What should my AI product terms of service cover?

Why AI products need their own terms

General terms of service were written for software that does the same thing every time. AI features raise questions those terms don’t answer: what happens to the data customers put in, who can use what comes out, whether you train on it, and who’s responsible when the output is wrong. Business customers ask these questions in procurement, and consumers increasingly do too.

AI terms usually sit inside your SaaS agreement or terms of service as a dedicated section, or as separate AI terms that the main agreement incorporates.

Who owns the inputs?

The customer should keep ownership of what it submits: prompts, documents, data and files. Your terms then grant you a licence to use inputs to provide the service, and for anything else you name. Customers will read that licence closely, so keep it as narrow as your product allows.

Add a promise from the customer that it has the rights to submit the input, including any personal information, and that it won’t upload what your acceptable use policy prohibits.

Who owns the output?

As between you and the customer, the terms usually assign or license output to the customer. That’s a contract allocation, not a guarantee that the output is protected by copyright. Canadian law hasn’t settled whether, or when, AI-generated material has an author or owner under the Copyright Act, and the federal government has consulted on the question without changing the Act.

Good terms also say that output may not be unique (another user could get similar output), and that you don’t promise output is free of third-party rights unless you offer an indemnity for it.

Can we train on customer data?

Only if your terms and privacy policy allow it, and personal information is handled as privacy law requires. Under PIPEDA, using personal information for a new purpose, such as training a model, generally needs consent for that purpose, and the OPC’s generative AI principles stress that people should understand how their information is used.

Common approaches:

• No training on customer content, which many business customers will ask for anyway.
• Opt-in training, with a clear setting or contract term.
• Opt-out training for consumers, disclosed plainly at sign-up, with consent being express for sensitive information.
• Aggregated or de-identified usage data used to improve the service, defined carefully, since data that can be re-identified is still personal information.

Whatever you choose, make the terms, the privacy policy and the product settings say the same thing. See AI training data and web scraping in Canada.

Accuracy, disclaimers and human review

AI output can be wrong, incomplete or out of date. Your terms should say so clearly, tell users to review output before relying on it, and exclude uses where an error could cause serious harm unless your product is designed for them.

A disclaimer in the terms doesn’t cure marketing that says the opposite. The Competition Act prohibits materially false or misleading representations to the public, and section 74.01 lets the Competition Bureau pursue them civilly. Claims about what your AI can do, how accurate it is, or that it’s “AI-powered” at all should be ones you can back up.

Acceptable use

An AI acceptable use policy lists what users may not do: generate unlawful or harmful content, impersonate people, try to extract training data or model weights, get around safety limits, or use the product for decisions it isn’t built for. Also include the restrictions your model provider imposes on you, because their usage policy usually requires you to pass those on. Keep the policy enforceable: reserve the right to suspend accounts, and actually monitor for misuse.

Third-party models

If your product calls a third-party model, your terms should line up with that provider’s terms:

• Disclose that a third-party provider processes inputs, and list it as a sub-processor where personal information is involved.
• Check where the provider processes data, and whether it keeps or trains on API inputs.
• Don’t promise customers more than your provider promises you on uptime, data retention or IP.

Automated decisions about people

If your product uses personal information to make a decision about someone based exclusively on automated processing, such as approving an application or ranking candidates, Quebec’s private-sector privacy law (section 12.1) requires the business to tell the person and, on request, explain the information and principal factors used. If your customers use your product this way, your terms should say who gives that notice.

Is there an AI law in Canada?

Not a general one yet. The proposed Artificial Intelligence and Data Act was part of Bill C-27, which died when Parliament was prorogued in January 2025. Existing law still applies to AI products: privacy law, consumer protection, the Competition Act, human rights law and sector rules. For chatbot and social products, see Bill C-34, the Safe Social Media Act, which is a proposal, not law.

Consumer and business versions

Consumer terms need plainer language and can’t rely on some limits that work between businesses, and consumer protection law may apply. Business terms usually carry a data processing agreement, negotiated liability caps and more specific training commitments. Many AI companies need both.

What to do next

1. Map how data flows through your AI features: what goes in, which models see it, what’s kept and for how long.
2. Decide your training position and make the product settings match.
3. Write AI terms covering inputs, outputs, training, accuracy and acceptable use.
4. Update your privacy policy to match.
5. Check your marketing claims against what the product actually does.

We prepare AI product terms covering inputs, outputs, training use and acceptable use at a fixed fee shown on our fees page, also available in the launch pack with terms of service and a privacy policy. See also AI and SaaS contracts and what contracts a software startup needs.

This guide is general information about Ontario and Canadian law, not legal advice for your situation. To talk through your AI product, book a free 15-minute consult.