AI is expanding at lightning speed. In the startup world, this technology will likely become integrated into multiple avenues of your work. How leadership integrates, utilizes, and creates rules around AI implementation must be consistently reviewed and modified. This is especially true for startups focused on the SaaS sector.
AI risk management is shifting from voluntary to mandatory and enforceable. Until recently, startups and vendor contracts outlined various software services and use cases. Now that most startups and SaaS companies are integrating various AI platforms and workflows into their processes, it’s time to update these contracts. AI Compliance Addenda, also known as AI Riders, Schedules, or Exhibits, are becoming a standard feature. Now’s the time to ensure your startup begins including the appropriate documents.
To maintain compliance and transparency, especially in data-sensitive sectors like healthcare, startup leadership must take measures to track and share when and how AI is used. What data sets are used to train skills, how customer data is protected, how liabilities are handled, and how humans oversee AI outputs are all key outline items for tech-based companies.
If contracts do not outline these and similar AI usage information, it’s time to add an addendum to your contracts. Let’s take a look at why, and what these addenda should include.
When Does the Need for AI Compliance Disclosures Arise?
The short answer is that the need is always there. However, the need for a fresh approach to reporting how a business interacts with and handles AI will be necessary at various times. Any time a new partnership or deal is entered, whether vendor, investor, advisor, or otherwise, may be a good time to update and share AI compliance requirements.
When early-stage businesses begin to use AI technology to automate decision-making processes, consumers as well as all involved parties should be made aware and given the opportunity to agree or decline services.
When it is time to renew contracts, some businesses may want to add AI language retroactively. This may or may not be acceptable depending on the language used. Any time new contract language is added or existing language is shifted is an ideal time to have an attorney review the documents.
AI compliance reviews should be considered an important part of any Due Diligence process. If there’s a chance someone will ask, it’s better to be prepared and have all AI compliance disclosures on hand and updated.
What AI Information Should Founders Disclose?
AI Compliance Addenda should disclose enough information to provide a clear and total picture of how companies interact with AI. Especially in regulated industries where privacy protection is of the utmost importance, any and all AI use must be documented and shared. Changes to AI protocols should be included as well.
Inside AI Compliance Addenda, startups should outline:
- Types of AI use scenarios.
- AI providers and models used.
- Training data sources and company commitments to training protocols.
- When use changes occur.
- Human oversight requirements.
- Accuracy and bias testing.
- Audit and inspection rights of customers.
- Indemnification liability for when AI mistakes occur.
- Customer notification timelines for when AI mistakes occur.
- What happens to customer data when it touches different AI features.
Depending on the nature of the startup and the AI systems leveraged within, there may be other data points founders should be prepared to disclose. Conversely, startups in sensitive industries must be careful of what types of data should remain proprietary. A startup attorney should advise on specific items to include in AI Compliance Addenda on a case-by-case basis.
What AI Use Records Should Founders Maintain?
Outlining all the ways in which a startup interacts with AI inside of an AI Compliance Addendum is one thing. Maintaining records of each of these items — and continually updating these records as use cases shift rapidly — is another.
While keeping records of AI use, regulations, and policies, may feel tedious, it will likely become imperative for startups to do so. In data-sensitive industries, this is already a must. Here’s a list of records that should be maintained:
- AI Inventory, including systems used, input data, and output data.
- Processing maps detailing where information comes from and where it goes.
- Terms and Conditions from model providers (which ideally align with those of the startup).
- Version logs of models and prompts.
- Testing logs for accuracy, safety, and bias.
- Human review logs that outline what, when, and to what extent data was reviewed.
- Incident and near-incident records and reports.
- Employee AI use policies, and any violations of policies if they occur.
Again, this may not be an extensive list, but these items comprise a good place to start. If founders are unsure of what AI information needs to be recorded, it’s best to reach out to a well-informed startup attorney for advice.
Aligning with AI Compliance Regulations
The vast majority of states have introduced many AI-related legislative bills, and the number of introduced bills is growing year over year. Not only does that mean there are a lot of compliance laws startups should be monitoring. Across the U.S. and internationally, there are several credentials that demonstrate trustworthiness of businesses that identify, measure, and manage risks in AI systems.
- The EU AI Act is binding legislation.
- NIST AI RMF comprises voluntary guidelines.
- ISO/IEC 42001 is a certifiable standard.
The vast majority of states have introduced many AI-related legislative bills, and the number of introduced bills is growing year over year. Not only does that mean there are a lot of compliance laws startups should be monitoring. Across the U.S. and internationally, there are several credentials that demonstrate trustworthiness of businesses that identify, measure, and manage risks in AI systems.
- The EU AI Act is binding legislation.
- NIST AI RMF comprises voluntary guidelines.
- ISO/IEC 42001 is a certifiable standard.
Each of the above brings benefits and complexities, and it may not be a startup’s immediate goal to achieve any or all of these credentials. However, working in the direction of one or more of these can demonstrate the serious approach an early-stage business is taking toward maintaining compliance along with consumer safety and protection. For potential investors, partners, auditors, insurers, and consumers alike, aligning with AI compliance regulations before they become law can offer peace of mind.
Turn AI Compliance Into a Competitive Advantage
Maintaining records and integrating the appropriate information into contracts can seem like a huge challenge. Keeping up with thousands of legislative bills in every state and country in which business is conducted can seem even more daunting.
Here, founders have an opportunity to shift the perspective by seeing compliance as a competitive advantage. Doing the work now, maintaining knowledge of the latest updates and developments, and ensuring thorough record-keeping of AI use boosts businesses ahead of competitors who may not be taking AI compliance as seriously. Startups implementing transparency through AI compliance language in their contracts are better positioning themselves in the marketplace.
AI compliance readiness also indicates a startup’s overall readiness for capital infusion. Taking the necessary steps indicates operational maturity and a significant component of risk mitigation to investors and venture capitalists. Taking the steps to maintain clean AI-use protocols reduces liabilities.
As AI compliance records are kept, uses are disclosed, and addenda added to contracts, founders should proactively include this information in data rooms ahead of due diligence periods. Publishing a trust and security page on the company’s website, can further demonstrate compliance to consumers, as well as readiness to investors.
Let HJF Law Review Your AI Compliance Addenda
As fast as AI compliance regulations are shifting, it’s never too early to hire a lawyer!
HJF Law’s team of expert startup attorneys are ready to stand in your corner and help you identify, maintain, and update AI compliance protocols and contract language to keep your startup protected throughout the age of AI.
Reach out to us at (917) 726-8184 or contact us here for a free consultation to see if we are a good fit for your startup.