Three Key Elements of SaaS Service Contracts Based on Artificial Intelligence (AI)

Law firm Veat recently received a request from Company A (hereinafter "Client"), providing AI-based SaaS services, to draft a SaaS contract including an AI learning model.

In the era of the Fourth Industrial Revolution, SaaS (Software as a Service) services leveraging AI and cloud-based technology are rapidly spreading across all industries. Particularly, industry-specific SaaS solutions go beyond simple software provision, encompassing real-time data analysis and prediction, automated decision-making functions, and deeply penetrating customers' business operations. However, as these sophisticated SaaS services become commercialized, the structure of SaaS contracts also requires a level of sophistication and legal stability to match.

The Client provides AI-based SaaS services to efficiently manage assets such as bonds issued by financial institutions, and considering its core competitiveness lies in advanced AI analysis functions, Law firm Veat drafted a customized SaaS contract focusing on license scope setting, establishing information utilization consent structures for AI learning model operation, and prioritizing personal information protection.

3 Key Elements of an AI-based SaaS Service Contract

1. Clarification of SaaS Contract License Scope

Unlike the traditional packaged software provision method, SaaS allows users to access and utilize services by connecting to a cloud server. Therefore, a different structure is required compared to traditional software license contracts, and it is particularly important to clearly define the 'scope of service provision' and 'limits of usage rights.'

When providing AI-based SaaS services, it is important to clearly define the license scope in the contract. Specifying details such as geographic scope, exclusivity, permissibility of sub-licensing, and contract duration can prevent disputes in the future, and it is essential to specify geographic scope especially when considering global service provision. Additionally, the pricing method can also have various structures, such as usage-based, fixed fee, and feature-based pricing, so it is necessary to clearly define rate calculation criteria, overage fees, and refund conditions to ensure predictability and transparency.

2. Securing the Legitimacy of AI Learning Models and Data Utilization

The Client's financial data is analyzed by the AI model, enabling more sophisticated asset management and risk prediction. The key issue was that the AI learning model provided by the company has a structure that collects and analyzes the Client's data.

If this type of data utilization for AI learning purposes is carried out without separate legal consent, it may be unlawful. In particular, when dealing with sensitive or non-public information such as financial data, its scope of utilization must be based on clear contractual clauses to be considered legitimate.

- Explicit consent for the utilization of client information for AI learning purposes

When an AI model uses client data as learning material, an explicit and specific consent clause is necessary in the contract. If learning purpose, scope, method, and possibility of reuse are not clearly stated, the client may later claim data misuse.

- Legal responsibility for data de-identification and protection measures

Even if the information provided by the client is not personal information, it is likely to be sensitive data or corporate information, so data used for AI learning must be subject to mandatory protection measures such as de-identification, encryption, and access control.

- Client’s right to consent and withdraw consent for data provision

The client has the right to withdraw consent for data provision for AI learning purposes at any time, and the company should specify in the contract that the data should be deleted or removed from the model upon the client’s request, ensuring the client's control.

These provisions guarantee the rights of the client, who is the data subject, and minimize the Client’s legal risks.

3. Review of SaaS Data Risks Involving Personal Information

AI SaaS services generally input and process various unstructured data. When the Client provides services to the financial sector, the data uploaded may also include personal information of actual users or transaction parties.

Therefore, Law firm Veat checked the scope of data collected, stored, and processed by the SaaS service and examined whether it meets the requirements for legally collecting and providing to third parties.

When a SaaS service processes personal information, it is first necessary to determine whether the collected information falls under personal information, sensitive information, or unique identifiers on a case-by-case basis. If third-party services via external cloud infrastructure are included, the requirements for personal information processing outsourcing or third-party provision must be met, and it is important to specify this in the contract. In addition, it is necessary to concurrently establish a personal information protection policy and an internal management plan in accordance with relevant laws and regulations such as the Personal Information Protection Act to reduce practical risks.

In the case of services linked to the financial sector, structures in which consumer information is indirectly utilized for AI learning may be highlighted as sensitive issues subject to regulatory interpretation, so it is essential to specify the level of data de-identification, responsibility of processing outsourcing parties, and inclusion of legal compliance items in the contract.

Law firm Veat provided a practical contractual strategy that considers a balance between technological structure and legal risks, not just simple document drafting. It is essential for AI-based SaaS companies to consider technical development direction, customer data handling policies, and legal risk mitigation strategies from the initial stage of the contract.

Law firm Veat provides comprehensive legal advice to technology-based industries across the board, including AI, cloud, and SaaS, based on a deep understanding of technology and abundant practical experience, enabling companies to gain market trust and achieve sustainable growth. It not only stops at drafting contracts but also designs customized SaaS contracts tailored to the AI learning structure and data flow, service operation method, performs precise risk analysis regarding the Personal Information Protection Act and cloud computing related laws, and comprehensively reviews knowledge property (IP) issues that may arise during AI model development and commercialization.

Furthermore, it helps to achieve harmony between law and technology by providing strategic contractual structures that respond to regulatory environments in each industry such as finance, healthcare, and education. Law firm Veat specializes in implementing contract systems that combine both legal stability and business flexibility in an environment where technology is rapidly changing.

If you need SaaS contract legal advice, please feel free to contact Law firm Veat.

This case study can also be viewed on the Law firm Veat blog.

- 3 Key Elements of an AI-based SaaS Service Contract

Thank you.

Law firm Veat