a qualified human reviewed each deliverable before delivery and that the deliverable is accurate and fit for the stated purpose, regardless of the tools used to produce it. Note the last clause — it forecloses the "the model did it" argument before anyone makes it. Pair it with a remedy that is proportionate: a cure period and re-performance at the provider's cost is usually the right answer for service work, not uncapped damages.

A minimal AI clause set you can copy

If you only have room for one paragraph, this covers the load-bearing parts. Adapt it to your jurisdiction and have a lawyer review it before you rely on it.

AI Tools. Provider may use generative artificial intelligence tools in performing the Services and shall identify such tools on Client's written request. Provider shall not submit Client Confidential Information to any AI tool other than those listed in Schedule A, each of which must be configured so that submitted content is not retained or used for model training. Provider assigns to Client all intellectual property rights that subsist in the Deliverables and grants Client a perpetual, worldwide, royalty-free, sublicensable license to use all other content contained in the Deliverables. Provider warrants that each Deliverable has been reviewed by a qualified human prior to delivery and is accurate and fit for the purpose stated in the Statement of Work, irrespective of the tools used to produce it.

Does the EU AI Act reach you?

Possibly, even from outside the EU. The Act applies to providers and deployers whose AI system output is used in the Union. For a small business, the realistic exposure is Article 50: if you deploy a chatbot that EU users talk to, generate synthetic audio, image, or video for an EU audience, or publish AI-generated text on matters of public interest without human editorial review, the transparency duties can apply to you. Employment-related AI use — recruitment, evaluation, monitoring, promotion, termination decisions — was specifically kept on the August 2, 2026 timeline rather than deferred.

None of that requires a compliance department. It requires knowing which of your contracts touch EU users, and saying in those contracts who is responsible for the disclosures.

Where to start

Pull your three most-used templates — your service agreement, your NDA, and your freelance contract — and check each for the four clauses above. Most templates written before 2024 have none of them.

This article is general information about how contracts commonly work, not legal advice, and reading it does not create an attorney-client relationship. Laws differ by jurisdiction and change over time. Consult a licensed attorney in your jurisdiction before relying on any agreement.