Enterprise customers are facing growing exposure as technology vendors reinterpret broad data-use language to justify building AI features and training machine learning models.
HubSpot’s recent and quickly reversed attempt to expand its use of customer CRM data to support a new AI-powered lead-generation feature is one of the most visible examples of this trend.
The company’s move would have potentially shared certain customer data elements across its platform, triggering significant pushback before the policy was reversed.
For customer-side counsel, the lesson extends well beyond a single vendor or product category to a fundamental shift in how standard contract language operates in practice.
Familiar SaaS concepts such as “service improvement,” “analytics,” and “product development” can take on very different meanings in the AI era if they are not carefully constrained.
Historically, many customers accepted broad vendor rights to use their data “to provide, maintain, support, and improve” the service, understanding that to mean routine operational tasks.
Before AI, that language typically covered debugging, security monitoring, and performance optimisation rather than training models or generating cross-customer insights from individual customer datasets.
Today, those same words may be read to authorise training AI systems, building new features from patterns in customer data, or using one customer’s data to enhance the vendor’s broader product offering.
That risk becomes especially acute where the relevant data is substantive business information rather than technical telemetry, including CRM records, pricing history, pipeline details, and sales strategy.
Even when public disclosure is not in play, many customers will object to a vendor using sensitive commercial information in ways that help other customers or dilute the competitive value of the underlying dataset.
Customer-side counsel should separate categories of data and rights with greater precision than many legacy technology agreements provide, treating customer content differently from usage metadata.
Agreements should make clear that the vendor’s licence to customer data is limited to what is necessary to deliver contracted services, and not for broader AI training purposes without the customer’s affirmative agreement.
Provisions permitting use of “aggregated,” “anonymised,” or “de-identified” data also warrant close scrutiny, as they can give vendors wide latitude to extract value from customer data for secondary purposes.
The HubSpot situation also highlights the need to control the process by which data-use rights can change, not only the substance of those rights at the time of signing.
Vendors increasingly introduce AI-related changes through hyperlinked terms, privacy policies, or feature notices rather than through negotiated amendments, creating unilateral shifts in data-use rights mid-contract.
Customer-side counsel should be wary of contractual structures that permit such changes, particularly where they affect customer content, confidentiality expectations, or AI-related processing without explicit consent.
Order-of-precedence clauses should make clear that any hyperlinked, online, or other extra-contractual terms are subordinate to the negotiated agreement and cannot override its terms.
Broad vendor rights that may have seemed benign in a traditional technology agreement can carry materially different risk once AI is in the picture, requiring a fresh review of existing contracts.
As vendors face competitive pressure and growing customer sensitivity around AI, many are willing to narrow data-use language when the issue is clearly and precisely framed by counsel.