Legal Counsel for Companies Building and Deploying AI

Technology executive reviewing an AI product on a tablet

AI legal risk now reaches product design, customer contracts, vendor procurement, privacy, intellectual property, employment, and corporate governance. Sutter Law advises companies that build AI products and companies that deploy third-party AI tools across their operations.

Our work focuses on turning technical use cases into practical legal controls: defining permitted data use, allocating ownership and infringement risk, setting customer promises, reviewing vendors, and building governance that can adapt as products and regulations change.

Leadership team meeting to set an AI governance policy

AI Governance Programs

An AI governance program gives a company a repeatable process for deciding which tools and use cases are acceptable. We help companies establish internal AI policies, approval processes, risk classifications, documentation standards, and escalation procedures appropriate to the business.

Governance can also define who owns AI decisions internally, when legal or security review is required, and what information should be reported to management or the board.

Internal AI acceptable-use policies
Use-case and vendor review procedures
Risk classification and approval workflows
Board and management reporting
Employee training and documentation

AI Vendor and Model Provider Agreements

AI vendors often seek broad rights to customer inputs, prompts, usage data, or feedback. We review and negotiate provider agreements with attention to training rights, confidentiality, data retention, security, service commitments, output rights, indemnification, and liability allocation.

The goal is to align the contract with how the company will actually use the tool, especially where customer data, source code, personal information, or confidential business information may be involved.

Executive reviewing an AI vendor agreement on a tablet

Customer using an AI chat assistant on a smartphone

Customer Contracts for AI Products

Companies selling AI-enabled products increasingly face customer questions about model behavior, training data, output ownership, infringement risk, privacy, security, and human oversight. We draft and negotiate AI-specific contract terms that accurately describe the product without making promises the technology cannot reliably support.

We also help reconcile AI terms with the company’s existing MSA, DPA, security addendum, acceptable use policy, and product documentation.

Training Data, Customer Data, and Data Rights

Data rights are central to AI contracting. We help companies determine what data they may use for training, fine-tuning, evaluation, analytics, and product improvement, and then reflect those decisions in customer and vendor contracts.

Where third-party datasets, licensed content, or customer materials are involved, we review sourcing and license restrictions and help document the chain of rights.

AI Intellectual Property and Trade Secrets

AI products raise difficult ownership questions involving models, prompts, code, datasets, outputs, and employee-created materials. We help companies structure IP ownership and licensing provisions, protect proprietary methods and confidential information, and address AI use in invention-assignment and contractor agreements.

AI Privacy and Regulatory Compliance

AI systems may trigger privacy and sector-specific obligations depending on the data, users, geography, and use case. We coordinate AI governance with privacy programs, including CCPA/CPRA and GDPR requirements, and evaluate sector rules where applicable.

For companies operating internationally, we help map contractual and governance requirements to the markets in which the product is offered or deployed.

Healthcare professional using an AI system subject to privacy and sector rules

AI Due Diligence in Financings and M&A

Investors and acquirers increasingly examine AI assets and practices during diligence. We help companies prepare by reviewing data rights, model-provider terms, IP ownership, privacy compliance, customer commitments, and governance records before a financing or sale.

Why Companies Choose Sutter Law

Experienced Business Counsel

Our attorneys work on the corporate, financing, commercial, and transaction issues that arise as private companies grow, allowing related issues to be handled in a coordinated way.

Direct Attorney Involvement

Clients work directly with the attorneys responsible for the matter. The team is structured to keep senior lawyers involved rather than passing routine responsibility through multiple layers.

Bay Area and California Focus

We serve companies, founders, investors, and owners throughout the Bay Area and California, while regularly handling matters involving Delaware entities, national counterparties, and international operations.

Practical, Transaction-Oriented Advice

We focus on the legal issues that affect economics, control, timing, and execution, and coordinate with tax, accounting, financial, and other advisors when a matter crosses disciplines. Companies that want ongoing support can also work with us as outside general counsel.

Frequently Asked Questions

Do we need an AI policy?

If employees use AI tools with company, customer, source-code, or personal data, an internal policy can define permitted use and reduce confidentiality, IP, privacy, and security risk.

What should we look for in an AI vendor contract?

Key issues include data use and training rights, confidentiality, retention, security, output ownership, infringement allocation, indemnification, service terms, and liability caps.

Who owns AI-generated output?

The answer depends on the tool terms, the underlying inputs, applicable law, and the parties’ contracts. Companies should avoid assuming that a provider’s terms alone resolve all ownership and infringement questions.

What AI laws apply to our company?

It depends on where the company operates, the type of AI system, the data involved, and the use case. We map the applicable rules and then align contracts, policies, and product processes with them.

What do investors look for in AI diligence?

Common issues include ownership of code and models, rights to training data, vendor restrictions, privacy compliance, customer representations, security practices, and whether the company can substantiate claims about its technology.

AI Legal Services Legal Resources from the Sutter Law Blog

Our attorneys publish practical guidance on corporate, financing, transaction, employment, privacy, intellectual property, and business-law issues. Recommended reading on AI:

Ready to Talk?

Building or deploying AI? Schedule a consultation or call 415-341-2888.

Schedule a Consultation