AI procurement in Australia: trends, risks and what to expect in 2026

As is the case with most technology procurement contracts, documenting the scope of what is being provided by an AI solution is critical. Poorly defined functionality or deliverables can lead to misaligned expectations and disputes about performance.

Ways to manage risk include:

• defining clear, measurable objectives for the customer’s business and AI solution;
• setting out detailed functional specifications, including as they relate to the AI models or technologies which are being deployed;
• aligning deliverables with agreed objectives and specifications to ensure customers receive the full and intended benefit of the contract;
• implementing governance mechanisms to monitor performance and success metrics, ensuring that the right personnel have input on technical and commercial elements of procuring the AI solution; and
• including change control processes to manage evolving AI capabilities during the contract term. 

Ongoing dependency on AI solutions can create business risk. For customers, this can include leverage over future pricing, limited flexibility to transition to alternative solutions, limited rights in any embedded technology moving forward and constraints on producing similar outputs.  

Ways to manage this risk include:

• clear pricing adjustment mechanisms for the contract term and renewal periods;
• transition-out arrangements addressing ownership and use of data, outputs, artefacts and assets, pricing, timeframes and resourcing; and
• clearly defining IP ownership and usage rights for relevant components of the AI solution, including inputs, outputs and embedded technology.

Negotiations frequently focus on who owns, and how datasets, inputs and outputs may be used. 

Vendors often seek rights to use customer data to improve or train AI systems, and rights over derived datasets.  

Way to manage this risk include:

• clearly defining ‘data’ and identifying ownership or usage rights;
• recognising that data may include prompts, fine-tuning of prompts, personal information, commercially sensitive information and outputs (e.g. data derived from inputs);
• distinguishing between intellectual property rights in data and rights in underlying algorithms used to implement an AI solution, which vendors are less likely to provide rights or access to;
• considering whether traditional contracting concepts such as ‘Background IP’, and ‘Developed IP’ are appropriate solutions;
• establishing contractual controls based on agreed ownership and permitted uses (noting where ownership by one party is not conceded, often a right to use and access by the other party is just as valuable); and
• including targeted audit or reporting rights if vendors use customer data for training or improvement. 

AI vendors often operate across multiple jurisdictions and may offer different degrees of privacy and data security protections. 

Businesses should consider key AI security issues like where data is hosted, how it is processed, what safeguards apply, as well as potential manipulation of input data. 

Ways to manage this risk include:

• assessing whether data can be hosted and processed in Australia;
• where data is transferred offshore, assessing applicable legal protections and compliance with Australian Privacy Principle 8 under the Privacy Act 1988 (Cth), which generally requires the overseas recipient of data to agree to comply with the Privacy Act 1988 (Cth);
• ensuring internal technical teams understand which third parties process customer data;
• conducting appropriate due diligence on vendors and sub processors; and
• undertaking collaborative privacy impact assessments to understand data flows and security controls. 

Risk allocation is often a key negotiation point between AI vendors and customers. 

Customers should first identify the specific risks they want to manage, such as hallucinations, accuracy limitations or data security issues. 

Ways to manage risk include:

• higher liability caps for high-risk heads of liability such as data breaches, fraud, third party IP infringement and confidentiality breaches;
• clear definitions of what types of loss or damage are recoverable and what is out of scope (eg indirect or consequential loss). In AI procurement agreements, this may turn on items such as loss of data, loss of profits, loss of goodwill or remediation costs;
• a combination of warranties to set clear performance and quality baselines, indemnities for specific high-impact risks (including those heads of liability above) and service level commitments; and
• appropriate insurance policies to cover any excess loss, including cybersecurity and technology errors and omissions insurance with AI-specific liability endorsements.

Transition-out arrangements help ensure a smooth and predictable handover of services, data, assets and knowledge, to reduce disruption, additional cost and operational risk for customers at the end of the contract. 

Effective provisions may include:

• clear post-contract rights to datasets, (raw and processed), prompts, algorithms, assets and other artefacts, and considering whether these need to be transferred to a new provider;
• provisions addressing knowledge transfer, timeframes, fees and resourcing;
• consideration of upstream licensing restrictions that could affect future use, licensing to third parties or transferring to another provider; and
• assessing whether elements of the AI solution may create ongoing regulatory compliance risks. 

Some agreements can feature suggested ‘industry standard’ AI terms. However, these often do not align with the risk profiles of the parties and so should be treated with caution. 

Businesses may consider:

• aligning procurement agreements with internationally reputable standards such as NIST AI RMF, ISO/IEC 42001 or ISO/IEC 23894, or aspects of the Guidance for AI Adoption published by the Commonwealth Government; and
• adapting standard contractual clauses such as the European Model Contractual Clauses for AI procurement or the Australian government’s Digital Transformation Agency’s model contractual clauses as a starting point. Both sets of clauses were developed initially for public sector agencies but can be adapted to the private sector.