7 AI Contract Terms That Protect the Record

What police reports can teach every organization handling sensitive data

Contracts exist to allocate risk, and AI makes that risk harder to predict. Generative drafting and autonomous agents raise questions of safety, liability and unauthorized action that many standard technology agreements were not written to answer. Vendors also tend to prioritize model performance, flexibility and rapid deployment, while buyers focus on data protection, accountability and compliance. The contract is where those priorities are reconciled.

We approach the question as a lawyer and a former police commander, pairing legal accountability with the practical demands of running a department. Police reports make a demanding test case. An officer signs the report, a prosecutor relies on it and a defense attorney challenges it, and what it says can affect someone’s liberty, safety or credibility. Contract terms that can protect that record offer a model for any organization handling sensitive data.

Take a hypothetical we will return to throughout. A witness tells an officer the suspect “might have been” the person she saw, but the AI draft says she “positively identified” him. At the end of a long shift, the officer skims the finished-looking paragraph and approves the report. Weeks later, a prosecutor asks what supports the identification, and by then the first draft is gone and the processing logs have expired. The agency can correct the sentence, but it can no longer explain how a witness’s uncertainty became the department’s certainty.

The error itself can be fixed; the lost history is the larger problem. The contract is where an organization decides, before deployment, what the AI may do and what proof will exist when someone questions the result.

The stakes rise when AI moves from drafting text to taking action. An agent connected to business systems can change, delete or disclose information, and prompt injection, in which instructions planted in an input redirect the system’s behavior, opens another path to unauthorized action. Contract safeguards therefore need to cover access, authority, review and recovery, with a clear owner, evidence and remedy for each, alongside any sector-specific legal duties.

The seven terms below cover:

• Control of the record: rights in inputs, drafts, metadata and training.
• Security and assurance: what CJIS, SOC 2 and FedRAMP prove, and what they miss.
• Human review: catching overstatement before certification.
• Audit trail: the record California requires, and the one to negotiate.
• Legal holds: preserving every copy, including the vendor’s.
• Incident response: notice deadlines, definitions and covered losses.
• Exit: export, transition and change controls set at signing.

Agreements that govern the work

Before negotiating any single term, identify where the AI protections live. They usually sit across several documents:

• Software/SaaS agreement and MSA: rights, performance, remedies and exit.
• Data processing agreement and security/AI addenda: permitted uses, access and providers.
• Implementation agreement and SOW: integrations, responsibilities and acceptance tests.
• NDA, data-sharing or pilot agreement: safeguards before operational use.

Read those documents together, including incorporated online terms and the order-of-precedence clause. A carefully negotiated data processing agreement protects less than it appears to if online terms override it.

Two other distinctions shape the negotiation:

• Deployment architecture: a vendor-hosted product, a private-cloud installation and a local or open-source model each place responsibilities in different hands.
• Type of vendor: an established software provider adding AI features may be relying on an agreement written before those features existed.

This AI vendor contracting article covers the foundation: warranties, indemnities, customer-data protections and governance. The seven commitments below apply it to the record itself. Where no vendor commitment is available, as in many local or open-source deployments, assign the same duties to your team or integrator.

1. Define who controls every layer of the record

Owning the final work product is not enough when AI does much of the work. The material that explains a report sits in layers an ownership clause may never mention: the officer’s dictation, the first draft, the edit history, the model version and the summaries and indexes generated along the way. An agency can own its reports outright while the vendor keeps full rights to its models, but leaving the layers undefined invites disputes, especially over historical data after termination. The matrix below identifies the issues to negotiate; the right allocation depends on the agreement and applicable law.

Separate service delivery from training

The operational baseline is permission to deliver the service. That floor should not require special authorization, but every use beyond it should, and the contract should treat each category separately:

• Service delivery: generating the report and supporting the officer’s workflow, including records and dispatch integrations, retrieval and the audit trail.
• Cross-customer model improvement: tuning performance across customers using aggregated or de-identified data.
• General-purpose training: feeding agency data into a foundation model that may serve unrelated products.

The last two carry different risks, so each needs its own written authorization rather than a shared data-use clause. For each broader use, identify the data, the safeguards and the specific lawful authorization, and flow those terms down to upstream providers.

De-identification is weaker than it sounds for police narratives. Removing names can still leave an address, a time, an injury description, vehicle details or a suspect description, which together can re-identify a case. California’s police-report law restricts vendor reuse and separately permits specified support and improvement access, and consent cannot expand those legal permissions.

Plan the training exit before anyone opts in

Training creates a problem that ordinary deletion clauses were not written to solve. A database stores each report as a record that can be found and deleted. A model works differently. When a vendor trains or fine-tunes a model on agency data, that data adjusts the model’s weights, the vast set of numerical parameters that determine how the model writes. The reports are not kept inside the model as separate files, but what the model learned from them is built into those weights.

That is why training works like a one-way window. Deleting the stored reports afterward removes the files, but it does not establish that their influence has left the model. Removing one customer’s contribution may require retraining or replacing the model, and techniques for “unlearning” specific data are still developing. A standard termination clause, which typically requires the vendor to return or delete customer data, does not reach that problem.

Before an agency opts in to model improvement or training, the contract should answer four questions:

• Withdrawal: Can the agency revoke its consent, and what happens to models already trained on its data?
• Future use: May the vendor keep using or building on those models after the agency leaves?
• Reversal: What can be removed, such as stored copies, training datasets and models tuned for the agency, and which effects will remain?
• Proof: What documentation will the vendor provide to confirm deletion and any retraining?

Ownership has a separate limit. A contract can allocate rights in AI-assisted reports, but it does not make AI-generated text copyrightable. The U.S. Copyright Office’s report on copyrightability concludes that copyright protects human authorship, so AI-generated passages without sufficient human creative control may not be protected. That leaves the contract, not copyright law, to do most of the work of controlling how reports are used.

2. Use security policies and accounting assurance principles

Security review should start where agencies tend to lose visibility. Two gaps deserve particular attention:

• The upstream model layer: when a report-writing vendor calls a third-party model provider, the agency may not know which calls leave the vendor’s environment, even if the vendor’s own staff access is tightly controlled.
• Integration credentials: a records or dispatch sync whose access was never revisited after go-live.

Map who can access information and where it is processed, then assess what the available security evidence demonstrates.

Match the frameworks to the data

NIST SP 800-53 provides a widely used catalog of security and privacy controls, and the FBI’s Criminal Justice Information Services Security Policy, or CJIS, organizes its minimum protections for covered criminal justice information around those control families. Version 6.1 includes monthly vulnerability scanning and 256-bit symmetric encryption requirements in specified transit and at-rest settings, which gives agencies something concrete to verify alongside personnel screening, hosting locations and applicable state requirements.

Read assurance reports for scope

SOC 2 brings the accounting profession’s assurance discipline into the discussion. An independent CPA examines the vendor under American Institute of Certified Public Accountants (AICPA) standards, using Trust Services Criteria for security, availability, processing integrity, confidentiality and privacy. A Type 1 report addresses a specified date; a Type 2 report also examines operating effectiveness over a period, making it a meaningful signal of operational maturity.

Its value, however, depends on scope. Read the service boundary, selected categories, exceptions, outside-provider treatment and customer responsibilities. A SOC 2 report does not establish CJIS compliance or verify a narrative’s accuracy.

Cloud authorizations raise a similar scoping question. FedRAMP, the Federal Risk and Authorization Management Program, addresses federal cloud security, and its guidance separates the cloud offering’s status from the agency’s own authorization and risk decision. GovRAMP, formerly StateRAMP, supports public-sector cloud assurance. A vendor building on an authorized platform inherits the platform’s infrastructure controls, but its application still carries its own responsibilities, so ask which parts of a claim are inherited and which were independently assessed. These programs are also costly, a burden on smaller vendors that should be weighed against the risk.

Whatever credential a vendor cites, ask for the CJIS posture directly:

• Personnel screening status.
• Hosting location.
• The subcontractor register.
• Current encryption, measured against the version 6.1 baseline.

Write the protections into the agreement

Certifications describe a vendor’s posture; the agreement makes it enforceable. The contract should:

• Spell out access, encryption, segregation and outside-provider protections, and flow them down to subcontractors.
• Require a component and model register with licenses, notices and a compliance owner.
• Assign review of supplied and generated code.
• For agents, specify allowed actions and enforce permissions in the connected application, so read access does not carry deletion rights by default.

Involve procurement, security, privacy, legal and technical owners before deployment, while their concerns can still shape the terms.

3. Give human review a clear purpose

Officers stand behind their reports, supervisors review them and agencies enforce the rules, and none of that changes when AI drafts the first version. Agencies already trust officers with use-of-force decisions made in a fraction of a second; asking them to read a report against the source before certifying it is consistent with the rest of the job. Vendors share that responsibility through design, performance, support and architecture. Systems built on the officer’s active input, rather than passive audio or video capture, help keep the officer’s recollection from being shaped by the machine’s account. Reviewers also need the source, the time and the authority to exercise judgment.

What preserved versions can show

Preserved versions make review possible after the fact. In one anonymized implementation example, a supervisor worried the AI had gotten a report wrong after a prosecutor found the narrative did not establish probable cause. Comparing the officer’s dictation, the AI draft and the final report showed the officer had never articulated probable cause. The AI reflected an existing gap, and the preserved versions revealed it.

Design review to catch overstatement

Our hypothetical is the harder case: the input preserved uncertainty and the draft overstated it. A tired officer skimming a polished paragraph can miss “might have been” becoming “positively identified,” so review has to compare meaning with the source. We recommend a forcing function: the summary or key findings, where identifications and probable cause statements are most likely to appear, arrive blank, and the officer must write them before submission. There is nothing to skim past.

Some systems reportedly plant a deliberate error for the officer to catch instead. That tests attention, not accuracy, and an officer who catches the planted error may still miss the overstated identification. It also shifts the agency from trusting its officers to policing them. The same standard applies to agents: consequential actions should be visible to the reviewer before authorization.

For the witness identification, a meaningful review means the reviewer should:

• Compare the sentence with the witness account and original officer input.
• Preserve uncertainty, attribution and the distinction between observation and inference.
• State the factual basis for identification or probable cause in the officer’s own words.
• Correct unsupported additions and escalate unresolved material gaps.
• Preserve the first draft, material corrections and approval history, then certify the version actually reviewed.

4. Require an audit trail you can use

An AI audit trail is a tamper-evident record of a system’s inputs, outputs, actions and policy compliance. It lets an organization reconstruct decisions and demonstrate accountability, and it supports compliance with the EU AI Act and alignment with the NIST AI Risk Management Framework. A drafting model’s trail centers on inputs, outputs and model versions. An agent’s trail must also capture actions taken, systems called and the decision trace behind each step, and the agent should not be able to access or alter its own logs, a control the new federal guidance in section 6 makes explicit.

Know what California requires

Our chain-of-custody article examined where AI-assisted police records break. A contract cannot prevent every break, but it can assign who preserves each piece of the record and who produces it on demand, and California has already made part of that work a legal requirement.

SB 524, Penal Code §13663, effective January 1, 2026, requires:

• Agency policy for AI identification, disclosure and signed officer verification.
• Retention of the first AI-created draft and an audit trail for as long as the official report.
• An audit trail that identifies the AI user and any video or audio used.

A system that cannot produce that trail is a compliance gap waiting to surface. The statute also sets only a minimum. Section 13663 specifies no standalone fine or prison term and no automatic exclusion of a report, though other consequences depend on applicable law and the facts, and it does not require every intermediate version or a complete edit history.

Negotiate the record your workflow needs

In practice, a usable record starts with three versions, linked by stable IDs, timestamps and the officer’s ID:

• The officer’s input, which shows what the officer said.
• The AI draft, which shows what the system produced.
• The final certified report, which shows what the officer approved.

Those are the questions that come up in court, and a records clerk or supervisor should be able to pull the answers without the vendor on the phone. Beyond that, negotiate the fuller record your workflow needs:

• Material edits, approvals, model/configuration details and available processing records, with omissions documented.
• An owner to assemble records across systems and a vendor support deadline for technical questions.

Deeper layers, such as model version, prompt-level detail and raw processing logs, often need the vendor to interpret them, which is why that support deadline matters. A raw log dump that a prosecutor cannot read without line-by-line translation is a bottleneck, not evidence, so test the export with a nontechnical reviewer during the pilot.

Architecture shapes provenance too. Officer input gives the record one clean source, while ambient audio or video includes things nobody chose to say. For those systems, specify source selection and speaker context so the record shows what informed the draft.

5. Make legal holds reach every custodian

A hold on the agency’s records system does not automatically preserve vendor logs, backups or upstream copies, which may run on their own retention schedules. The contract should:

• Map every custodian and retention schedule.
• Require the vendor to acknowledge preservation instructions.
• Define how a hold suspends routine deletion across every copy.

Resolve deletion and discovery conflicts

Deletion and discovery can also collide, as when a report due for scheduled deletion is subject to a pending discovery or public-records request. Counsel should resolve those conflicts, along with privacy duties and case-specific holds, before litigation forces the issue, and document any authorized destruction, including backups and subcontractor copies.

Keep the disputed version

Corrections need the same discipline. When a disputed report is corrected, keep the original; if the flawed version disappears once it is fixed, there is no record that the error happened or that review caught it.

6. Set the response clock and allocate covered losses

Incident terms should define triggers, contacts, updates, preservation and cooperation for breaches, material errors and rights claims. The agency’s own clock is short: CJIS v6.1 IR-6 requires internal reporting of suspected incidents immediately, within one hour of discovery. Vendor notice is a separate obligation, and a vague “prompt notice” standard may move slower than the agency’s own rules, so set a deadline that lets the agency meet them.

The notice itself should identify:

• Which reports are affected.
• What time window the problem covers.
• Which component failed.

A vendor with a SOC 2 Type 2 report should also be able to show a tested incident response process.

Adopt from the new federal incident guidance

On October 16, 2026, NIST, the NSA and CISA released Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation. Despite the title, the guidance covers current frontier models and the agents built on them. “Super intelligence” is the term NIST has begun using where it previously said AI, including in the name of its standards center, now the Center for Advancing Innovation and Standards for Super Intelligence (CAISSI).

Its ten voluntary practices target developers and do not address contracts, but several translate directly into contract terms for buyers:

• Evidence: tamper-resistant logs with reliable timestamps, the configurations needed to reproduce an incident and a record of actions the system attempted but was blocked from taking.
• Log integrity: agents should not be able to access or interfere with their own monitoring and logs.
• Containment: the ability to shut down affected activity, pause similar agents or runs and revoke credentials accessed during the incident.
• Notice: notifying affected parties, including third parties that were not the target, and sharing timelines and transcripts where feasible.

Two of its definitions are worth adopting for the incident clause itself:

• Near-misses: the guidance tracks events that came close to becoming incidents, which gives a contract a reporting trigger below a confirmed breach.
• Instructed and uninstructed actions: it separates an agent’s own uninstructed actions from actions driven by prompt injection or a backdoored model, which it treats as instructed. An incident definition should cover both, or one way an agent can go wrong will fall outside it.

Because the guidance sets no fixed reporting deadlines, the contract still has to set the clock.

Allocate covered losses

The guidance also tells responders to investigate similar agents and runs, and the same logic applies to reports: require support across every potentially affected report, not just the one that surfaced the problem. Then negotiate protection for covered vendor-caused losses and defense costs, checking caps, exclusions, claim control and reverse indemnities that shift losses back to the customer. Reimbursement helps, but it does not remove public duties or third-party claims.

7. Negotiate the exit at signing

Switching costs can make an exit right difficult to exercise, which is why transition terms belong in the original deal. A December 2023 Los Gatos staff report described more than 81,000 files the department uploaded to Axon’s evidence system during 2020–2023, along with significant switching costs and lost productivity for the department and district attorney if established evidence workflows had to be replicated on another platform.

Define a workable transition

Axon also documents bulk downloads, including transcripts and audit trails, so the ability to export is only the starting point. A workable transition requires every retained report, source record, material version, approval and associated metadata in usable formats. The contract should specify:

• Deadlines and fees for export.
• Data dictionaries that explain each field.
• Transition support and continued access to records under hold.
• A completeness test and a sample import before the old system is shut off.

Text is usually lighter than video, but attachments, permissions and workflow dependencies still matter, so write the export format and timeline into the agreement rather than relying on goodwill at termination.

Control changes during the term

The same discipline applies while the contract runs. Require notice and testing for material model, feature, provider, license or term changes, with consent, objection or exit rights where warranted.

Key takeaways

Contracts cannot predict every AI risk, but they can secure two things: the authority to control how AI is used and the records to explain what it did. Before signing:

• Separate service delivery from improvement and training, and settle training exits before anyone opts in.
• Treat SOC 2 and FedRAMP as supporting evidence, and ask for the CJIS posture directly.
• Require officers to write key findings in their own words.
• Keep the three-version record, producible without the vendor.
• Extend legal holds to vendor logs, backups and upstream copies.
• Set a vendor notice deadline that fits the agency’s one-hour CJIS clock, and cover near-misses.
• Write export formats, timelines and transition support into the original deal.

Then rehearse it. Walk the witness hypothetical from the overstated identification to the exported record, and give each commitment an owner, a deliverable and an acceptance test. Do it before someone’s rights, data or reputation depends on the answer.

For more on AI, accountability and human judgment, subscribe to The Human Edge of AI.

About the authors

Lili Kazemi is General Counsel and AI Policy Leader at Anant, founder of DAOFitLife and author of Business Class Fitness. More from Lili.

You can now also follow Lili on substack at https://substack.com/@lilikazemi
Subscribe – The Human Edge of AI

Chris Ryan is Chief Product Officer at PoliceReports.ai and a former police commander. PoliceReports.ai leadership.

About Anant

At Anant, we help forward-thinking teams unlock the power of AI safely, strategically, and at scale. From legal to finance, our experts guide organizations in building workflows that act, automate, and aggregate without losing the human edge. We turn emerging technology into practical, scalable business capability.

Disclaimer

Educational information, not legal advice. Requirements depend on jurisdiction, data, deployment and agreement. AI assisted research and drafting; the authors are responsible for the final published content.