# What are AI indemnification carve-outs and why do they leave enterprises exposed?

thane.zone · September 10, 2026

> AI indemnification carve-outs explained simply: when a vendor promises to indemnify you against third-party intellectual property claims arising from...

AI indemnification carve-outs explained simply: when a vendor promises to indemnify you against third-party intellectual property claims arising from AI outputs, the promise almost never covers everything. Carve-outs are the exclusions written into that promise — the specific situations where the vendor walks away and you absorb the liability. In 2025 and 2026, these carve-outs have become the single most contested clause in AI vendor negotiations, and most buyers discover them far too late.

## The Direct Answer: What Carve-Outs Actually Exclude

**Also worth reading:** [What should enterprises know about AI vendor data training license clauses in SaaS contracts?](https://thane.zone/knowledge/what_should_enterprises_know_about_ai_vendor_data_training_license_clauses_in_saas_contracts.php) · [How do enterprises scale agentic AI operations safely across multiple teams?](https://thane.zone/knowledge/how_do_enterprises_scale_agentic_ai_operations_safely_across_multiple_teams.php) · [How do you design a distributed operations governance framework for multi-team enterprises?](https://thane.zone/knowledge/how_do_you_design_a_distributed_operations_governance_framework_for_multi-team_enterprises.php)

An AI indemnity typically says the vendor will defend and pay damages if a third party claims the AI's output infringes their copyright, patent, or trade secret. The carve-outs then subtract from that promise. The most common exclusions are: outputs the customer materially modified, combinations of AI output with the customer's own systems or data, use of the output in a way the vendor did not intend or document, continued use after the vendor notified the customer of a claim, and — increasingly — entire categories of AI functionality such as agentic or autonomous features.

The practical effect is stark. A vendor may advertise broad IP protection in its marketing, yet the contract excludes the two things enterprises actually do: modify outputs before production use, and combine them with internal data pipelines. Reuters reporting on generative AI stack risk in 2025 noted that indemnity coverage frequently stops at the model layer, leaving fine-tuned models, retrieval-augmented pipelines, and orchestration frameworks outside the protection entirely. If your claim arises from your RAG pipeline feeding copyrighted text into a fine-tuned model, you may discover the indemnity never applied in the first place.

## Why Vendors Insist on Carve-Outs

Vendors are not simply being difficult; they are managing exposure they genuinely cannot price. Foundation model providers face training-data litigation with damages potentially measured in billions, and they cannot underwrite unknown liability across thousands of customers. A single model provider facing a class action over training data could face aggregate exposure that dwarfs its revenue, so the indemnity is deliberately scoped to what the vendor can control: the unmodified, intended use of its output.

There is also an insurance dimension. Vendor-side tech E&O and cyber policies increasingly carry their own AI exclusions or sublimits — often $1 million to $5 million per claim against policies with $10 million-plus limits — meaning the vendor's insurer may not pay even if the vendor wants to. Carve-outs push risk down to the customer, who frequently has no corresponding insurance product. This asymmetry is why sophisticated buyers now treat the indemnity section as a negotiation over risk transfer economics, not boilerplate.

## The Agentic AI Problem: The Newest and Widest Carve-Out

The 2025-2026 shift is the emergence of carve-outs targeting agentic AI — systems that take autonomous actions rather than merely generating text. Foley & Lardner's analysis of agentic AI liability in autonomous supply chain decisions highlighted that when an AI agent independently places orders, reroutes logistics, or approves payments, vendors argue the customer directed the action and therefore owns the consequence. Vendors are responding by excluding agentic functionality from indemnities entirely, or conditioning indemnity on the customer maintaining specified human-in-the-loop controls.

The widely discussed Anthropic enterprise-agent situation — described in commentary as finance agents shipped into the carve-out — illustrated the pattern: enterprise customers deployed autonomous agents for financial workflows, only to find the indemnity excluded autonomous decision-making, leaving the customer holding liability for agent errors affecting third parties. For leadership teams running multi-team operations, this matters because agentic deployments tend to spread organically across departments before legal reviews them. By the time procurement sees the contract, the operational dependency already exists, which destroys negotiating leverage.

## Comparison: How Major Vendor Indemnity Structures Differ

| Feature | Foundation model providers (e.g., OpenAI, Anthropic, Google) | Enterprise SaaS with embedded AI (CRM, productivity suites) | Agentic AI platforms |
| --- | --- | --- | --- |
| Scope of IP indemnity | Broad for unmodified outputs; Copyright Shield-style commitments | Often extends to vendor's product layer only | Frequently excludes autonomous actions entirely |
| Modification carve-out | Excludes materially modified outputs | Excludes customer prompts and configurations | Excludes customer-defined goals and guardrails |
| Combination carve-out | Excludes combinations with customer data/systems | Excludes third-party integrations | Excludes multi-agent orchestration across vendors |
| Agentic actions | Generally out of scope | Rarely addressed | Explicitly carved out or conditioned on human oversight |
| Typical cap | Uncapped for IP claims, or capped at fees paid (12-36 months) | Capped at 12 months of fees | Capped at fees paid, sometimes $1M-$5M sublimit |
| Practical protection level | Moderate to strong for text/code generation | Weak — claims usually arise from customer use patterns | Minimal — buyer bears most risk |

The takeaway from this comparison is uncomfortable: the more autonomous the AI, the thinner the indemnity. Buyers comparing vendors should score indemnity scope with the same rigor they apply to uptime SLAs, because a 99.9% uptime guarantee is worthless if an IP claim shuts the workflow down.

## Practical Steps Before You Sign

First, demand the carve-out list in writing during procurement, not after redlines. Ask the vendor to enumerate every exclusion and confirm in a side letter that your documented use cases — including fine-tuning, RAG, and output modification — fall within covered use. Second, negotiate the modification carve-out language. The standard exclusion for "materially modified" outputs can be narrowed to modifications that are the proximate cause of the infringement, which is the formulation sophisticated counsel push for and vendors sometimes accept.

Third, address the notice-and-suspension trap. Many indemnities terminate protection if you continue using the output after the vendor notifies you of a claim. Negotiate a cure period of 30 to 90 days and require the vendor to offer a functionally equivalent workaround or refund. Fourth, align the indemnity with your insurance. If the vendor caps liability at 12 months of fees and your deployment touches regulated decisions, that cap may be a rounding error against actual exposure. Fifth, for agentic features, contractually define the human oversight controls the vendor requires for coverage, and document that your operations actually maintain them — because the vendor will audit compliance before paying any claim.

## Common Mistakes Buyers Make

The most expensive mistake is assuming the indemnity covers your actual architecture. TechTarget's guidance for CIOs entering AI vendor negotiations emphasizes that buyers routinely evaluate the model without mapping how outputs flow through their own systems — and the carve-outs are written precisely against those downstream steps. A second mistake is treating the indemnity as uncapped when it is not; many contracts cap IP indemnity at fees paid in the preceding 12 months, which for a $500,000 annual contract means $500,000 of protection against a claim that could cost millions in defense alone.

A third mistake is ignoring ownership of outputs altogether. The National Law Review's analysis of AI ownership in commercial and license agreements distinguishes between indemnity (who pays for a claim) and ownership (who holds rights to the output). Vendors may indemnify you while retaining ownership of outputs, or grant ownership while disclaiming any indemnity — and buyers conflate the two at their peril. Finally, teams often let individual business units adopt AI tools on self-serve terms, so the enterprise never sees the carve-outs until an incident occurs. Centralizing AI procurement review is the cheapest risk control available.

## The Regulatory Overlay: Colorado and Automated Decisions

Carve-outs interact with emerging regulation in ways that multiply exposure. Colorado's AI Act, enacted in 2024 with compliance obligations phasing in through 2026, imposes duties on developers and deployers of AI systems used for consequential decisions in areas like employment, lending, housing, and insurance. The statute allocates duties between developers and deployers — and a vendor indemnity carve-out for "customer use decisions" can shift regulatory compliance burden squarely onto the deployer, which is you.

This means a carve-out is not just about IP claims. If your vendor excludes liability for how you configure the system, and a regulator finds your configuration produced discriminatory outcomes, the indemnity provides nothing. Leadership teams running multi-team operations should map every AI use case against state AI statutes — Colorado first, with similar frameworks advancing in other states — and treat indemnity scope and regulatory duty allocation as a single negotiation.

## When to Act and What It Costs

Act before renewal, not after signature. Most enterprise agreements renew on 12-month cycles, and carve-outs are nearly impossible to amend mid-term. If you have AI deployments running on legacy terms signed before 2024, those contracts likely contain no AI indemnity at all, which is worse than a carve-out — it is silence. Budget 4 to 8 weeks for indemnity negotiation on a meaningful enterprise deal; vendors with standard AI terms may concede narrowing language within two redline cycles, while foundation model providers rarely move at all and instead offer their published indemnity programs on a take-it-or-leave-it basis.

The cost of getting this wrong is asymmetric. External IP counsel for a single copyright claim typically runs $300,000 to $1 million through summary judgment, before any settlement. Against that, the cost of 20 hours of contract negotiation and a technology transactions attorney review — roughly $15,000 to $40,000 — is trivial. For teams evaluating AI operations platforms, including command-center style tools that coordinate multi-team workflows, the evaluation should include a contractual risk review alongside the functional demo, because the platform that orchestrates agents across teams is precisely the architecture that sits inside the widest carve-outs.

## The Bottom Line

AI indemnification carve-outs are where the promise meets the fine print, and in 2026 the fine print is expanding faster than the promise. The pattern across the market is consistent: protection is strongest for unmodified generative outputs, weakest for agentic and autonomous behavior, and nearly absent for customer-side combinations and configurations. Buyers who map their actual AI architecture against the carve-out list before signing — and who negotiate proximate-cause language, cure periods, and regulatory duty allocation — convert an unbounded risk into a priced one. Buyers who skip this step are self-insuring without knowing it.

## Quick answers

### Do AI indemnities cover copyright claims from training data?

Usually only indirectly. Vendor indemnity programs like Copyright Shield-style commitments typically cover output-based infringement claims, not claims that the model's training data itself was infringing. Training-data litigation risk largely stays with the vendor, but the indemnity may not pay if a court finds the underlying model itself is tainted.

### What does 'materially modified' mean in an AI indemnity carve-out?

It is deliberately vague contract language excluding outputs the customer changed before use. Sophisticated buyers negotiate it down to modifications that are the proximate cause of the infringement, so routine editing does not void coverage.

### Are agentic AI features covered by vendor indemnities?

Increasingly, no. Vendors are explicitly carving autonomous actions out of indemnities or conditioning coverage on documented human-in-the-loop controls. Buyers should get the required controls in writing and verify their operations actually maintain them.

### How much liability cap should I accept on an AI indemnity?

Uncapped is the goal for IP indemnity, but a common fallback is a super-cap of 2-3x annual fees, well above the standard 12-month fees limitation. Anything capped at 12 months of fees is inadequate for claims that routinely cost seven figures to defend.

### Does the Colorado AI Act change vendor indemnity negotiations?

Yes. The Act allocates duties between AI developers and deployers for consequential decisions, so a carve-out for customer configuration can shift regulatory compliance burden to you. Ask vendors to warrant developer-side duties and clarify who bears regulatory defense costs.

Canonical: https://thane.zone/knowledge/what_are_ai_indemnification_carve-outs_and_why_do_they_leave_enterprises_exposed.php
Markdown: https://thane.zone/knowledge/what_are_ai_indemnification_carve-outs_and_why_do_they_leave_enterprises_exposed.php/index.md