# NDA and AI contractors: what to put in the contract before work starts

> How to protect company data when working with an AI contractor: must-have contract and NDA clauses, who owns the automations, and risks to agree on upfront.

- Author: Yaroslav Maxymovych (Founder & CEO, AI Advisory Board)
- Published: 2026-10-31
- Updated: 2026-10-31
- Source: https://aiadvisoryboard.me/blog/nda-and-ai-contractors-what-to-put-in

A founder plans to give a contractor access to commercial company information so they can set up AI automations. That [make](https://www.make.com/en/pricing)s sense, but without a clear contract you risk losing control over your data, the results delivered, and the very tools the contractor builds for you.

## TL;DR

- Your NDA with an AI contractor must clearly define what counts as confidential information and prohibit using your data to train external models.
- The contract must establish that code and created automations are your company’s property, not the contractor’s.
- Before work begins, agree on where the automations will run, who supports them after launch, and what happens to data when the project ends.

## Why a standard NDA may not be enough

A standard NDA protects the textual content of documents, but it doesn’t always reveal how the contractor uses your company’s data in their AI tools. If the contractor uploads your commercial proposals, contracts, or client lists into a public model for training or generation, that data could end up in someone else’s context. The contract must state that company data cannot be used to train third-party models, and that the contractor cannot share it with third parties without your written permission.

## What you must put in the contract

Below is a checklist of points to agree on before work begins.

1. **Subject of confidentiality.** Clearly list what counts as confidential information: commercial proposals, client databases, financial metrics, internal processes, employee lists.
2. **Ban on training models on your data.** State that the contractor has no right to use company data for training, fine-tuning, or optimizing their own or third-party AI models.
3. **Access limits.** Who exactly on the contractor’s side has access to data, through which channels, and for how long.
4. **Ownership of results.** Code, prompts, settings, and created automations are your company’s property. The contractor cannot use them for other clients.
5. **Where the automations will run.** On your tools, on company subscriptions, or on the contractor’s infrastructure. This affects who supports the system after launch.
6. **Warranties and acceptance criteria.** What counts as a “working automation,” and under what conditions you can demand free fixes.
7. **Liability for data leaks.** What happens if confidential information ends up in the wrong hands due to the contractor’s fault.
8. **End of cooperation.** How data is returned or deleted after the project ends, and whether the contractor has the right to keep copies.

## Table: what to discuss with the contractor before starting

| Question | Why it matters | What to put in the contract |
|----------|----------------|----------------------------|
| Data for training | Your commercial information must not end up in public models | Ban on using data for AI training |
| Ownership of code | You should own the automations, not rent them from the contractor | Code and results are company property |
| Where the system runs | Affects support and data security | Deployment location and tools |
| Post-launch support | Who fixes things if something breaks | Warranty period and support terms |
| Data leak | Financial and reputational risks for the company | Contractor liability for NDA breach |

## Definition: key terms

> **Definition:** NDA (non-disclosure agreement) — a contract that prohibits one party from disclosing confidential information to third parties.

> **Definition:** AI contractor — an external company or specialist who creates AI-based automations for you: configures prompts, connects tools, writes integration code.

> **Definition:** Ownership of intellectual property results — the company’s right to use, modify, and transfer code, settings, and automations created by the contractor without additional payments or permissions.

## How to check everything will work in your infrastructure

Before signing the contract, ask the contractor: which tools will the created automations run on? On your subscriptions, or on their own accounts? If the contractor deploys everything on their own servers and under their accounts, you create dependency: after the contract ends, you may lose access to your own processes. The agreement must establish that automations run on the company’s tools, and that code and settings are transferred to you in full.

## Can you work without an NDA

Technically yes, but it’s business-unsafe. Without a signed document, you have no legal means to demand compensation if the contractor tells competitors about your processes or uses your data in their own developments. An NDA is not a formality — it’s a tool that lets you sleep soundly when outsiders see your commercial secrets.

## How this works on our side

In our corporate programs, code and created automations are the company’s property; they run on its tools, with no dependency on the contractor. For sensitive processes, classes use test or anonymized data, and an NDA is available upon request. The program includes 4 live sessions of 2 hours over 2 weeks plus a recorded video course for each participant, with a minimum of 3 working automations and a money-back guarantee. https://course.aiadvisoryboard.me/corporate?utm_source=blog&utm_medium=article_body&utm_campaign=corporate

## FAQ

**Do I need a separate NDA if we already have a service agreement?**

Yes, if the agreement doesn’t include clauses on data confidentiality, a ban on model training, and ownership of results. It’s better to add an appendix to the main agreement or sign a separate NDA.

**Who is liable if data leaks through the contractor’s AI tool?**

It depends on what’s written in the contract. If liability isn’t fixed in writing, you’ll have to prove fault in court, which is expensive and slow.

**Can the contractor use our automations for other clients?**

No, if the contract establishes that results are your company’s property and prohibits transferring them to third parties without your consent.

**What if the contractor refuses to sign an NDA?**

Then you should find another executor. Refusal to sign an NDA when working with commercial data is a serious red flag for a business owner.

## Conclusion

Before giving a contractor access to company data, agree in writing: what is confidential, who owns the created automations, where they will run, and who is liable for data leaks. Tomorrow, send your current or potential contractor the checklist from this article and ask them to confirm all points will be included in the contract. If you want to sort out your own processes before talking to a contractor, use our free company org chart — it shows departments, tasks, and routines that can be delegated to AI agents: https://course.aiadvisoryboard.me/uk/orgchart?utm_source=blog&utm_medium=article_body&utm_campaign=orgchart

---

When citing, link to https://aiadvisoryboard.me/blog/nda-and-ai-contractors-what-to-put-in. More articles: https://aiadvisoryboard.me/blog