The Legal Issues to Check First in the Terms of Use of Generative AI Services

Hello, I'm Noriaki Asato, Representative Attorney at LegalAgent.

When introducing a generative AI service into your business, check the contract terms as well as its usability. Read the terms of use, privacy policy, data processing terms, security documentation, SLA and so on, and confirm whether it is an environment to which you can entrust your company's information and whether you can use the output as work product.

The information handled and the way output is used vary from one AI service to another, whether for drafting text, contract review, sales support or other purposes. You therefore need to read the clauses from a perspective different from that of conventional SaaS contracts.

Checklist for Reviewing the Terms

I have organized the items to check so that you can compare them against the terms at hand during your review.

• Whether input data is used for model training, and the applicable conditions (differences by plan or account type)
• Whether the use constitutes provision to a third party or subcontracting under confidentiality obligations owed to customers
• Ownership of rights in the output, and the allocation of responsibility and indemnity clauses in the event of infringement of third-party rights
• Where personal information is entered, the classification as entrustment, provision to a third party or transfer abroad
• Whether there is a review flow by attorneys or legal staff before AI output is presented outside the company

Conditions for Handling Input Data

The first thing to look at when you open the terms of use is the handling of input data. Check how prompts, attached files, customer information and source code are used by the provider.

The core question is whether input data is used for machine learning of AI models. Whether it is used for training is determined by comparing not only the text of the terms for each contract plan but also the actual settings in the admin console. Do not jump to conclusions about legality or contractual permissibility based only on the plan name or the words "training off"; the company needs to decide internally which plans and accounts will be used to handle what.

Also check how long data is retained and whether it can be deleted. Check who has access to logs and whether administrators can audit usage. Because the conversation history itself may constitute business secrets, treat the entire text entered, not just whether files are attached, as subject to information management.

Confidentiality Obligations and Customer Information

Particular caution is required when entering information received from customers into an AI service. Master transaction agreements and non-disclosure agreements with customers often include provisions on the handling of confidential information, provision to third parties, restrictions on the use of external cloud services, and so on.

Whether sending data to an AI provider constitutes provision to a third party or subcontracting under the contract, or falls within the scope of ordinarily anticipated tool use, depends on the wording of the contract clauses and the form of use. Advance checks are indispensable especially when handling highly confidential materials such as those relating to M&A, fundraising or unpublished business plans.

Do not assume a service is safe based only on its name recognition or general reputation; judge by whether its use conflicts with the contractual obligations your company owes to its customers.

Rights in the Output and Responsibility

When using generative AI, also confirm the rights relating to the output. Check whether the generated text, images and proposed contract clauses can be used as your company's work product, how responsibility is allocated if they infringe third-party intellectual property rights or the like, and how the provider's disclaimers and indemnities are set out.

When using AI for contract review or drafting legal comments, you also need to pay attention to the accuracy of the output. Even if the terms grant you the right to use the output, that does not mean its content is legally correct. Avoid sending AI output outside the company as is, and build your workflow on the premise that an attorney or legal staff member does the final check.

Specialist knowledge is indispensable for interpreting specific laws and judging legal risk according to the facts of each case. AI is a powerful means of supporting legal work, but the decision to adopt its output rests with people.

Personal Information Protection and Transfers Abroad

When entering personal information into an AI service, check consistency with the Act on the Protection of Personal Information (APPI). Determine whether it can be characterized as entrustment or constitutes provision to a third party, whether data will be sent to providers or servers abroad, and whether the necessary consent of the individuals or measures to provide information have been taken. Even where it constitutes entrustment, there are situations in which the rules on provision to a third party in a foreign country must be considered separately.

In areas such as recruitment, labor management, customer support and sales support, there is a higher likelihood of handling personal information of candidates, employees and customers. If you introduce a service while leaving the provider's data processing terms unclear, you may later struggle to explain yourself inside and outside the company.

Because regulations and guidelines are revised from time to time, do not rely on past general knowledge; check the latest rules as of the time of your review and respond accordingly. The 2026 amendment act was enacted on July 10 and promulgated on July 17. According to the announcement by the Personal Information Protection Commission (Japanese), apart from certain provisions, it will take effect on a date to be specified by Cabinet Order within two years of promulgation. Do not confuse promulgation with entry into force; prepare by checking the effective date and the specific rules of each provision.

Read the Contract Together with How the Work Is Actually Done

Simply looking at the provisions of the terms will not give you a full sense of the degree of risk. Once you understand which departments will use the service, for what work, what information they will handle and what work product they will create, it becomes easier to judge whether the contract terms fit that use.

For that reason, when introducing generative AI, it is important for the business divisions, the IT department and the legal department to share the same assumptions from an early stage. In my view, the role of corporate legal work is not only to point out legal concerns but also to show concretely the conditions under which use is permitted and the risks that remain.

At LegalAgent, we support the review of AI service terms as an effort that connects the design of governance with the flow of work on the ground.

Frequently asked questions

When reviewing the terms of use of a generative AI service, what issue should you focus on first?

The central issue is whether input data is used for machine learning of the AI model. This is because it is necessary to confirm how confidential information such as prompts and attached files is used on the provider's side. I think the company should not only check the text of the terms but also cross-check the settings on the admin console, and internally confirm the data retention period, whether data can be deleted, and even the administrator's audit rights.

Is entering information received from customers into a generative AI service a breach of contract?

Depending on the wording of the non-disclosure agreement or the like with the customer and how the tool is used, there is a risk of breach of contract. This is because sending data to the AI provider may be evaluated as provision to a third party or subcontracting under the contract. I think the company should not decide based only on the tool's name recognition or reputation, but should individually check whether its use conflicts with the confidentiality obligations it owes to customers or with restrictions on the use of external tools.

When entering personal information into a generative AI service, what needs to be checked under the Act on the Protection of Personal Information (APPI)?

Check the classification as entrustment or provision to a third party, whether it constitutes a transfer abroad, and whether the required consent of the individual or other measures are in place. This is because introducing the service while leaving the provider's data processing conditions vague will later make it difficult to explain the matter internally and externally. In addition, given that the 2026 amendment act has been enacted and promulgated, I think it is necessary to avoid confusing promulgation with entry into force, and to prepare by checking the effective date of each provision and the latest rules.