Commercial Contracts in 2026: 5 Key Trends in AI, Data Protection & Technology Risk

Artificial intelligence is increasingly difficult to ignore in the commercial contracting landscape.

AI as a concept feels unlike anything else businesses have previously had to contend with when thinking about commercial contracts, particularly given the ethical, political and regulatory questions it raises. At the same time, AI products are increasingly prevalent and now form the subject matter of many of the contracts businesses are negotiating on a daily basis.

One of the key questions for businesses is what provisions they should look out for when entering into a contract for the supply of an AI-enabled solution, and how they can mitigate the legal risks associated with the use of AI by service providers.

Service Descriptions, Warranties and Exclusions

AI contracts frequently contain high-level descriptions of functionality, referring to concepts such as “generative AI assistance”, “intelligent insights” or “automated recommendations”.

While businesses may understand what they expect to receive from the product, vague contractual descriptions create risk.

Businesses should therefore ensure that intended functionality is clearly stated, that any significant limitations on use are identified and that the nature of AI outputs is properly specified.

AI vendors will also typically seek to soften warranties that customers might otherwise expect to receive in a traditional services contract.

For example, contracts may contain:

• No warranty that outputs are accurate, complete or fit for purpose
• No warranty of non-infringement of third-party intellectual property rights
• Express disclaimers that AI may generate incorrect or misleading information

Even where some negotiation is possible, businesses should ensure they fully understand the limits of any warranties they provide and consider whether additional operational safeguards are required.

Contracts should also be carefully reviewed for exclusions which may undermine the commercial value of the service, particularly where suppliers seek to exclude responsibility if the solution is used without human review or in regulated or safety-critical contexts.

Intellectual Property and Data Protection

AI contracts also raise important intellectual property and data protection considerations.

Key questions include:

• Who owns AI-generated outputs
• Whether customers receive sufficiently broad licence rights
• Whether outputs could infringe third-party intellectual property rights
• How vendors may use customer data or prompts for model training

From a data protection perspective, organisations remain responsible for compliance with UK GDPR and related obligations even where AI tools are being used.

Businesses should therefore understand:

• Whether personal data is being processed
• Whether data will be retained or used for model improvement
• Whether international transfers are involved
• Whether appropriate contractual protections are in place

Liability and indemnification clauses also require careful scrutiny.

AI vendors frequently seek broad indemnities from customers for the use of inputs and outputs, including indemnities for intellectual property infringement and violations of applicable law. This can represent a significant shift from more traditional technology contracting positions.

Data protection remains one of the topics clients most frequently seek advice on.

The UK data protection framework continues to be governed primarily by:

• UK GDPR
• The Data Protection Act 2018
• The Data (Use and Access) Act 2025

The DUA Act introduced targeted reforms intended to make the UK’s data protection regime more practical and adaptable while maintaining accountability obligations.

Legitimate Interests

Legitimate interests remain one of the most important and widely relied upon lawful bases for processing personal data.

The DUA Act and updated ICO guidance provide additional clarity regarding:

• What may constitute a legitimate interest
• How the necessity test should be applied
• How organisations should approach balancing exercises

The ICO has confirmed that legitimate interests can include commercial objectives, third-party interests and wider societal benefits.

Importantly, the necessity test should not be interpreted in an overly narrow manner. Instead, organisations are expected to use personal data in a targeted and proportionate way to achieve legitimate objectives.

The guidance is particularly relevant for direct marketing activities where consent may not always be required.

However, organisations relying on legitimate interests must still be able to explain and evidence their reasoning.

Privacy notices and contracts should therefore clearly describe processing purposes and avoid overly broad or generic wording.

International Data Transfers

The DUA Act also supports a more flexible, risk-based approach to international data transfers.

The focus is now on whether protections in the destination country are “not materially lower” than UK standards.

While this may simplify aspects of transfer risk assessments, organisations must still:

• Understand where personal data is being transferred
• Assess transfer risks appropriately
• Implement suitable safeguards

Contracts involving overseas processors should clearly address:

• Where data is stored and accessed
• What safeguards apply to onward transfers

Liability and Risk Allocation

Liability clauses remain among the most important provisions in technology contracts.

Suppliers commonly seek to:

• Cap liability by reference to annual contract value
• Exclude losses such as profit, revenue and business interruption
• Limit remedies to service credits

While this may be acceptable in some low-risk SaaS arrangements, it may be problematic in business-critical, implementation-heavy, or customer-facing solutions.

Businesses should carefully consider:

• Whether caps are aggregate or claim-specific
• Whether indemnities fall within liability caps
• Whether exclusions remove meaningful recovery rights
• Whether separate caps should apply to different categories of risk

The case of Drax Energy Solutions v Wipro remains an important reminder of the need for clear drafting where liability caps are linked to charges paid over specific periods.