In AI procurement, risks are shared in the contract.

A classic software contract is not enough

In AI procurement, classic licence templates fall short in three respects: the accuracy of the output cannot be guaranteed (hallucination risk), the provider may want to use your data for training, and regulatory (AI Act) obligations must be shared along the chain. The contract must be restructured around these three realities.

In custom-model and integration work, the acceptance criteria (accuracy metrics, test sets), staged payment and the allocation of intellectual property (model weights, prompt libraries) must be clarified. Without measurement, a dispute over acceptance is inevitable.

The procurement file is built in four steps

First, a use-case and role analysis: in which process will the tool run, on which data — and where do you stand under the AI Act: do you remain a deployer, or does fine-tuning move you towards provider obligations? Second, a document review: the provider's master agreement, data processing addendum, usage policies and SLA are read against a clause matrix, and the negotiable points marked. Third, negotiation — at the same table as your technical team, so that logging, retention and model-version-change clauses are tied to operational reality. Fourth, post-signature: the provider's unilateral change notices are tracked and the set is kept current through annual revision within your contract management routine. What you keep: the clause matrix, a negotiation memo and the final executed set.

Typical client profiles

This service is most often used by finance, healthcare and e-commerce companies wiring generative tools into customer-facing processes, by manufacturers adding AI modules to their ERP, and by Türkiye subsidiaries that must adapt a German parent's central procurement contract to local operations. Even where the central contract is governed by foreign law, the local layer does not disappear: the privacy-notice and data-processor framework of the KVKK (Law No. 6698) and the standard-terms review under the Turkish Code of Obligations (Law No. 6098) are set up separately in the Türkiye file. Where use will spread across the company, we add the internal usage policy and training layer to the same project through our Artificial Intelligence focus.