Procurement Is Not a Defense: Treating AI Vendors as the Legal Events They Are

Somewhere in your organization, an employee has already pasted confidential information into a chatbot. Another has generated marketing copy with a tool whose terms of service none of your lawyers have read. A third has connected an AI assistant to your customer database because it made a Tuesday afternoon easier.

This is not a hypothetical. It is the current state of American business, and it means that AI adoption — whether or not leadership approved it — has already occurred. The only open question is whether it happened with governance or without it.

Our position is blunt: an AI vendor is a compliance event, and treating one like ordinary software procurement is the fastest way to get burned.

Why AI Breaks the Usual Software Playbook

Traditional software is a tool; it does what a user directs. Generative AI systems ingest your data, retain it under terms you may not have noticed, produce outputs of uncertain legal status, and in some cases learn from your information in ways that are difficult to reverse. The risk profile is not incremental. It is categorical.

Yet most procurement processes still evaluate AI tools on the same checklist used for a project management app: price, security certification, and a SOC 2 report. That checklist was never designed for a technology that can regurgitate a competitor's trade secrets into your marketing materials.

A Four-Part Audit Framework

1. Data ownership and retention. What happens to the data your team submits? Read the terms for retention, model-training rights, and deletion mechanics. Many consumer-grade AI licenses grant the vendor broad rights to use submitted inputs. Enterprise agreements often differ materially — but only if you negotiate. If your vendor claims a perpetual license to your prompts, you have just licensed your trade secrets.

2. Training data provenance. Ask where the model's training data came from. Vendors facing litigation over scraped copyrighted material are not merely their problem; they are your problem the moment their output enters your product or your advertising. A vendor that cannot answer provenance questions credibly is telling you something.

3. Indemnification language. The default position in most AI terms of service is that the vendor disclaims everything and you indemnify them. That allocation must be inverted for enterprise use: the vendor should stand behind its output, particularly for IP infringement claims arising from generated content. This is negotiable, but only if it is raised before signature — not after a demand letter arrives.

4. Regulatory exposure. The regulatory map is fragmenting. Colorado has enacted comprehensive AI legislation; Illinois, New York, and California have imposed their own requirements in specific domains; and the Federal Trade Commission has made clear through enforcement actions that existing prohibitions on unfair and deceptive practices apply fully to AI claims and deployments. Companies in regulated industries — finance, healthcare, employment screening — face a second layer entirely. Your compliance posture attaches to your vendor's conduct.

Governance That Actually Works

A workable framework does not require a new bureaucracy. It requires three things: an approved-vendor list with negotiated terms, a written acceptable-use policy that names what data may never enter an AI tool, and a designated owner — legal, not IT — accountable for the portfolio of AI relationships.

Boards should expect management to report on this the way they report on cybersecurity. The question is no longer whether the company uses AI. The question is whether it uses AI on terms the company chose.

The Cost of Treating This Lightly

The scenarios that end badly are predictable: a data incident traced to a tool nobody vetted, an IP claim over generated content the vendor refuses to defend, an FTC inquiry into claims your marketing team made about an AI feature. Each was preventable with a contract clause, a policy, or an afternoon of diligence.

The fastest way to get burned by AI is to treat it like ordinary software. The second fastest is to ban it and pretend the ban holds. Neither posture survives contact with reality. Governance does.