In my last article, I gave tips on procurement due diligence for museums evaluating AI vendors. This piece is for when you’ve done that and you’re ready to sign, and it applies whether you’re signing with a named platform or commissioning a bespoke build.
Most AI vendor contracts are written entirely in the vendor’s favour. The provisions I’ll be discussing likely won’t be in the first draft you receive. You will have to advocate on behalf of your institution.
A note on jurisdiction: I write mainly on EU and UK regulatory frameworks (GDPR, the EU AI Act), but these contractual principles broadly apply wherever you are. If your institution operates outside the EU, you can still take these points to your legal counsel.
How to read this article
Museums, galleries, archives, and heritage sites have limited legal budgets. You’ll have to pick your battles and how much you want to spend on them. To make those decisions easier and tell you how you should approach your vendor, the contract provisions we’ll discuss all carry one or more tags:
| Tag | What it means | Legal cost |
|---|---|---|
| Ask first | Ask before a contract is drafted. If the vendor fails, accept the risk or walk away. | None |
| Negotiate | Push for your full ask. Know the technical limits. Have a fallback position ready. | Moderate |
| Non-negotiable | Contract wording impacts your regulatory or data security exposure. | Spend here |
Provision one: Data sovereignty
Vendor contracts typically allow data to be processed anywhere their infrastructure operates. For a museum, this is a compliance and ethical thicket. Your collections data, visitor records, and curatorial notes could be processed on servers subject to US legal authority, regardless of where those servers physically sit. Legal jurisdiction follows the company, not the building.
The legal mechanisms EU institutions use to legitimise data transfers to US vendors are the EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs). They’re significantly less stable than they were two years ago, for reasons covered in my previous article. In a nutshell, do not sign a US vendor contract involving personal data without your solicitor in the room.
If your institution holds indigenous collections or repatriation-sensitive records: More source communities are applying the CARE Principles for Indigenous Data Governance to assess how institutions handle their cultural heritage data. If you sign a contract without their consultation where their data passes through commercial AI infrastructure, that could break their trust.
If your institution receives public funding: Before drafting a vendor contract, check your grant agreements for data residency conditions. Arts Council, lottery, and EU structural funding agreements often carry them. Miss the fine print and you’re in breach before your new AI tool even goes live.
If your institution holds active provenance research or restitution case files: Be aware that US litigation gives opposing lawyers the power to compel a US vendor to hand over data it holds on your behalf.
Ask first
Do you control the compute infrastructure on which inference runs? A vendor running on OpenAI or Anthropic can’t guarantee where your data will be processed. If they can’t control where inference runs, consider this a disclosed risk and decide whether it’s acceptable before you ask your legal team to review.
Negotiate
- Specified jurisdictions for data at rest (and for active inference if the vendor controls their own infrastructure)
- Sub-processor approval rights: who else touches your data, and your right to object
- A contractual guarantee that data stays in the jurisdictions you’ve specified
- Enhanced protections for indigenous and repatriation-sensitive records as a named data category
Provision two: Audit trails
Article 50 of the EU AI Act (in full effect from 2 August 2026) requires you to inform visitors when they’re interacting with an AI system. If a regulator asks, you must be able to prove that your AI was clearly disclosed, and recreate its outputs. It’s very difficult to do this without a cooperative vendor.
When a vendor tells you logging is “too expensive” or “not in our architecture,” ask them to be specific. Per-query logging is standard in enterprise software. If they haven’t built it, well, that was a choice they made.
Non-negotiable
- Six-month log retention for query inputs, model outputs, and disclosure events, accessible to you on request
- Log access within 10 business days of a regulatory inquiry
If a vendor refuses both, they are leaving you exposed to regulatory fines. Walk away.
Negotiate
- Disclosure event logging: proof AI disclosure fired, per interaction
- Explainability on demand for any AI applications that are high-risk under the EU AI Act
- Incident documentation if the system produces harmful or inaccurate outputs
Provision three: Training data and your data
A common concern of cultural institutions is whether their data will be used to train the vendor’s model. That’s important and the opt-out needs to be in your contract. But what was the model trained on before it arrived at your institution?
AI tools built on widely-used datasets like ImageNet contain labels that are outdated, culturally offensive, or just inaccurate. A museum deploying those tools to generate public-facing collection descriptions could be publishing misrepresentations on behalf of its collections.
If your vendor is building on a foundational model they didn’t train, the reality is, they can’t give you a full dataset audit. Since neither you nor the vendor can change what the model learned, you’ll have to focus on how it is required to behave.
Ask first
Can we opt out from model training across all data streams? Think curatorial notes, query logs, outputs, and incidental data. This should be the default, not paid add-on. If the vendor won’t confirm this, walk away.
Negotiate
- A mandatory guardrail or system prompt layer to override questionable outputs, contractually enforceable and testable by your curatorial team
- Fine-tuning veto rights for any secondary datasets the vendor controls
- Dataset disclosure for the layers the vendor does control
Non-negotiable
- Post-contract data deletion: timeline, written confirmation, and coverage of derived data (embeddings, cached outputs, fine-tuning data generated from your content)
- Notification if the vendor changes training datasets or switches foundation model providers after signing
What to tell your solicitor
You don’t need to hand them this article. The table below is what you need.
| Provision | What to ask your solicitor to include |
|---|---|
| 1. Data sovereignty | Restrict processing to specified jurisdictions. Sub-processor visibility and approval rights. Enhanced protections for indigenous and repatriation-sensitive records as a named data category. |
| 2. Article 50 audit trails | Minimum six-month log retention. Log access on request within 10 business days. Disclosure event logging for any visitor-facing AI system. |
| 3. Training data | Explicit opt-out across all data streams, default not optional. Post-contract deletion with written confirmation. Fine-tuning veto and contractual guardrail layer where relevant. |
If your legal budget is limited, focus on the log retention clause and the deletion clause. These are where you face the worst regulatory and data security risks. You don’t have to negotiate them from scratch either — the Museums Association and equivalent bodies maintain legal referral networks, and your regional or national museum body may already have template contract language you can adapt.
What a vendor’s response tells you
A vendor who claims “our standard terms cover this” hasn’t read their own contract carefully, or is hoping you haven’t. If they come back with counterproposals rather than flat refusals, that’s a good sign they understand the complexities cultural institutions face. There are good vendors out there!
That said, you may find some of these negotiations very difficult. AI vendors are moving toward lower accountability as a general trend. In some cases the most leverage you may have is your willingness to walk away. I know that’s asking a lot when the market consolidates around a small number of providers with little incentive to accommodate your museum.
That’s why it’s so important to build collective leverage now. AI4LAM was established as an international organisation in December 2025, with over forty leading institutions signing on including Harvard, the British Library, and the Bibliothèque nationale de France. It gives the cultural sector a way to hold the line in a way no single institution can.
Finally, I think it’s important to acknowledge that there’s a ceiling to what procurement can achieve without wider support from across your institution’s stakeholders. The question of who in your institution has the authority and mandate to hold these lines consistently is a deeper conversation.
That’s where my next article will begin.
I’d love to hear from law firms working with cultural institutions on AI vendor agreements. Reach out to me here or on LinkedIn.
