What are you trying to do?
Tap the path that fits your situation — each routes to the right flat-fee package.
Or scroll to the package details below.
Four flat-fee packages — full detail
Same options as the routes above, with deliverable lists and turnaround. Many SaaS clients start with the AI Use Addendum if they already know procurement is asking for it, or the diagnostic memo if they are unsure which package fits.
Diagnostic — AI Legal Stack Case Evaluation
Written attorney evaluation of your AI footprint and the legal exposure it creates. Use this when you are not sure which package fits.
- Inventory of AI providers, integrations, and data flows
- Gap analysis against the five AI legal layers (vendor / training / addendum / privacy / risk)
- Regulatory exposure summary (EU AI Act, California ADMT, Colorado AI Act, FTC § 5)
- Prioritized remediation plan with pricing for each next step
- One follow-up round of email Q&A
AI Vendor Contract Review
Before integrating OpenAI, Anthropic, Google, AWS Bedrock, Azure OpenAI, or any other AI vendor, get the contract reviewed for the clauses that hurt you.
- Review of one major AI vendor agreement
- Indemnification scope and IP risk analysis
- Training-data carve-outs and customer-data protections
- Liability cap analysis and material deal-killer flags
- Recommended addendum language to push back with
- Negotiation strategy memo
Recommended — AI Use Addendum + DPA Update
The clauses your customer agreement is missing if you ship AI features. Procurement teams ask for these by name. The single highest-leverage package for any SaaS adding AI.
- AI Use Addendum bolted onto your existing MSA / TOS
- Updated Data Processing Addendum with AI sub-processor language
- Customer-data-not-used-for-training clause
- Output ownership and IP-assignment language
- Hallucination and accuracy risk disclosures
- Human-review and customer-responsibility clauses
- CCPA / GDPR alignment
AI Training-Data Audit
For companies building or fine-tuning models. Review what your AI is being trained on and flag IP, privacy, and contractual exposure.
- Training-data source inventory and license review
- Public-web scraping risk analysis
- Customer-data usage audit (was it permitted?)
- Open-source dataset license review (CC-BY, Apache, restrictive)
- CCPA / GDPR / EU AI Act alignment
- Written audit memo with prioritized remediation list
Who this is for — and who it isn't
This is for you if:
- B2B SaaS adding AI features (chat, summarization, generation)
- Companies integrating OpenAI, Anthropic, or Perplexity into customer-facing products
- Teams hitting "no AI / explain AI usage" questions in enterprise procurement
- AI startups training or fine-tuning their own models
- Vertical SaaS (healthcare, fintech, legal) where AI features have regulatory implications
This isn't for you if:
- Pure consumer-facing AI apps (different liability and ToS regime)
- Companies that need ongoing AI compliance (use the Fractional CLO Hub)
- EU-AI-Act high-risk system designers (specialty firm work)
- AI deepfake / generative content platforms (different liability frame)
What to send with your first email
You do not need to organize everything perfectly. The fastest way to evaluate the matter is to send the core documents and a short timeline.
- AI footprint: which AI providers you use (OpenAI, Anthropic, Google, AWS, Azure), which models, and what they do in your service.
- Vendor contracts: the AI provider agreements you have signed (or are about to sign).
- Current legal stack: your MSA / TOS, Privacy Policy, DPA. The AI Use Addendum builds on these.
- Training-data plan: if you train or fine-tune, what data sources you use, what licenses you have, and what consents are in place.
- Customer profile: SMB / mid-market / enterprise; sector (healthcare / financial / education / general); geographic distribution.
- Specific concern: a vendor contract redline, an enterprise customer demanding AI compliance, a privacy update, an investor diligence list, or a general AI legal-stack audit.
- Your goal: what outcome are you looking for — a written legal evaluation, a contract draft, a demand letter, a filing, ongoing advisory, or something else.
My approach
AI legal work changes weekly. I keep up with the new guidance so you don’t have to.
Send your stack
Existing customer agreement, current DPA if any, the AI vendor contract, and a one-paragraph description of what your AI feature does (input, output, retention).
I draft and review
Within 5-10 business days I deliver the addendum, the vendor markup, or the training-data audit memo — depending on package.
Roll out
You wire the addendum into your signup flow or send the markup back to the AI vendor. I support enterprise procurement questions for 30 days post-delivery at no extra cost.
Before you contact me or take action
- Do not start using customer data for training without an AI Use Addendum or explicit MSA carve-out. Most enterprise MSAs prohibit training; using customer data anyway is a breach.
- Do not deploy AI features without updating the Privacy Policy. Automated decision-making, training data sources, and third-party AI provider disclosures are required disclosures under multiple privacy regimes.
- Do not assume your AI vendor's indemnification covers everything. Most cover IP infringement on output; few cover privacy breaches, security incidents, or model bias.
- Do not market AI capabilities you cannot substantiate. FTC Act § 5 enforcement on deceptive AI claims is active; "AI-powered" needs to mean something.
- Do not skip the model card / system card. Enterprise customers, regulators, and acquirers all want documented model behavior. The investment is small and the upside is large.
Recent client results
"Microsoft procurement asked for our AI Use Addendum by name in security review. We had it. Deal closed."— AI startup, $2,000 package enterprise deal closed
"Sergei flagged that our OpenAI agreement had a training-data clause that would have killed our enterprise pitch. We pushed back, OpenAI removed it."— AI vendor review client
"Training-data audit caught two licensed datasets we were using outside the license terms. Saved us a future copyright suit."— AI infrastructure startup remediated $50K+ in exposure
Why work with me
Sergei Tokmakov, Esq.
I have been a California-licensed business attorney since 2011 and have spent the last three years deep in AI legal work — both as outside counsel for SaaS companies and as the operator of an AI-driven legal-content platform (Terms.Law) that uses GPT and Claude in production.
I track the EU AI Act, CCPA AI rulemaking, NY State AI bills, and federal copyright/training-data developments week by week, so the addendums I deliver reflect what procurement teams are actually asking for right now.
Frequently asked questions
What’s the difference between the AI Use Addendum and a normal DPA?
A standard DPA covers data processing, subprocessors, security, and breach notification. The AI Use Addendum specifically addresses AI-feature behaviors: training data, output ownership, hallucination risk, human review, and the customer’s responsibility for AI-assisted outputs. Most enterprise procurement teams now require both.
Do I need this if I’m only using OpenAI on the back end?
Yes. The fact that your customer’s data hits OpenAI’s API is itself a procurement question. The addendum covers the subprocessor disclosure, the training-data opt-out (OpenAI does honor this for API customers but you have to flow it through), and the customer’s right to know what AI is doing with their data.
How does this interact with the EU AI Act?
The EU AI Act categorizes AI systems by risk. Most B2B SaaS AI features are minimal-risk or limited-risk and require disclosure obligations rather than registration. The addendum I draft satisfies those disclosure obligations and flags any high-risk classification that might apply.
Can I get just the vendor contract review without the addendum?
Yes. The vendor review is a standalone $1,500 engagement. Most companies hit the addendum question first because procurement asks for it before vendor integration even comes up.
What about California’s SB 1047 / pending AI bills?
California’s AI rulemaking is in flux. The addendum is built to be forward-compatible with the most likely outcomes (disclosure, training-data restrictions, audit rights). When a California bill passes, I update the template and offer existing clients a free re-issue.
My AI vendor sent me terms. Can you redline them?
Yes — that’s the AI Vendor Contract Review package, $1,500. Includes redline + negotiation strategy memo.
The five legal layers of AI implementation
- Vendor contracts. OpenAI, Anthropic, Google, Mistral, Cohere, AWS Bedrock, Azure OpenAI Service. Each has its own data-use, training, output-ownership, indemnification, and shutdown-risk profile. The vendor contract review identifies which terms are deal-breakers and which are negotiable for an enterprise customer.
- Training-data sourcing and rights. Where does the training data come from? Public scraping has copyright, privacy, ToS-violation, and CFAA exposure. Licensed corpora reduce exposure but increase cost. User-contributed data needs explicit consent. The AI Implementation Legal Hub addresses each path.
- Customer-facing AI Use Addendum. Bolted onto the existing MSA / TOS, the AI Use Addendum addresses input ownership, output ownership, training restrictions on customer data, AI-generated output indemnification, and disclosure of third-party AI use. Required once AI features go live to enterprise customers.
- Privacy and regulatory compliance. California ADMT, NYC AEDT, Colorado AI Act, EU AI Act, FTC Act § 5 (deceptive AI claims), copyright law, biometric privacy laws (BIPA in Illinois). Each adds a compliance layer that depends on what the AI does and who the users are.
- Risk and incident response. AI systems hallucinate, leak data, propagate bias, generate copyright-infringing output, or fail safely. The implementation framework includes risk assessment, escalation procedures, customer-notification protocols, and a documented model-card / system-card for each deployed model.
Six AI implementation scenarios that often require legal work
Scenario 1: Adding a chat / generative-AI feature to an existing SaaS
Existing product gains a "chat with our docs" or "generate content" feature powered by OpenAI / Anthropic. The MSA, TOS, and Privacy Policy do not contemplate AI processing, training, or output. The fix: AI Use Addendum bolted onto MSA / TOS, Privacy Policy update, vendor contract review for the AI provider, and a model-card describing the system.
Scenario 2: Building an AI product from scratch
The product is AI-native (a coding assistant, a workflow agent, a vertical-AI app). Legal stack needs to be built from the ground up: TOS / MSA with AI-specific carve-outs, Privacy Policy with training and inference disclosures, AUP that addresses AI-generated content abuse, vendor contracts for the underlying models, and a documented training-data sourcing record.
Scenario 3: Enterprise customer requires AI compliance certifications
Customer's procurement team requires SOC 2, ISO 27001, ISO 42001 (AI management), AI risk assessment, model card, and red-team report. The work is preparing the documentation and providing legal cover for the certifications.
Scenario 4: Vendor contract review for an AI provider
The company is signing an OpenAI Enterprise, Anthropic, or other AI provider. The vendor contract has terms on data use (usually no training on inputs by default for enterprise tiers, but verify), output ownership, indemnification (most providers indemnify against IP claims now), uptime, and termination. The review identifies which terms need negotiation and which are acceptable.
Scenario 5: Training-data audit before fundraising or acquisition
Investors or acquirers ask: where did the training data come from, what licenses do you have, what is the copyright exposure, what is the privacy exposure. The audit produces a documented chain of custody for the training corpus, identifies gaps, and provides remediation paths.
Scenario 6: AI-related dispute or incident
Customer claims AI output infringed their copyright, leaked their data, or made a decision they consider unlawful. The response: incident-response playbook, customer notification, vendor-indemnification activation, documentation review, and dispute-resolution path under the contract.
First-30-days action checklist for AI legal-stack implementation
- Inventory the AI footprint. Which models / vendors / APIs are integrated. Where is each used. What customer data flows through.
- Pull every AI-related vendor contract. OpenAI, Anthropic, Google, AWS, Azure. Confirm data-use, training, output-ownership, and indemnification terms.
- Document the training data. If you train models, document the sources, licenses, consents, and any opt-out / removal mechanisms. If you fine-tune third-party models, document the fine-tuning data.
- Update or draft the AI Use Addendum. Bolted onto the MSA / TOS. Specifies input ownership, output ownership, training restrictions on customer data, AI indemnification, and disclosure of third-party AI providers.
- Update the Privacy Policy. Add AI processing disclosures, training-data disclosures, automated decision-making rights (California ADMT, GDPR Art. 22), and applicable state-AI-law disclosures.
- Build the model card. One-page per deployed model: provider, version, training-data summary, intended use, known limitations, evaluation results.
- Set up the incident-response playbook. Procedures for AI hallucinations, data leakage, customer complaints, regulator inquiries, and copyright claims.
- Calendar the regulatory tracking. AI law is moving fast. EU AI Act, California ADMT, Colorado AI Act, NYC AEDT, FTC enforcement. Quarterly review and update.
Related resources I've written
SaaS Legal Package
For the full SaaS document stack including AI clauses.
Healthcare SaaS Legal Package
For HIPAA-regulated AI implementations.
Contract Review
Single AI vendor contract review starts at $349.
Software Lawyer
EULA, OSS license audit, IP work for software products.
Fractional Chief Legal Officer
For ongoing AI compliance and governance work.
Free interactive tools
Free, no email signup, no popup.
AI Vendor Contract Risk Score
Tap the terms in your AI provider contract. The output flags red flags vs acceptable terms.
AI Use Addendum Need-Detector
Do you need an AI Use Addendum bolted onto your MSA / TOS? 6 questions.
AI Regulatory Coverage Checker
Which AI laws apply to your service? EU AI Act, California ADMT, Colorado, NYC, FTC, sector overlays.
AI Vendor Contract Risk Score
Tap each term that is in your contract with an AI provider (OpenAI, Anthropic, Google, AWS, Azure, etc.).
AI Use Addendum Need-Detector
Tap each that applies to your service.
AI Regulatory Coverage Checker
Tap each that applies.
Ship AI features without procurement blocking the deal.
AI Use Addendum + DPA $2,000. Vendor review $1,500. Training-data audit $2,500. Pick the one that matches what you’re actually shipping.