Most negotiations here waste their energy on the liability cap. The cap is close to irrelevant — no number a software vendor will accept is sized for a deal-scale loss, and pushing it from one year's fees to two changes nothing about your real exposure. The clause that actually matters is the one nobody reads carefully: whether AI output is carved out of the warranties that cover the rest of the product.
Why the cap is the wrong fight
A screening subscription might cost five figures. A missed change-of-control provision in a mid-market acquisition can cost seven. Even an uncapped indemnity is worth only what the vendor's balance sheet can satisfy, and in this category that is usually not much.
So the realistic goal of the negotiation is not to transfer deal risk. It cannot be transferred. The goal is narrower and achievable: make sure the vendor stands behind what they sold, disclose what it cannot do, and preserve your ability to reconstruct what happened. Those are winnable, and they matter more.
The carve-out, which is where the real risk sits
Read the warranty section and then read the exclusions. A common structure warrants that the software will perform materially in accordance with documentation — and then excludes, in a separate clause, any warranty as to the accuracy, completeness or fitness of AI-generated output.
Read together, that warrants the delivery mechanism and disclaims the product. It is the equivalent of warranting that the printing press works while disclaiming the words.
What to push for, in descending order of achievability:
- Remove the blanket AI-output exclusion. Often refused outright, but the refusal itself is informative.
- Warrant the mechanical properties instead. Far more achievable and nearly as useful: that quoted source text accurately reproduces the source document; that coverage reporting accurately reflects what was processed; that documents reported as processed were in fact processed in full. These are verifiable, non-probabilistic claims about system behaviour — not promises about judgment quality — and a vendor who will not stand behind even these is telling you something.
- A disclosure warranty. That the vendor has disclosed known material limitations — length ceilings, unsupported formats, languages handled poorly. This converts silent truncation from your problem into theirs.
The four indemnities worth naming separately
| Indemnity | Covers | Realistic? |
|---|---|---|
| IP infringement | Third-party claim that the tool or its output infringes | Yes — standard, and increasingly offered uncapped by larger vendors |
| Confidentiality breach | Vendor or subprocessor discloses your deal documents | Yes — push hard, this is squarely their control |
| Data protection | Regulatory exposure from their processing | Yes, where personal data is in scope; pair with a DPA |
| Output accuracy | Loss from a wrong or missed finding | No. Nobody offers this. Stop asking and negotiate elsewhere |
The first three are genuinely negotiable and cover risks within the vendor's control. The fourth is not available from anyone, and the reason is structural rather than stingy: grounded commercial legal AI has been measured hallucinating between 17% and 33% of the time in an adjacent task, with providers' hallucination-free claims found to be overstated.[1] No vendor can insure against an error rate nobody has eliminated.
Terms that protect you better than any indemnity
These are cheaper to obtain and worth more, because they change your position when something goes wrong rather than promising money afterwards.
Model versioning and run-record retention
If the system that produced last quarter's report no longer exists, you cannot reconstruct how a conclusion was reached — and reconstruction is what makes reliance defensible. Require versioned models, retention of run records for a stated period, and the ability to export them. This is the single most valuable non-monetary term available.
Contractual training prohibition, with flow-down
Not a policy page. A term, binding the vendor, subprocessors and the underlying model provider, with no carve-out for telemetry, evaluation sets or human review of outputs — which is where content usually escapes.
Named subprocessors and change notification
Several parties see your documents. A vendor who cannot name them has not mapped their own data flow.
Coverage-limit disclosure
Document length ceilings, unsupported formats, OCR behaviour on scanned files. You cannot manage a limit you were not told about, and silent truncation on the longest document in the room is a common and expensive failure.
Deletion on termination
With a stated timeline and an answer about backups. Deal documents stop being needed at close and become pure exposure afterwards.
Exit and export
Your findings, overrides and run records in a portable format. Otherwise switching vendors means abandoning the audit trail you built.
The clause that quietly matters: your own override record
Make sure nothing in the agreement prevents you from retaining, exporting and relying on your own reviewers' overrides — what was flagged, what your team concluded, and why.
That log is the evidence professional judgment was applied. When a miss is investigated, it is the difference between “the system did not flag it” and “it scored below the escalation threshold we set in advance, and a named reviewer signed off.” The first sentence sounds like abdication. The second describes a managed process, and it is worth more than any indemnity you will be offered.
Why the duty makes all of this secondary
ABA Formal Opinion 512 (29 July 2024) holds that lawyers using generative AI must “fully consider their applicable ethical obligations,” including competence and supervisory responsibility.[2] That duty is non-delegable. No contractual term moves it, and no vendor attempts to accept it.
Which is the honest frame for this whole negotiation: you are not buying protection from the consequences of a miss. You are buying disclosure, reconstructability and control over your own data — the things that let you demonstrate a managed process when a miss happens. Negotiate for those and you will get most of them. Negotiate for the cap and you will get a number that does not matter.
A negotiating order that works
- Training prohibition with flow-down. Non-negotiable. Walk if refused.
- Confidentiality indemnity. Squarely their control; push hard.
- Model versioning and run-record retention. Cheap for them, worth the most to you.
- Coverage-limit disclosure warranty. Converts silent truncation into their problem.
- Remove or narrow the AI-output warranty carve-out. Fall back to warranting mechanical properties.
- IP indemnity. Usually offered; take it.
- The cap. Last, and do not spend leverage here.
Bottom line
Nobody will indemnify you for a wrong finding, so stop negotiating for it. Spend your leverage on the warranty carve-out, on versioning and record retention, on the training prohibition, and on disclosure of what the system cannot do.
And check your professional indemnity policy for an AI exclusion before the deal rather than after the claim — a short call to your broker that occasionally produces a very unwelcome answer.
Sources
- Magesh, V., Surani, F., Dahl, M., Suzgun, M., Manning, C. D., & Ho, D. E. Hallucination-Free? Assessing the Reliability of Leading AI Legal Research Tools. arXiv:2405.20362; Journal of Empirical Legal Studies (2025). Measures legal research, not document review — see the scoping note above. arxiv.org/abs/2405.20362
- ABA Standing Committee on Ethics and Professional Responsibility, Formal Opinion 512: Generative Artificial Intelligence Tools, 29 July 2024. americanbar.org
Nothing here is legal advice; have your own counsel review any agreement. We cite only sources we have retrieved and read — see our methodology.