AI Tool Terms For NZ SaaS Startups: What To Check

Can you plug an AI tool or model into your SaaS product and launch? Usually, yes, but you shouldn't treat the supplier terms as a box ticking exercise.

The good news is that most AI supplier contracts follow a familiar pattern once you know where to look. The risky parts are usually around data use, who owns the output, service reliability, liability caps, indemnities and what you need to tell your customers.

If you're building fast, it's tempting to accept the standard clickwrap terms of use and move on. But if that AI tool sits inside your core product, those terms can quietly become part of your own product risk.

Can You Use An AI Tool In Your SaaS Product?

Yes, you can usually use an AI tool in your SaaS product, but only if the supplier terms allow your planned use and your customer promises don't go further than what the AI supplier gives you.

Start by checking whether the tool is being used for:

• Internal use, such as helping your team summarise support tickets or draft content.
• Embedded use, where your customers interact with AI inside your SaaS platform.
• Automated decisions, such as scoring, recommendations, approvals or risk flags.
• Customer facing outputs, such as reports, copy, code, designs or analysis delivered to your users.

The more visible and central the AI tool is, the more carefully you need to review the terms. A lower risk internal drafting tool is very different from an AI feature your customers rely on to run their own business.

In New Zealand, your legal position also depends on the data and customers involved. If you're processing personal information, the Privacy Act 2020 will matter. If your product claims could mislead customers, the Fair Trading Act 1986 may apply. If you sell to consumers, the Consumer Guarantees Act 1993 may limit what you can exclude in your own terms.

Your first job is to line up three things:

• What the AI supplier promises you.
• What you promise your customers.
• What the law requires from your business.

If those don't match, your business may be left carrying a risk the AI supplier has refused to accept.

Will The AI Supplier Use Your Data To Train Its Model?

It depends on the supplier terms, and this is one of the first clauses you should check before sending customer data into an AI system.

Look for wording about training, improving services, model development, analytics, evaluation, human review and retention. Some suppliers say they won't use your API data for model training. Others allow training unless you opt out, use an enterprise plan or configure your settings correctly.

That matters because your SaaS business may be handling customer data, confidential business information or personal information. Under the Privacy Act 2020, you need to be clear about why you're collecting personal information, how you're using it and who you're disclosing it to. If the AI supplier is overseas, Information Privacy Principle 12 may also be relevant because it deals with overseas disclosure of personal information.

Ask these practical questions:

• Can the supplier use your prompts, uploads, logs or outputs for training?
• Can you switch training use off, and is that confirmed in writing?
• How long does the supplier keep inputs, outputs and logs?
• Can supplier staff or contractors review customer data?
• Where is the data hosted and processed?
• Does the supplier use subprocessors, and can they change them without notice?

If your customer contracts promise that their data is confidential, private or not used to train third party models, your AI supplier terms need to support that promise. A privacy policy alone won't fix a supplier contract that lets the supplier reuse customer data broadly.

Who Owns The Inputs, Prompts And Outputs?

It depends, because ownership of AI inputs and outputs is a mix of contract terms, intellectual property law and the facts around how the content was created.

Your contract with the AI supplier should clearly deal with three things:

• Inputs, meaning the data, prompts, files, code or content you send to the tool.
• Outputs, meaning the text, code, images, analysis or other material the tool produces.
• Model rights, meaning the supplier's ownership of the underlying model, weights, software and training methods.

Many AI suppliers say you own your inputs and may use the outputs. That's helpful, but it's not the same as a clean guarantee that the output is original, not infringing or exclusively yours.

Under the Copyright Act 1994, copyright can subsist in original works, including certain computer generated works where there's no human author. For those computer generated works, the Act treats the author as the person who undertook the arrangements necessary for creation, and an author can be a natural person or a body corporate. However, AI generated outputs can still raise difficult questions about originality, infringement risk and who can safely claim ownership or exclusive rights. If your SaaS product gives customers AI generated copy, reports or code, you should avoid promising that every output is owned outright by the customer unless you're confident the supplier terms and your workflow support that.

You should also check whether the supplier gives an IP indemnity. An indemnity is a promise to cover certain losses if a third party claims the tool or output infringes their rights. Some suppliers provide one only for paid enterprise plans. Others exclude outputs, customer prompts, modified content or use outside their rules.

Example: When The Output Clause Changes The Deal

Aroha runs a Wellington SaaS platform that creates marketing reports for gyms. Her AI supplier charges $1,200 per month and allows up to 100,000 API calls. The standard business terms and conditions say Aroha can use outputs, but the supplier doesn't promise outputs are unique and excludes any IP indemnity for generated text.

Aroha's largest customer pays $2,500 per month and wants her terms to say all reports are original and fully owned by the customer. That's a mismatch. If she signs the customer term as drafted, Aroha is giving a stronger IP promise than the AI supplier gives her. A safer approach is to narrow the customer promise, add review processes for high risk content and seek better supplier terms before launch.

Are Open Source AI Models Safe To Use Commercially?

Sometimes, but you need to read the licence carefully because open source doesn't always mean free to use in any way you like.

Open source AI can be attractive for a SaaS startup because it may reduce vendor lock in and give you more control over hosting. But the legal issues can be different from a hosted AI API.

Check the licence and any acceptable use policy for:

• Commercial use, including whether use in a paid SaaS product is allowed.
• Copyleft obligations, such as GPL or AGPL style terms that may require you to share source code in some situations.
• Attribution, including notices you must keep in your product or documentation.
• Use restrictions, such as bans on certain industries, biometric uses, surveillance, harmful content or regulated decisions.
• Patent rights, especially whether the licence grants a patent licence or has termination rules.
• Model weights and datasets, because the code licence may not cover the weights, training data or output rules.

AGPL style licences deserve special care in SaaS products. Some licences can be triggered by network use, not just distribution of software. If your product lets customers interact with modified open source software over the internet, you may have source code disclosure obligations.

Also remember that open source licences may not give you any warranty or indemnity. If the model produces harmful content, copies training data or infringes someone else's rights, the licence may leave that risk with your business.

What Happens If The AI Tool Goes Down Or Produces A Bad Output?

It depends on the service levels and liability clauses, but many AI suppliers limit their responsibility much more than SaaS founders expect.

If the AI feature is central to your product, uptime and performance terms matter. Check whether the supplier gives a specific service level agreement, such as 99.5 percent or 99.9 percent uptime, and what happens if they miss it.

Service credits can be useful, but they may be small. For example, if your supplier's only remedy is a credit capped at 10 percent of your monthly fee, and your monthly fee is $1,200, your maximum credit may be $120. That won't cover much if your own customers lose access to a key feature for a day.

Review these clauses closely:

• Uptime, including exclusions for maintenance, beta features and third party outages.
• Support response times, especially for production incidents.
• Rate limits, because API limits can affect your own customer experience.
• Suspension rights, including when the supplier can stop access for suspected misuse.
• Liability caps, such as fees paid in the last month, 3 months or 12 months.
• Excluded losses, including lost profits, data loss, reputational harm and customer claims.

You should also think about bad outputs. AI tools can hallucinate, produce biased results or generate unsafe recommendations. Your supplier terms may say the output is provided as is and that you're responsible for evaluating it before use.

For customer facing AI, your own SaaS terms and conditions should explain sensible limits: outputs may be inaccurate, customers should review them, and the tool shouldn't be used as the sole basis for high risk decisions unless you've designed and contracted for that use.

Do You Need To Tell Your Customers You Use AI?

Often, yes, especially if AI affects what your customers receive, how decisions are made or how their data is processed.

There's no single New Zealand law that says every SaaS product must put an AI label on every feature. But customer disclosure is still a practical and legal risk point.

Under the Fair Trading Act 1986, you shouldn't mislead customers about how your product works. If your marketing suggests every report is prepared by human experts, but it's mostly generated by AI, that could create a problem. The Commerce Commission can take action where conduct is misleading or deceptive.

Under the Privacy Act 2020, if you collect and use personal information in an AI feature, your privacy wording should tell customers what information is collected, why it's used, who receives it and whether it may go overseas. If there's a privacy breach that's likely to cause serious harm, you may need to notify the Privacy Commissioner and affected people as soon as practicable.

Your customer disclosures might sit in:

• Your SaaS terms and conditions.
• Your privacy policy.
• An AI product notice inside the platform.
• Admin settings or consent flows for customer account owners.
• Help centre materials explaining limitations and safe use.

Keep the wording accurate and practical. You don't need to reveal trade secrets, but you should avoid overstating reliability, human oversight or ownership of outputs.

What Should An AI Supplier Contract Checklist Include?

Your checklist should focus on the clauses that could stop your product working, expose customer data or leave your business holding risk your supplier has excluded.

When you're reviewing AI terms and conditions for your SaaS launch, work through the supplier terms alongside your own customer terms. The goal is to make sure the risk flows sensibly through the chain.

Here is a practical outline you can use for an internal review note or supplier addendum:

1. Product Use: describe exactly how the AI tool will be used inside your SaaS product and whether customers will see or rely on the output.
2. Data Use And Training: state whether prompts, uploads, logs and outputs can be used for model training, analytics or human review.
3. Privacy And Security: list hosting locations, security standards, breach notice obligations and overseas disclosure details.
4. Subprocessors: require a current list, notice of changes and flow down obligations for data handling.
5. IP Ownership: confirm ownership of inputs, permitted use of outputs, model ownership and any restrictions on generated content.
6. Open Source Components: identify any open source model, code, licence, attribution rules and source code disclosure risks.
7. Service Levels: set uptime, support response times, rate limits, maintenance windows and remedies for outages.
8. Indemnities: check whether the supplier covers IP claims, privacy breaches, security failures or regulatory issues caused by the tool.
9. Liability Cap: record the dollar cap or cap based on fees and whether key risks sit outside the cap.
10. Customer Disclosures: note what you need to say in your SaaS terms, privacy policy and product notices.

If the supplier won't negotiate, you still have options. You can change your product design, remove personal information before sending data to the tool, add human review, limit customer promises or choose a different provider. Templates can help you spot headings, but AI supplier risk usually needs tailoring to your product, data and customer base.

Key Takeaways

• AI supplier terms can affect your SaaS product, privacy position, customer promises and IP risk.
• Check whether the supplier can use your data for training, human review or product improvement.
• Don't promise customers more ownership, uptime or indemnity protection than your AI supplier gives you.
• Open source AI models can be useful, but licences like AGPL style terms and use restrictions need careful review.
• Your customer disclosures should explain AI use clearly without overstating accuracy, human involvement or output ownership.
• A tailored AI contract review is worth doing before launch, not after customers are already relying on the feature.

If you'd like help with reviewing your AI supplier terms, updating your SaaS customer terms, privacy wording or IP clauses, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.