Insert these clauses into vendor and integrator agreements covering AI systems. Standard software licence agreements do not satisfy Pillar 01 requirements. Legal review is recommended before execution. Adapt bracketed fields to match your actual arrangements.
1. Parties
Client (Deployer)
[Organisation Name] (ABN [XX XXX XXX XXX]), of [Address]
Vendor / Integrator
[Vendor Name] (ABN [XX XXX XXX XXX]), of [Address]
2. AI System(s) Covered by This Agreement
System name(s) and version(s)
[System name, version, deployment environment, intended use case]
3. Vendor Obligations
- Provide documentation of pre-deployment testing results, including accuracy, bias, robustness, and security assessments, within [30] days of contract execution.
- Disclose known limitations, failure modes, and edge cases of the AI system in writing before deployment.
- Report any material changes to the underlying model, training data, or system architecture within [14] days of such changes.
- Notify the Client of identified security vulnerabilities within [72] hours of discovery.
- Confirm data residency and processing location for all Client data processed by the AI system.
4. Client Obligations
- Deploy the AI system only for the use cases disclosed to the Vendor and assessed for compliance with this agreement.
- Maintain a named accountable official responsible for oversight of the AI system throughout its operational lifecycle.
- Ensure all personnel operating the system have completed the required AI literacy training prior to use.
- Report suspected system failures or adverse outcomes to the Vendor within [48] hours of detection.
5. Incident Reporting
Notification obligation and timeframe
[Both parties agree to notify the other within [24/48/72] hours of any AI system incident that results in or may result in: harm to a person; a data breach; a material operational failure; or regulatory notification obligations. Specify escalation contacts for each party.]
6. Liability Allocation
Allocation of liability between parties
[Specify which party bears liability for: model error; deployment error; data quality issues; integration failures; and consequential loss. Seek legal review.]
7. Execution
Client — Authorised Signatory
[Name] · [Title] · [Date]
Vendor — Authorised Signatory
[Name] · [Title] · [Date]