Sample control language for the terms most often missing from AI vendor agreements, with the AITPRM Health domain and finding each clause answers.
Terms are easiest to set while the vendor is still selling. Each clause below is written as a starting position for counsel, not a final form. Where a clause is not accepted, the response is recorded as a finding alongside the decision to accept, condition or decline.
Why it matters. One-sided disclaimers shift the cost of a model error to the provider who did not build it.
Vendor shall indemnify, defend and hold harmless Customer from third-party claims arising from (a) any breach of the Business Associate Agreement by Vendor or its subprocessors, (b) infringement claims relating to the Service or its training data, and (c) bodily injury or death to the extent caused by output of the Service that Vendor’s documentation represented as suitable for the clinical use in question. Limitations of liability shall not apply to (a) through (c).
Why it matters. A halt that depends on a vendor ticket is not a control the organization holds.
Customer shall have the unilateral ability to suspend all AI-generated output to any clinical, financial or operational record through a control operable by Customer personnel, effective immediately and without Vendor involvement. Vendor shall document and maintain a fallback to Customer’s prior workflow and shall not treat Customer’s exercise of this right as a breach or grounds for fee adjustment.
Why it matters. Training rights, embeddings and “de-identified” derivatives outlive the contract unless the agreement says otherwise.
Vendor shall not retain Customer Data, prompts, outputs, transcripts, embeddings or any derivative thereof beyond the period necessary to deliver the Service, and in no case beyond thirty (30) days, except as Customer directs in writing. Vendor shall not use Customer Data or derivatives to train, tune, evaluate or improve any model. On termination Vendor shall return or destroy all such data and certify destruction in writing within thirty (30) days, and shall cause each subprocessor to do the same.
Why it matters. Standard BAAs bind the vendor; they rarely name the model provider two hops down.
Vendor shall identify in Schedule B each subprocessor, including any provider of a foundation or hosted model, that processes Customer Data, with its function, processing region and agreement status. Vendor shall give Customer thirty (30) days’ notice before engaging any additional subprocessor and Customer may object; Vendor shall flow down restrictions no less protective than this Agreement and produce executed agreements on request.
Why it matters. Uptime SLAs measure whether the tool is on. They do not measure whether it is still right.
Vendor shall monitor the metrics in Schedule C (including calibration, drift and subgroup performance) and shall notify Customer within five (5) business days of any metric exceeding its threshold, any change in model version or training data, and any incident of unsupported output affecting a clinical record. Vendor shall provide monitoring artifacts quarterly and on request. Two threshold breaches in any rolling ninety (90) day period shall entitle Customer to suspend the Service under Clause 2 and to terminate for cause without penalty.
Illustrative. Sample organization, vendors, scores, findings and clause language are fictitious and provided for demonstration. A score is decision support, not a determination or finding of compliance. Nothing in this document is legal advice; sample clause templates must be reviewed by counsel. © 2026 ReMyll. AITPRM Health™ is a trademark of ReMyll.