Negotiating OpenAI Contracts for Generative AI

Adopting generative AI at enterprise level promises innovation and efficiency. But it also brings new risks and contractual complexities. Securing a favourable contract with OpenAI is essential to protect your organisation’s data, intellectual property, and commercial interests. This 13-point playbook covers every critical area.

#	Contract Area	What to Negotiate	Risk if Missed
1	Data Privacy	Confidentiality, retention control, DPA, GDPR/CCPA compliance	Data leakage, regulatory fines
2	IP Ownership	Ownership of inputs and outputs, limited licence back to OpenAI	Uncertain IP rights, third-party claims
3	Usage & Compliance	Align usage policies with business needs, industry-specific rules	Contract breach, regulatory violation
4	Model Transparency	Documentation, change notifications, audit support, bias assurance	Unpredictable model behaviour
5	Indemnification	IP infringement indemnity from OpenAI, narrow your indemnity back	Uninsured legal exposure
6	SLA & Uptime	Uptime commitment, latency, support SLAs, remedies (credits)	Downtime with no recourse
7	Pricing & Cost Controls	Volume discounts, spend caps, fixed rates, transparency	Budget overruns, surprise charges
8	Renewal & Lock-In	Short terms, data portability, renewal caps, exit rights	Vendor lock-in, price escalation
9	Security	Encryption, access controls, SOC 2, breach notification	Data breach liability
10	Training Opt-Out	Explicit no-training clause, deletion rights, audit verification	Proprietary data absorbed into public model
11	Liability Limits	Higher caps, carve-outs for IP/security/wilful misconduct	Minimal vendor accountability
12	Termination & Exit	For-cause and for-convenience termination, data retrieval, refunds	Trapped in unfavourable agreement
13	Red Flags	Data loopholes, missing NDA, one-sided changes, no SLA, weak indemnity	Signing a contract that works against you

Protecting sensitive data is paramount. The contract must define how OpenAI handles your data: the prompts you send and the AI-generated outputs. All inputs and outputs should be treated as your confidential information. OpenAI commits by default not to train on business customer data, but you must cement this in the contract.

Privacy Requirement	What to Negotiate	Why It Matters
Confidentiality	All inputs and outputs treated as your confidential information	Prevents OpenAI from sharing data with third parties or using it beyond service delivery
Retention control	You set data retention policies (including zero retention)	Limits exposure of historical data; supports GDPR “right to be forgotten”
Data Processing Addendum	Signed DPA covering GDPR, CCPA, and sector-specific laws	Legal framework for personal data handling; OpenAI acts as processor on your instructions
Deletion rights	Right to request deletion with written confirmation	Ensures data does not persist after you no longer need it
Sector-specific compliance	HIPAA BAA for healthcare, financial regulation addenda	Without these, processing regulated data is a compliance violation

Clarify who owns what: your inputs to the AI and its outputs. OpenAI’s standard business terms assign you ownership of both inputs and outputs, but you should still nail down the details contractually to avoid ambiguity.

IP Element	Recommended Position	Watch-Fors
Ownership of outputs	You own all AI-generated output based on your prompts	Ensure no broad licence that lets OpenAI reuse your outputs
Ownership of inputs	Your data and content remain your property at all times	OpenAI should not gain any ownership over material you provide
Licence back to OpenAI	Limited licence solely to perform the service	Reject any broad licence allowing other uses of your content
Third-party IP in outputs	Negotiate warranties or indemnities for IP issues	AI may inadvertently generate content similar to copyrighted material

OpenAI has usage policies that enterprise customers must follow. Understand use-case restrictions and ensure they align with your intended AI applications. You want to both comply with OpenAI’s rules and meet your own regulatory obligations.

Respect OpenAI’s usage policies. Review restrictions on reverse engineering, competing model development, and prohibited content generation. Flag any that conflict with your business plans.

Ensure industry-specific compliance. Healthcare requires HIPAA BAA. Finance requires SEC/FINRA awareness. Banking requires data sovereignty controls.

Test high-risk use cases. Legal/medical advice, hiring decisions, and financial planning require human review and accuracy validation before deployment.

Verify geographic and export compliance. OpenAI must follow U.S. export controls. Confirm service availability in all countries where you operate.

Get written clarification on grey areas. If your strategy involves using outputs to improve internal ML models, clarify where the line is and get it in writing.

While OpenAI’s models are largely “black boxes,” you should negotiate for as much insight and transparency as feasible to build trust and meet governance obligations.

Transparency Area	What to Negotiate
Model documentation	System cards, model cards, transparency reports describing capabilities, limitations, biases, and training data scope
Change notifications	Advance notice of significant model updates, algorithm changes, or safety filter modifications, with sandbox testing rights
Audit support	Access to logs of all prompts and outputs; tools or support for offline review and pattern analysis
Bias and ethical assurance	Commitment to bias testing, periodic fairness reviews, content filtering options aligned with your policies
Performance reporting	Monthly reports on model performance, identified risks, and improvement updates

Focus on practical transparency: information that helps you use the model responsibly. Also verify that nothing in the contract prevents you from discussing issues. Some vendors restrict public statements about model performance. As a CIO, you may need to share findings with your board or regulators. Ensure the contract allows you to conduct internal audits and report on them as needed.

Indemnification is your safety net for legal troubles arising from OpenAI’s services. Given emerging legal issues surrounding generative AI, particularly IP claims related to training data, securing strong indemnities from OpenAI is non-negotiable.

Direction	Indemnity Element	Recommendation
FROM OpenAI	IP infringement indemnity	OpenAI defends you if third parties claim the AI’s outputs or training data infringe their copyright, patent, or IP rights
FROM OpenAI	Training data coverage	Indemnity explicitly covers claims arising from the data OpenAI used to train the model
FROM OpenAI	Product liability	OpenAI is accountable if the software itself causes harm due to a defect
FROM OpenAI	Separate or uncapped limits	IP indemnification should not be subject to the general liability cap
YOUR indemnity (narrow)	Breach or misuse only	Only indemnify for your breach of the agreement or misuse of the service. Do not indemnify for claims arising from normal, authorised use.

For enterprise-critical services, you need contractual assurances on availability and performance. Treat OpenAI’s generative AI service as you would any important cloud service and insist on measurable reliability commitments.

SLA Element	Target	Remedy if Missed
Uptime commitment	99.9% monthly (≤45 min downtime/month)	Tiered service credits (e.g. 10% credit if below 99%, 25% if below 98%)
Response latency	Median response under X seconds for standard queries	Infrastructure upgrade commitment or dedicated instance
Support: Severity 1 (critical)	Response within 1 hour, 24/7	Executive escalation; continuous work until resolved
Support: Severity 2 (high)	Response within 4 hours	Dedicated technical contact assignment
Repeated failures	Consecutive months below SLA threshold	Right to terminate without penalty + refund for unused services

Generative AI services can have complex and unpredictable pricing, particularly when usage scales rapidly. The contract must address pricing transparency, flexibility, and safeguards against budget overruns.

Cost Control Mechanism	What to Negotiate
Rate transparency	Full rate card for all models (GPT-4, GPT-4o, etc.), premium features, support tiers, and any hidden charges
Volume discounts	Tiered pricing based on committed monthly spend or token volume, with flexibility to adjust mid-term
Spending caps	Monthly spending cap requiring written approval to exceed; automated alerts at threshold levels
Fixed pricing period	Lock rates for the full contract term. Reject the standard 14-day price change notice; require 60 to 90 days minimum
Unused credit rollover	If prepaying, ensure unused credits roll over or negotiate partial refund clauses
Renewal price caps	Maximum price increase at renewal (CPI-linked or single-digit percentage)
Usage monitoring	Real-time visibility dashboard; proactive alerts if usage exceeds 20% above forecast

Renewal and lock-in management. Given the rapid evolution of AI, manage vendor lock-in risk and negotiate favourable renewal terms. Prefer 1-year initial terms unless longer terms offer significant savings. Require 60 to 90 day renewal reminders and negotiate opt-out at any renewal. Secure data export rights in usable format before account closure. Cap renewal price increases (CPI or single-digit percentage). Use abstraction layers in your integration to swap AI providers if needed. Build relationships, not dependencies.

Security obligations. When entrusting sensitive business information to an AI service, demand the same security standards you would require from any top-tier cloud provider.

Security Requirement	What the Contract Should Include
Encryption	AES-256 at rest, TLS 1.2+ in transit for all customer data
Access controls	Least-privilege access, MFA for OpenAI staff, need-to-know basis only
Certifications	SOC 2 Type II maintained throughout term; right to review audit reports under NDA
Breach notification	Written notification within 24 to 48 hours of discovery, with details and remediation plan
Penetration testing	Regular third-party pen tests; summary of results or warrant that critical vulnerabilities are addressed
Data locality	Specify data residency requirements; notification before data is moved to different jurisdiction
Material breach	Security breach = material breach of contract, triggering termination rights

Customer data use and training opt-out. Ensure that OpenAI does not use your data to train its AI models or otherwise exploit it for its benefit. While OpenAI’s enterprise policy currently excludes business data from training by default, you must cement this in writing.

Additionally: if you engage OpenAI for custom model fine-tuning on your data, the resulting model must be for your exclusive use. OpenAI should not use that data to train any other models or share the model with others.

Liability limits. Limitation of liability determines who bears the financial risk if things go wrong. Vendors try to minimise their liability. Your goal is to ensure OpenAI has enough skin in the game.

Liability Element	Standard Position	What to Negotiate
General cap	12 months of fees paid	Push for 2 to 3 times annual fees, or all fees paid over contract life
IP indemnification	Often uncapped or separate cap	Confirm IP indemnity is separate from and additional to the general cap
Data breach / confidentiality	Subject to general cap	Carve out as exception to the cap. Breach of privacy should carry higher exposure.
Gross negligence / wilful misconduct	Excluded from some limitations	Ensure this is explicitly stated; define what qualifies
Indirect damages	Disclaimed entirely	Try to classify costs to remedy customer impacts as direct damages
Reciprocity	Mutual caps	Ensure your liability to OpenAI is not broader than their liability to you

Termination and exit rights. Even with the best planning, situations may arise where you need to terminate the contract. Negotiate clear exit rights to avoid being trapped.

Termination for cause. Either party can terminate for material breach with 30-day cure period. Critical breaches (confidentiality, repeated SLA failure) allow faster exit.

Termination for convenience. Right to exit with 60-day notice. If not available, ensure contract term is short enough to avoid lock-in.

Regulatory/legal change clause. If a law change makes use of the service illegal or impractical, you can terminate without penalty.

Data retrieval. Export all prompts, outputs, fine-tuning data in usable format before account closure. Written certification of data destruction after.

Transition assistance. OpenAI continues service for 30 to 60 days post-termination to allow smooth migration (at pro-rated cost).

Refund for pre-paid fees. Pro-rata refund if termination is due to OpenAI’s breach. Negotiate partial refund even for convenience termination.

Survival clauses. Confidentiality, IP ownership, indemnities, and liability limits survive termination indefinitely.

Throughout the negotiation, look for contract elements, or omissions, that could cause problems in the future.

Red Flag	What It Means	What to Do
Data usage loopholes	Any clause suggesting OpenAI could use your data beyond serving you, or silence on data usage	Insist on explicit protection
Missing confidentiality clause	No NDA or confidentiality section protecting your information	Unacceptable for enterprise. Add immediately.
One-sided change rights	OpenAI retaining broad freedom to modify the agreement, service, or pricing with minimal notice	Negotiate mutual consent or long notice periods
No SLA or vague SLAs	“Best effort” availability with no measurable commitment and no remedies	Require specific uptime targets and credit remedies
No vendor indemnity	Contract lacks IP infringement indemnification from OpenAI	You are exposed to third-party claims. Negotiate indemnification.
Overly restrictive usage terms	Broad or ambiguous restrictions that could prevent legitimate business use of outputs	Flag and clarify before signing
Uncapped your liability, capped theirs	Asymmetric liability provisions where OpenAI has minimal accountability	Demand reciprocity
Vendor termination for convenience	OpenAI can drop you without cause	Negotiate out or require long notice + refund
Hidden costs	Fees for support, overages at high rates, premium features, or storage buried in fine print	Demand full rate card transparency

Related Resources