Most AI procurement still runs on SaaS templates written before anyone asked who the provider is when a customer fine-tunes the vendor’s model. When something fails; a discriminatory score, a leaked training record, a hallucinated contract term; the contract decides who pays. These are the twelve clauses we negotiate hardest.
Role and compliance allocation
1. AI Act role clause. Say explicitly who is provider and who is deployer for each component, including what happens if the customer’s configuration or fine-tuning would flip the roles (substantial modification). Silence here is how a buyer becomes a provider by accident.
2. Regulatory cooperation. The party facing the authority needs the other’s file: technical documentation, conformity evidence, logs; delivered within fixed deadlines, matching the 15-day serious-incident clock.
3. Transparency artifacts. For generative features: who implements Article 50 marking and disclosure; with acceptance criteria, not intentions.
Data and IP
4. Training rights on customer data. The single most negotiated clause of 2026: may the vendor train on your prompts, outputs, documents? Default should be no; any yes should be scoped, aggregated/de-identified, and priced.
5. Data protection annex. KVKK/GDPR processor terms tuned for AI: sub-processor lists including model hosts, transfer mechanics (2024 KVKK standard contracts for Türkiye), deletion covering derived artifacts and fine-tunes.
6. Output ownership and freedom to use. Assignment or broad licence of outputs, plus a warranty that outputs do not incorporate third-party trained content in a way that restricts use.
7. IP indemnity for training-data claims. Copyright suits over training data are live worldwide; the vendor (who chose the corpus) should indemnify, without the “you prompted it” carve-out swallowing the promise. Check alignment with the vendor’s TDM opt-out and copyright policy.
Performance and change
8. Model identification and change control. Pin model/version; require notice (and for regulated uses, consent) before swaps, deprecations or “silent upgrades” that change behaviour; with rollback and parallel-run windows.
9. Accuracy SLAs and evaluation. Replace “commercially reasonable efforts” with measurable evals on agreed test sets, drift thresholds tied to remedies, and (for high-risk uses) the vendor’s post-market monitoring outputs shared with you.
10. Human-oversight enablement. The product must expose what Article 14 requires you to have: confidence signals, logs, override and stop controls.
When it goes wrong
11. Liability architecture. Carve-outs from the cap for data breaches, IP indemnity, regulatory fines caused by the vendor’s non-compliance, and prohibited-practice violations; think in multiples of fees, not fee refunds.
12. Incident and exit. Joint incident playbook (who notifies whom, KVKK 72-hour and AI Act 15-day clocks), plus exit: model weights or equivalent continuity for fine-tunes, data export in usable form, and post-termination inference for a wind-down period.
Use this with our AI due-diligence questions and the AI Act Readiness Checklist; the same twelve headings work as a review grid for contracts you receive.
Sources. Regulation (EU) 2024/1689 (AI Act) and Law No. 6698 on the Protection of Personal Data (KVKK). Statute links open the official consolidated Turkish texts on mevzuat.gov.tr.
This article is for general information only and does not constitute legal advice. For advice on your specific situation, contact us.
Author
More from Vircon Insights
Who Pays When the Output Is Wrong: Allocating Liability Between the Company, the Vendor and the Model Provider
October 8, 2026When the Model Decides About a Person: Hiring, Performance and KVKK Article 11
October 7, 2026Buying an AI Tool, Not Building One: What the Vendor Contract Has to Say
October 4, 2026Feeding Company Data to a Model: KVKK Basis, Transfer Abroad and the Trade Secret You Just Uploaded
October 5, 2026When Does a Turkish Game Studio Need a UK or US Holding?
October 2, 2026Raising Your First Round as a New Game Studio: The Chain of Title Problem When the Founders Still Work Elsewhere
September 30, 2026Related Practice Areas
Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →Mergers & Acquisitions
End-to-end M&A: due diligence, structuring, documentation, negotiation.
View service →Intellectual Property
Trademark, patent, copyright and trade secret advisory.
View service →