What NJ Small Firms Should Actually Look for in an AI Vendor Contract Before Signing Anything

You've done your research. You've watched the demos, compared the pricing tiers, and decided an AI tool is worth a trial. Then the vendor emails you a link to a 14-page Terms of Service and a Master Services Agreement. Most attorneys click "Accept" and move on.

That decision — made in under 30 seconds — can create compliance exposure that takes months to unwind.

AI vendor contracts are not boilerplate. They are the legal infrastructure of your firm's data governance, and for NJ attorneys bound by the Rules of Professional Conduct, several clauses have direct ethical weight. Here's what to actually look for before you sign.

---

The Training Data Clause Is the One That Surprises Attorneys Most

Buried in many consumer-grade and even mid-market AI platforms is a clause granting the vendor a license to use your inputs to train or improve their models. On its own, this is a business norm. In a law firm context, it means client facts, matter details, and privileged communications could become training data for a product used by your opposing counsel next quarter.

What to look for: Seek explicit language stating that your firm's inputs and outputs are excluded from model training. Vendors like Microsoft (Copilot for M365 with enterprise licensing), Clio Duo, and Harvey typically offer this at the enterprise tier. Many consumer-facing tiers — including default ChatGPT — do not, unless you specifically opt out in settings.

If you can't find the clause, ask before signing. If the vendor can't produce it in writing, treat that as a red flag under NJ RPC 1.6, which requires you to make reasonable efforts to prevent unauthorized disclosure of client information.

---

Data Residency Language Is Specific — and Matters for NJ Firms

Where is your data stored and processed? "The cloud" is not an answer. For NJ attorneys working on matters that touch federal agencies, immigration, family court, or sensitive commercial clients, data residency in the United States is often a practical necessity — and increasingly, a client expectation.

What to look for: Contracts should specify that data is stored and processed within the U.S. (or within a jurisdiction acceptable to your clients). Watch for broad transfer clauses that allow the vendor to shift data to offshore infrastructure "for redundancy" or "as necessary." These look innocuous. They are not.

If the vendor offers a Data Processing Agreement (DPA), request it — and read Schedule 1 carefully. It will name the sub-processors (third parties who actually touch your data). Surprises live in that schedule.

---

The Liability Cap Is Probably Lower Than You Think

Most SaaS vendor contracts cap their liability at the amount you paid in the prior 12 months. For a solo attorney paying $50/month, that cap is $600. If a vendor breach results in a reportable data incident involving client PII, your exposure as the attorney far exceeds that.

What to look for: Negotiate the liability cap upward if you can, especially for any vendor touching client documents. More practically, make sure your own professional liability policy (and any cyber coverage rider) contemplates third-party AI vendor failures. Many NJ attorneys don't know whether their coverage applies to a breach caused by a vendor's misconfiguration — find out now, not after an incident.

---

Termination and Data Return Provisions Are Regularly Overlooked

When you stop using a platform, what happens to the data you uploaded? Some contracts allow vendors to retain your data for 90 days post-termination — others say "indefinitely in anonymized form," which is a phrase that should prompt a follow-up question.

What to look for: The contract should give you a clear window to export your data and an explicit commitment to delete it from vendor servers (and sub-processor servers) after termination. Bonus points if the deletion is confirmed in writing upon request. This matters for file retention obligations under NJ rules, and for client files specifically.

---

A Practical Action Step Before Your Next Demo Call

Create a one-page vendor questionnaire you send before any trial begins. It should ask four things:

1. Does your platform use my firm's inputs for model training, and how do I opt out?
2. Where is client data stored and processed, and who are your sub-processors?
3. What is your incident notification timeline in the event of a breach?
4. What are the data return and deletion procedures upon termination?

If a vendor can't answer all four in writing, you have your answer about their enterprise readiness — without ever opening the contract.

---

AI adoption in NJ small firms is accelerating. The ethics infrastructure supporting it — competent vendor selection, documented data governance, contractual due diligence — is lagging behind. Slowing down for 45 minutes to read a vendor agreement isn't caution. It's practice management.