AI in SaaS and cloud: who bears the risk under vendor contracts

Companies increasingly consume generative AI as a service: a ChatGPT subscription, Copilot features inside Microsoft 365, an API built into an internal application. A legal analysis published by ICT Security Magazine on 11 October 2026 looks at how these services are fitted into existing SaaS and cloud contracts, and at how vendor terms split the risk between whoever provides the service and whoever uses it. On ARX News we covered the AI Act from the model providers’ side, in connection with incident reporting obligations; this time the point of view is the customer’s.

This article relies on a single source, a legal analysis rather than a technical advisory. The text we were able to consult covers ChatGPT’s terms in depth and breaks off in the section on Microsoft Copilot: for the other services it mentions, such as Google Gemini, we report no details.

The context: European rules and standard-form contracts

According to ICT Security Magazine, the European AI framework focuses on risk prevention, governance and an upfront allocation of obligations among the actors in the supply chain, but leaves several practical questions open, and those are settled by the contract. Generative models are not bought: the customer gets a right of use limited in time and scope, while the model and the infrastructure remain with the provider (the AI-as-a-Service paradigm, a form of SaaS).

The author notes that these contracts are often standard, drafted by foreign operators and in practice non-negotiable, with consequences for risk, liability, data and intellectual property. The alternative, a custom system built on datasets chosen by the client, gives more control (access to source code and algorithms, the option to rely on other developers) but costs more and is less common.

What the terms say: the ChatGPT case

The source’s analysis of OpenAI’s terms brings out several points that matter directly to IT and security managers:

• Documents to read together: terms of use, conditions of the paid plans (Plus, Team, Enterprise), privacy policy and, for businesses, the Data Processing Addendum (DPA).
• Input and output data: users keep ownership of their inputs and receive the rights to outputs within the limits of the law, with no guarantee of originality. On consumer plans, content may be used to train the models unless the user opts out; on enterprise plans, according to the source, it normally is not.
• “As is” and “as available” service: no warranty of accuracy, reliability, continuity or fitness for a purpose. Users are responsible for decisions based on the outputs and must check them.
• Limited liability: a cap on damages tied to the amount paid over a period (for example the last twelve months) or to a fixed threshold, and exclusion of indirect damages, including data loss, lost profits and reputational harm.
• Indemnification by the user for unlawful use; business contracts may include protections for the customer, for example on intellectual property, within set limits.
• Prohibited uses: reverse engineering and model extraction, using outputs to build competing systems, use in high-risk areas without human oversight. Breaches can lead to account suspension.
• Unilateral changes: the provider can modify, suspend or discontinue the service and update the terms with notice.

In enterprise plans and negotiated contracts, again according to the source, there are SLAs with availability guarantees and service credits, higher liability caps and more detailed clauses on security and data protection. Under the DPA the customer is the controller of the data it enters and the provider acts as processor. The author’s conclusion: liability is not uniform, it depends on the customer’s bargaining power.

The supply chain: the Copilot case

For Microsoft the source describes a more layered ecosystem: free Copilot in Windows, Edge and Bing, Copilot Pro, Copilot for Microsoft 365 in the Office applications and Teams, GitHub Copilot for code and Copilot Studio for building agents. The models are developed by OpenAI and licensed to Microsoft, which runs them on its own Azure infrastructure: when a user works with Copilot in Word or Excel, the prompt goes to Microsoft’s servers, which decide which model to use.

For anyone assessing third-party risk, this means a single contract hides a chain of providers. The available text stops at this point.

Impact for European and Italian companies

The analysis is legal, but the consequences are operational. An AI service that handles documents, code or customer data is an ICT supplier in every respect. For NIS2 entities (in Italy, Legislative Decree 138/2024) supply chain security is part of the risk management measures: “as is” terms with low liability caps and no SLA should be treated as a residual risk to be assessed, not as a legal footnote. Where personal data is involved, the DPA and transfers to third countries fall under the GDPR; in healthcare, health data entered in a prompt is a special category of data.

The most concrete point is the difference between plans: the same service can have opposite rules on using data for training, depending on whether an employee uses a personal account or the company one.

What to do now

1. Inventory: list the AI services in use, including features switched on inside platforms already under contract (office suites, development environments), and the plan type for each.
2. Personal accounts: decide which services are authorised and with which accounts; where possible allow access only with the corporate identity (SSO) and restrict the others at the proxy.
3. Data and training: check in the contract and in the admin console whether inputs and outputs can be used for training, and document the chosen setting.
4. DPA and sub-processors: review roles, security measures, the list of sub-processors, processing location and transfers outside the European Economic Area.
5. Contractual risk: compare liability cap, SLA and service credits with how critical the dependent processes are; for critical ones, negotiate different terms or plan an alternative.
6. Human review of outputs: the contract puts it on you. Make it a written rule for significant decisions, generated code and customer-facing text.
7. Changes to the terms: assign someone to track vendor notices and reassess the risk when conditions or models change.
8. Exit: check how data is retrieved and deleted when the contract ends.

How ARXDOME helps

If the terms make the customer responsible for using the service and for decisions taken with its outputs, you need evidence of what happened. ARX Sentry collects server and firewall logs in one place, and ARX Retain keeps them for the required number of years on European storage with object lock and legal hold, ready for an audit or a dispute with the provider.

Last updated: 11 October 2026