AI Vendor Packet
IndexableAI vendor termsLast reviewed 2026-05-21

What B2B SaaS teams should monitor in AI vendor terms

The parts of AI vendor terms that matter most are the parts customers ask about: whether data is used for training, how long data is retained, who can access it, which subprocessors are involved, and which agreement controls the workflow.

Check AI vendor termsView all guides

Workflow steps

4 practical steps

Records to keep

3 examples

Source links

4 official sources

Step-by-step process

Step 1

Separate product paths

Do not treat API, enterprise workspace, consumer account, cloud-hosted model, and internal employee use as the same path. The source evidence can differ even when the vendor name is the same.

Step 2

Review data-use and model training language

Attach the product-specific source before saying customer data is or is not used for model training. Check feedback, fine-tuning, uploads, and opt-in settings separately.

Step 3

Review retention and your own copies

Vendor retention is only one side of the answer. Prompts, outputs, transcripts, files, logs, and support tickets may also be stored by your own systems.

Step 4

Check contract and subprocessor evidence

Use the DPA, product terms, and subprocessor sources to refresh customer exhibits. Keep contract role questions separate from product behavior questions.

Records to keep

  • A product-path table that separates OpenAI API, ChatGPT workspace, Azure OpenAI, and Microsoft 365 Copilot.
  • A training statement review note with source link, plan scope, setting evidence, and owner.
  • A retention worksheet that lists vendor storage and company-controlled logs separately.

Where mistakes happen

  • Copying a direct API answer into an enterprise workspace answer.
  • Treating zero retention language as a blanket claim for files, logs, or fine-tuning.
  • Ignoring subprocessors because the question started as an AI model training review.

Lightweight version

For a small team, keep one page per AI vendor with the exact product, source links, customer data categories, and last reviewed date.

More mature version

For a larger team, connect AI vendor terms to data inventory, procurement approval, subprocessor updates, and customer-specific contract exceptions.

Source links

These are starting sources for the examples in this guide. Review the vendor page for scope and limitations before changing customer commitments.

Data controls in the OpenAI platformhttps://platform.openai.com/docs/guides/your-dataOfficial sourceIs my data used for model training?https://privacy.anthropic.com/en/articles/7996868-i-want-to-opt-out-of-my-prompts-and-results-being-used-for-training-modelsOfficial sourceGoogle Cloud Vertex AI data governancehttps://cloud.google.com/vertex-ai/generative-ai/docs/data-governanceOfficial sourceData, Privacy, and Security for Microsoft 365 Copilothttps://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacyOfficial source

Related templates

AI vendor risk assessment templateUse this template to document the review questions that matter before customer data is sent to an AI vendor. It focuses on commitments and evidence, not abstract scoring.Customer data not used for training clause checklistUse this checklist before saying customer data is not used for model training. The answer must match the vendor, product, plan, settings, and any feedback or fine-tuning flow.Vendor retention review worksheetUse this worksheet to separate vendor retention from your own retention. Many customer answers fail because prompts, tickets, recordings, or logs are copied outside the vendor path.

Related vendor pages

OpenAIReview OpenAI API, DPA, privacy, subprocessors, retention, and model training sources for SaaS customer commitments.AnthropicReview Anthropic Claude commercial terms, DPA, model training, retention, and privacy sources for SaaS review packet evidence.Google Vertex AI / Gemini for CloudReview Google Cloud Vertex AI data governance, zero data retention, DPA, terms, and subprocessor sources.Microsoft 365 / CopilotReview Microsoft 365 / Copilot privacy, terms, DPA, security, and data-use sources for SaaS customer commitments.

Generate a review packet from this workflow.

Select your vendors, data categories, and customer commitments. AI Vendor Packet turns the workflow into evidence your team can review.

Check AI vendor termsBrowse templates