The company has decided. Now somebody has to sign something, and what arrives is a vendor’s standard terms: a subscription order form, an acceptable use policy by reference, a data processing addendum, and a link to documentation that the vendor can change. Most of the commercial negotiation goes into the price and the term. Almost none of it goes into the four clauses that decide what happens when the relationship matters.
This is the second part of a series on what the move to artificial intelligence actually does to a company’s legal position. The first part put the decision where the Commercial Code puts it, on the board. This part is about the paper that carries it.
Does your data train the model
The first question is the one vendors answer most evasively, because the honest answer usually has three layers: what the vendor does, what the underlying model provider does, and what happens in the free or trial tier that somebody in the company is already using.
What you want in writing is narrow and testable. Customer content is not used to train or fine-tune any model made available to other customers. If the vendor retains inputs for abuse monitoring, the retention period is stated and bounded. If a zero-retention mode exists, the contract says your tenant is on it, not that it is available. And the commitment binds the sub-processor chain, because a promise from the vendor that its own upstream provider does not make is a promise about something the vendor does not control.
Who owns the output
Vendor terms typically assign to the customer whatever rights the vendor has in the output. That sentence does less than it looks like it does. It transfers the vendor’s position, which may be thin, and it says nothing about whether the output attracts protection at all.
Under Law No. 5846 a work requires the personal characteristics of its author. Material generated with heavy machine involvement and light human authorship sits awkwardly against that requirement, and the company’s real protection for such material is often not copyright but confidentiality and contract. That is a design constraint, not a drafting problem: if a workflow produces assets the company intends to own and license onward, the human contribution has to be real and it has to be recorded. The clause to insist on is different — a warranty and indemnity covering third-party intellectual property claims arising from the output, which is the risk that actually lands on the customer.
The model can change underneath you
This clause is missing from almost every deployment we see and it is the one that produces the unpleasant surprise. The vendor updates a model version, deprecates the one you validated, or changes a default, and a process that was tested against one behaviour now runs against another.
What a serious contract carries: notice before a material model or version change, a defined period during which the prior version remains available, and a right to terminate without penalty if the change materially degrades the agreed use. Where the deployment touches a regulated process, add a commitment that the vendor will support the customer’s re-validation rather than treating it as the customer’s problem alone.
Getting out
Exit provisions in these agreements are usually written for a document storage product and not for a system that has accumulated configuration, prompt libraries, evaluation sets and fine-tuning artefacts. Decide before signing what is returnable and in what format, what is deleted and on what timetable, and what survives in backups and for how long. The deletion commitment should extend down the sub-processor chain in the same terms as the training commitment, for the same reason.
Why the selection file matters more than the clause
The negotiation will not go your way on every point; on a widely used platform it may not go your way on any of them. That is a commercial reality and it is survivable. What is not survivable is having no record of the trade.
Article 553 of the Turkish Commercial Code protects delegating organs from liability for the acts of those who take over a delegated function, unless it is proven that they failed to show reasonable care in selecting them. A file showing which suppliers were compared, what was asked about training, output rights, version change and exit, what the answers were, and why this supplier was chosen anyway is the evidence that the selection standard was met. It is worth more than a clause you could not obtain, and it is created at the moment of choosing or not at all.
The next part follows the data itself: what happens under the data protection law, and to the trade secret, when company material goes into a model.
This entry is for general information only and is not legal advice. How any of it applies depends on the company, the deployment and the agreements actually in place.
