For the last few years, AI regulation has mostly lived in consultations, white papers and conference panels. That phase is over.
Rules in the EU, in several US states and elsewhere now impose real obligations on businesses that build or use AI. Regulators are starting to ask for evidence, not intentions.
What regulators now expect
The detail varies by country, but the expectations are broadly similar. Businesses are expected to:
- Know which AI systems they build or use
- Assess how risky each one is
- Document how those systems work and how they are tested
- Monitor them over time, not just at launch
- Be clear about who is responsible when something goes wrong
None of that can be done by a policy document alone. It has to happen inside the business, day to day.
The rules do not line up
The harder problem is that the rules overlap and sometimes conflict. The EU has a single, detailed AI law. Some US states have their own rules. The UK has so far relied mainly on existing laws, such as data protection, and on sector regulators.
If you sell into more than one market, you may be working to several sets of requirements at once.
Where this shows up in contracts
Customers, investors and suppliers are already responding. Expect to see more detailed terms on:
- Testing and accuracy. What testing has been done, and what standard the AI is expected to meet.
- Monitoring and incidents. Who watches performance, and how quickly problems must be reported.
- Responsibility. A clear split between supplier and customer on who is accountable for outputs and decisions.
- Data use. Whether customer data can be used to train or improve the AI model.
- Model changes. What happens when a supplier updates or swaps the underlying model.
- Audit and information rights. What evidence the customer can ask for to meet its own obligations.
Build contracts that can adapt
Because the rules differ by market and keep changing, a single fixed set of AI terms will struggle. A modular approach works better: core contract terms that stay stable, with a separate AI schedule that can be updated by product or by market.
That makes it easier to respond to a new rule or a customer request without renegotiating the whole agreement.
What to do now
- List the AI tools you build and use, including those inside third-party software.
- Match each tool to the contracts that cover it.
- Check whether your supplier terms give you the information and protection you need.
- Check whether your customer terms make promises about AI that you cannot back up.
- Consider a standard AI schedule for new deals.
Summary
AI governance is now a practical requirement, and contracts are where it gets tested. The businesses that get ahead of this will find customer due diligence easier, deals quicker and disputes rarer.
If your contracts have not caught up with how you use AI, book a free 20-minute call with the Ethiqs team.