Customers and regulators now ask how AI products use data. We set out what data you can train on, how customer data is handled, and what users may and may not do with your model. The result is a set of policies and contract terms you can show to an enterprise buyer.
At a glance
- Practice
- Privacy
- Pricing
- Flat fee, quoted before we start
- Included
- 6 deliverables
- Process
- 3 steps, one named attorney
- Where we work
- Slack, email or a call
When founders call us
The moments that usually bring a company to us for this work.
- 01
You want to train or fine-tune models on customer data and need the rights to do it
- 02
An enterprise customer's security review asks about your AI data practices
- 03
You are launching a generative AI feature and need an acceptable use policy
- 04
You are selling into the EU or a US state with AI-specific rules
What you get
Scoped in writing before we start. One flat fee for all of it.
- Review of the data sources you use for training, fine-tuning and evaluation
- Customer contract terms on training rights, opt-outs and data retention
- Acceptable use policy for your AI features
- Internal AI governance policy covering approved tools, review and incident handling
- Disclosures for your privacy policy and product terms about AI features
- Summary of AI-specific laws that may apply based on your use cases and markets
How it works
- 1
Use-case review
We go through how your product uses models and data, including third-party model providers.
- 2
Policy and terms
We draft governance policies, customer terms and user-facing disclosures.
- 3
Rollout
We walk your team through the policies and how to answer customer questions about them.
Mistakes we help you avoid
The ones we see most often, and catch before they cost you.
- Avoided
Training on customer data your contracts or privacy policy do not permit you to use that way
- Avoided
Using third-party model APIs under terms that conflict with what you promised customers
- Avoided
No acceptable use policy, leaving you without a basis to stop misuse of your product
- Avoided
Overstating what your AI can do in marketing, which can draw consumer protection scrutiny
AI & Data Governance: questions founders ask
Only if your contracts and privacy disclosures give you the right to, and the use fits applicable privacy laws. Enterprise customers often negotiate this point closely. Many companies offer an opt-out or train only on de-identified or aggregated data.
It sets the rules for how users may use your AI product, such as banning illegal content, impersonation or attempts to extract the model. It gives you a contractual basis to suspend accounts that misuse the product. It usually sits alongside your terms of service.
It can, if you place AI systems on the EU market or their output is used in the EU. Obligations depend on how the system is classified, with stricter rules for high-risk uses. Many startups have limited obligations, but the analysis depends on your use case.
It is increasingly common, especially once enterprise customers ask about it. A short policy covers which AI tools staff may use, what data may go into them, and who approves new uses. It helps prevent confidential data from ending up in third-party tools.
Get a flat-fee quote for AI & Data Governance.
A short call with an attorney. You leave with a written scope and one fixed price.
Book a call