What should the terms of service for an AI product cover?

The sections an AI product's terms need beyond a standard SaaS template, from outputs and accuracy to acceptable use, training, and agent actions.

Short answer

Start from ordinary terms and add the parts AI changes: who owns inputs and outputs, what users can rely on, what they may not do with the product, whether their data trains models, and who is responsible when an agent acts. Your terms also have to be consistent with your model provider's terms, because many of its restrictions flow down to your users.

Sections AI products need

• Inputs and outputs. Users usually keep rights in what they submit and receive rights in outputs, to the extent you have any to give. Say that outputs may not be unique, so another user may receive similar output.
• Accuracy. AI output can be wrong. Tell users to check it before relying on it, especially for health, legal, financial, or safety decisions. A disclaimer helps, but it does not fix a product that is marketed as reliable, and it should not contradict specific promises you make elsewhere, for example about clinical accuracy, data security, or authorized transactions. Your marketing, your commitments, and your disclaimers have to match.
• Acceptable use. List what users may not do: illegal content, harassment, attempts to extract the model or other users' data, prompt injection against the service, and anything your model provider's usage policy prohibits. You are usually required to pass the provider's restrictions on to users.
• Training and improvement. Say plainly whether user content is used to train or improve models, yours or the provider's, and how users can opt out. This must match your privacy policy exactly.
• Agent actions. If the product acts for users, define the authority the user grants, whether the agent can spend money or enter agreements, which actions need confirmation, who is responsible for actions the user approved, and how mistakes and disputes are handled.
• Health care products. Keep the terms consistent with your business associate agreements, HIPAA, and who holds clinical decision-making responsibility.
• Third-party services. If the product operates other sites or accounts for users, say that their terms also apply and that you are not responsible for those services.
• Suspension. Reserve the right to suspend accounts for misuse, including misuse that puts your model-provider account at risk.
• Liability limits. Courts often enforce clearly drafted caps and disclaimers, especially between businesses. But enforceability depends on the state, the wording, the relationship, and the conduct. California law, for example, voids clauses that try to excuse fraud, willful injury, or violations of law. New York courts won't enforce clauses that excuse gross negligence or intentional misconduct, and a September 2026 federal decision applying New York law shows how much the drafting matters. Consumer-protection statutes can void waivers of statutory rights. A cap imposed on a consumer in non-negotiable online terms is treated differently from one negotiated between two businesses, and saying you have no responsibility for any AI error won't excuse deceptive practices, privacy violations, or negligence. Don't rely on these clauses as your main protection.
• Changes. Explain how you will notify users of material changes. Changing how existing data is used generally needs consent, not just new terms.

Common mistakes

• Copying another company's terms that promise things your product doesn't do, or describe features you don't have.
• Terms that say content is never used for training while the provider account or an analytics tool keeps it.
• No mechanism to show the user agreed: no checkbox or clear sign-up statement, and no record of which version they accepted.
• Bundling the terms with consents that must be separate, such as health-data consent or marketing.

Checklist an agent can run against the codebase

• Find where users accept the terms, and confirm that acceptance is recorded with the version and a timestamp.
• Compare the terms' training statement to the model-provider settings and any analytics or logging of prompts.
• List every action the product can take for users and compare it to what the terms describe.
• Find the provider's usage policy for the account in use and check that the acceptable-use section covers it.
• Check whether any terms or marketing copy describes the AI as accurate, safe, or professional-grade.

If this applies to you

An AI feature review covers terms changes for an AI feature. For a new product, the app launch legal package includes terms, privacy policies, and the consent flow together.