AI Procurement Agreement Checklist For NZ Businesses

Can you accept an AI vendor's standard terms and start uploading your business data?

Sometimes, yes, but only after you've checked what the terms actually let the vendor do with your data, what they promise about the service, and who carries the risk if the AI gets something wrong.

AI tools can save time, reduce admin and help you make faster decisions. The catch is that the contract often decides the most practical questions: who owns the outputs, whether your data can train the model, what happens after a breach, and whether you're left carrying all the liability.

This doesn't have to be complicated. A focused review of the AI vendor contract before you sign, click accept or upload data can save a lot of stress later.

What Should You Check Before Signing An AI Procurement Agreement?

You should check the AI procurement agreement before you share any real business, customer or employee data, because the vendor's terms may give them broader rights than you expect.

For an AI software agreement, don't just review the price and the subscription term. Look closely at how the tool will be used in your business, including any software licence terms and what could go wrong if the output is inaccurate, biased, unavailable or leaked.

A practical AI procurement checklist should cover:

• Parties: Check the vendor's legal name, NZBN if they have one, country of incorporation and contracting entity.
• Scope: Spell out what the AI tool does, what it doesn't do, and who can use it.
• Data: Confirm what data you'll upload, where it will be stored, and whether it leaves New Zealand.
• Model training: Check whether your prompts, files, chats, documents or outputs can be used to train or improve the vendor's models.
• Privacy: Make sure the terms support your obligations under the Privacy Act 2020, including any data processing agreement.
• IP: Work out who owns your inputs, the outputs, custom workflows and any improvements.
• Service levels: Check uptime, support hours, response times and what happens when the service is down.
• Liability: Review exclusions, caps, indemnities and disclaimers about accuracy.
• Exit: Make sure you can export or delete your data when the contract ends.

If the vendor only gives you online AI service terms in a click to accept format, you still need to review them. Clicking accept can still create a binding contract for your business.

Can An AI Vendor Use Your Data To Train Its Model?

Yes, an AI vendor may be able to use your data for model training if the contract, privacy settings or product terms allow it.

This is one of the biggest issues in an AI vendor contract in NZ, especially if you're uploading customer records, employee information, contracts, designs, financial data, source code or confidential business documents.

You want the agreement to be very clear about the difference between:

• Your inputs: prompts, documents, data sets, images, recordings and files you upload
• Your outputs: reports, summaries, recommendations, generated text, code, images or other results
• Usage data: logs, analytics, metadata and information about how your team uses the tool
• Model improvements: changes the vendor makes to its AI systems using customer data

Ideally, the contract should say the vendor can't use your confidential information, personal information or business data to train public or shared models unless you've clearly agreed to it. If training is allowed, check whether it's opt in or opt out, whether data is de identified, and whether de identification is good enough for the type of data you're providing.

Say Maia runs a Wellington HR consultancy. She wants to use an AI tool to summarise interview notes and draft candidate reports. If the tool's terms allow uploaded notes to train the vendor's model, Maia may be sharing candidate personal information and client confidential information in a way her clients never agreed to. A better setup might use an enterprise plan where training is switched off, access is limited to authorised users, and data is deleted after 30 days.

The practical point is simple: don't upload live data until you've checked the data use clause and the product settings match what the contract says.

What Privacy Clauses Should Your AI Software Agreement Include?

Your AI software agreement should include privacy clauses that help you comply with the Privacy Act 2020 and the Information Privacy Principles.

If your business is collecting, storing or using personal information, you need to think carefully about whether the AI provider is acting as a service provider, what data processing terms apply, where the information is hosted, and whether the tool's use matches what you've told people in your privacy policy.

Key privacy points to check include:

• Purpose: The vendor should only process personal information for the agreed service, not unrelated analytics, advertising or product training unless you've agreed.
• Indirect collection: Since 1 May 2026, if the AI tool or your business collects personal information about an individual from someone else, check whether IPP 3A requires you to take reasonable steps to ensure the individual is aware of the collection, the purpose, intended recipients and who is holding the information.
• Storage location: Check whether data is stored in New Zealand, Australia, the United States, Europe or elsewhere.
• Overseas disclosure: If personal information is disclosed overseas, you may need to be satisfied that appropriate privacy protections apply.
• Security: Look for practical security commitments, such as access controls, encryption, audit logs and vulnerability management.
• Subprocessors: The vendor should tell you who else handles the data and how changes to subprocessors are managed.
• Breach notice: The contract should require the vendor to notify you promptly if there's a privacy or security incident.
• Deletion and return: You should be able to get your data back and have it deleted at the end of the contract.

IPP 3A can be particularly relevant in AI procurement. For example, a vendor might enrich customer records from third party databases, screen candidates using information collected from recruitment platforms, or process employee information supplied by managers rather than by the employee directly. Your privacy policy, collection notices and vendor workflows should all line up, so people receive the right information at the right time.

Under the Privacy Act 2020, notifiable privacy breaches must be reported to the Privacy Commissioner and affected individuals as soon as practicable after you become aware of the breach, if the breach has caused or is likely to cause serious harm. If your vendor waits days or weeks to tell you about an incident, you may struggle to meet that obligation.

Your privacy policy should also line up with how you're using AI. If you tell customers their information is used only to provide your service, but you upload it into an external AI tool for profiling or automated recommendations, that mismatch can create real compliance issues.

Who Owns AI Outputs And What If They Are Wrong?

It depends on the contract, because AI service terms often deal with ownership, accuracy and responsibility in very different ways.

Most businesses want two things from the IP clause. First, you should keep ownership of the data, prompts and materials you upload. Second, you should have a clear right to use the outputs for your business purposes, including internal documents, customer reports, marketing content, software code or product designs.

However, AI outputs can raise tricky issues. The vendor may say:

• outputs may not be unique to you
• other users may receive similar outputs
• the vendor doesn't promise outputs are accurate, complete or fit for your purpose
• you're responsible for reviewing outputs before using them
• the vendor won't be liable if an output infringes someone else's rights

If you're using AI for lower risk internal drafting, those terms may be manageable. If you're using AI outputs in customer facing advice, health, finance, recruitment, education, legal documents, engineering or safety related decisions, the risk is much higher.

A Worked Example

Imagine Koru Health, a small allied health clinic in Christchurch, pays for an AI tool that turns practitioner notes into patient summary letters. The clinic uploads 5,000 patient records during setup. The contract says the tool has 99.5 percent monthly uptime, support replies within 2 business days, and the vendor's total liability is capped at one month of fees.

If the AI produces an inaccurate letter that leads to a complaint, the clinic probably can't point to the vendor and walk away. The vendor has likely disclaimed medical accuracy, and the liability cap may be tiny compared with the harm to the clinic's reputation and the time spent fixing the issue.

For higher risk use cases, you may need human review steps, audit trails, stricter warranties, a higher liability cap, indemnities for IP infringement, and clear rules about when staff can rely on the tool.

How Do You Review Liability, Bias And Fair Trading Risk?

You should review liability, bias and Fair Trading Act risk by asking what the AI tool is being used to decide, recommend or generate for customers.

The Fair Trading Act 1986 prohibits misleading and deceptive conduct in trade. If your business uses AI to generate product claims, advertising copy, chatbot answers, pricing recommendations or customer emails, you're still responsible for what your customers see. You generally can't excuse a misleading statement by saying the AI wrote it.

The Consumer Guarantees Act 1993 can also matter if you're providing goods or services to consumers. If your AI backed service doesn't meet the guarantees that apply to consumer services, your customer may have remedies against your business. In some business to business situations, parties can contract out of the Consumer Guarantees Act if the goods or services are supplied and acquired in trade and it's fair and reasonable to do so, but that needs to be handled carefully.

Bias is another practical risk. If an AI tool supports hiring, lending, pricing, customer segmentation, data sharing or eligibility decisions, biased outputs can damage trust and create legal exposure. You should check whether the vendor provides information about testing, monitoring, limitations and human oversight.

In the contract, look for:

• Accuracy commitments: What does the vendor actually promise, if anything?
• Use restrictions: Does the vendor ban certain uses, such as medical, legal, employment or financial decisions?
• Human review: Are you required to review outputs before using them?
• Liability cap: Is the cap realistic for the risk, or just a refund of fees?
• Indemnities: Does the vendor protect you if the tool infringes third party IP or breaches confidentiality?
• Excluded losses: Are data loss, privacy breaches, reputational harm and lost profits excluded?

If the tool will affect employees, customers or regulated decisions, get tailored advice before relying on standard AI service terms.

What Should You Put In An AI Procurement Checklist?

Your AI procurement checklist should turn the contract review into a practical approval process your team can follow before using the tool.

This is especially helpful if different teams are trialling AI tools on company cards or free accounts. Without a process, someone can accidentally accept terms that let a vendor use your confidential information for product development or send personal information offshore.

AI Procurement Agreement Outline

Use this as a working outline for the clauses to cover. It's not a finished legal document, and a lawyer or legal team should tailor it before you use it.

1. Parties And Contract Details: Write the legal names, NZBNs if relevant, contact people, start date and contract term.
2. AI Tool And Use Case: Describe the software, features, permitted users and approved business purpose.
3. Data Inputs: List the categories of data you'll upload, including any personal, sensitive or confidential information.
4. Data Use And Model Training: State whether the vendor can use inputs, outputs or usage data for training or improvement.
5. Privacy And Security: Set out Privacy Act 2020 obligations, IPP 3A checks for indirect collection, storage locations, subprocessors, security controls and breach notice timing.
6. Confidentiality: Protect business information, customer data, trade secrets, pricing, strategy and documents.
7. IP Ownership: Confirm ownership of inputs, rights to outputs, licences, restrictions and IP infringement protection.
8. Service Levels And Support: Include uptime targets, support hours, response times, maintenance windows, IT services obligations and credits if relevant.
9. Compliance And Acceptable Use: Cover prohibited uses, regulated use cases, human review and staff responsibilities.
10. Liability And Indemnities: Set liability caps, exclusions and indemnities based on the actual risk of the tool.
11. Exit And Data Deletion: Explain export formats, deletion timing, backup deletion and assistance during transition.

Internal Approval Steps

Before approving an AI vendor, you can ask your team to:

• identify what problem the tool solves and who will use it
• confirm whether personal information or confidential information will be uploaded
• test the tool with dummy data first
• review the vendor's terms, privacy policy and security materials
• check whether model training is off by default
• check whether privacy policies, collection notices and vendor workflows cover the intended AI use
• record who approved the tool and any restrictions on use
• train staff not to upload data outside the approved use case

This gives you a paper trail and helps your team move quickly without taking unnecessary risks.

Key Takeaways

• An AI procurement agreement in NZ should be reviewed before you upload real business, customer or employee data.
• Pay close attention to data use, model training, privacy, confidentiality, IP ownership, service levels and liability caps.
• Your Privacy Act 2020 obligations still apply when an AI vendor processes personal information for your business, including IPP 3A where personal information is collected indirectly.
• You remain responsible for misleading customer claims, unfair outcomes and risky decisions made using AI outputs.
• A practical checklist and internal approval process can help your team adopt AI tools safely and consistently.
• Standard AI service terms often favour the vendor, so tailor the agreement to the risk level of your use case.

If you'd like help with reviewing an AI vendor contract, preparing your AI procurement checklist, updating your privacy terms or tailoring your software agreements, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.