AI Vendor Security Addendum - Template
Security terms to attach to a contract with a supplier of AI services or AI agents. Replace the bracketed placeholders with your own details.
This addendum forms part of the agreement between [Organization] and the supplier named in that agreement ("the supplier"). It sets the security terms the supplier agrees to when it provides AI services to [Organization]: AI models and APIs that [Organization] sends data to, AI agents that take actions on [Organization]'s systems or data, and AI features built into software [Organization] uses.
1. Purpose and application
This addendum applies to the AI services listed in the agreement and to any AI service the supplier later provides to [Organization]. Where it conflicts with the main agreement on a security matter, the stricter term applies. Nothing in it reduces an obligation the supplier already owes under the main agreement or at law.
Some large AI providers offer only their standard terms. Where that is the case, [Organization] checks those terms against this addendum before the service is used, records any gap, and [approver role] decides whether to accept it.
2. Definitions
| Term | Meaning |
|---|---|
| AI service | Any product the supplier provides that uses an AI model: a model or its API, an AI agent, or AI features built into software. |
| AI agent | Software that takes actions on [Organization]'s systems or data on its own, without a person approving each step. |
| Customer Data | Any information [Organization] sends to, stores in or receives from the AI service, including prompts, uploaded files, outputs and logs. |
| Model training | Using data to build, train, fine-tune or otherwise improve an AI model. |
| Sub-processor | Any third party the supplier uses to deliver the AI service that can access Customer Data, including a third-party model provider. |
| Security incident | Any event that harms, or is reasonably likely to harm, the confidentiality, integrity or availability of Customer Data, including an AI agent acting outside its agreed scope. |
3. Use of Customer Data
The supplier must:
- Use Customer Data only to provide the AI service to [Organization]
- Not use Customer Data to train, fine-tune, test or improve any model, its own or a third party's, without [Organization]'s prior written agreement
- Not keep prompts and outputs longer than [30 days] after processing, unless [Organization] agrees otherwise in writing or the law requires it
- Process and store Customer Data only in [the agreed countries or regions], and not move it elsewhere without [Organization]'s written agreement
- Keep Customer Data logically separate from its other customers' data
4. AI agents and automated access
Where the supplier operates an AI agent on [Organization]'s systems or data, the agent may reach only the systems, data and actions agreed in writing with [role]. The supplier gives each agent its own credentials, scoped to that agreed task and never shared or reused. The agent must not make a payment, delete data, change anyone's access or send anything outside [Organization] without recorded approval from a named person at [Organization].
The supplier protects each agent against prompt injection: text inside a ticket, email, document or other content the agent reads is never treated as an instruction that changes its permissions or approved actions. [Organization] can suspend any agent immediately, without the supplier's help.
5. Security requirements
- Customer Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent)
- Multi-factor authentication for every supplier staff member and administrator account with access to Customer Data
- Least-privilege access to Customer Data, reviewed [quarterly]
- Critical vulnerabilities on internet-facing systems fixed within [48 hours] of a fix being available, and others within [30 days]
- Security testing before release and after material change, including testing for prompt injection and data leaking through outputs
- A current independent assurance report or certification covering the AI service, such as ISO/IEC 27001, ISO/IEC 42001 or SOC 2
6. Incident notification
The supplier notifies [role] at [channel] of each event below, within the time shown. It cooperates with [Organization]'s own legal notification duties, such as a data breach assessment, and does not notify [Organization]'s customers or any regulator on its behalf without written agreement.
| Event | Notify within | The notice says |
|---|---|---|
| A security incident affecting Customer Data | [24 hours] of becoming aware | What happened, the data and systems affected, containment so far, and a named contact |
| An AI agent acting outside its agreed access or scope | [24 hours] of becoming aware | Which agent, what it accessed or did, when, and how it was stopped |
| Ransomware or extortion affecting the service | [24 hours] of becoming aware | What is affected or at risk, current status, and recovery steps |
| A follow-up report on any of the above | [5 business days] after the first notice | Root cause, the full scope of Customer Data affected, remediation and prevention |
7. Logging and records
The supplier logs every access to Customer Data, every administrative action on the systems that hold it, and every action an AI agent takes, including the instruction that triggered it, the data it read and anything it changed.
Logs are protected from alteration and deletion, kept for at least [12 months], and provided to [role] within [5 business days] of a written request, or within [24 hours] during a security incident.
8. Model and service changes
The supplier gives [Organization] at least [30 days] written notice before a material change: replacing the underlying model or changing it in a way that affects how it behaves or what data it uses, changing where Customer Data is processed or stored, adding or replacing a sub-processor, or reducing a security control in this addendum.
[Organization] may object before the change takes effect. If no acceptable alternative is agreed, [Organization] may end the affected service without penalty. Where a change is forced by law or a security emergency, the supplier tells [role] as soon as it can and explains why notice could not be given.
9. Sub-processors and supply chain
The supplier keeps a current list of its sub-processors, naming any third-party model provider behind the service, and gives it to [Organization] on request. It binds each sub-processor in writing to terms at least as protective as this addendum, including the limits on model training, and remains responsible for their acts and omissions as if they were its own.
10. Assurance and audit
The supplier completes [Organization]'s security questionnaire [annually], provides its current certifications or independent assurance reports on request, and tells [role] if one lapses or is withdrawn.
Where no current report covers the service, [Organization] or its auditor may audit the controls relevant to this addendum at an agreed time, no more than once a year unless an incident justifies another. [role] reviews this evidence [annually] and records the outcome.
11. Termination and exit
On termination, or within [30 days] of a written request, the supplier returns Customer Data in a usable, machine-readable format and then deletes it everywhere it is held: prompts, outputs and logs, copies held by sub-processors, and any fine-tuned model, embedding or index built from it. Where a law requires it to keep a copy, it tells [Organization] what it keeps, why and for how long.
The supplier confirms the deletion in writing, revokes every credential, API key and token it holds to [Organization]'s systems, and stops all AI agent access.
This template is a starting point, not legal advice. Replace every bracketed placeholder, delete what does not apply, and have it reviewed before you rely on it.
