Published
8 MIN READ
AI Implementation Contract: What It Should Include
An AI implementation contract defines what the vendor will build, which accounts everything lives in, who owns the code, the prompts and the data, who pays for model usage and how the company leaves with what belongs to it. It's worth more than the proposal, because it's what remains when something goes wrong.
This article is a business checklist, not legal advice: the final wording of the clauses is your lawyer's job. What changes the outcome is coming to the table knowing what to ask, and that's what the next sections organize.
At Wama, the execution contract never comes first. Before it comes the AI Assessment, which produces the custom Implementation Plan and gives the contract a scope that can be verified. If you're still comparing vendors, you'll find the criteria in the article on how to choose an AI implementation company, and the role of the assessment that precedes the project is explained separately.
What does an AI implementation contract need to include?
A complete AI implementation contract covers seven blocks. If one of them is left out, the gap shows up later, almost always at the worst moment.
Purpose and scope: what will be built, with what type of AI and in which processes.
Accounts and keys: whose name the model, hosting and repository are under.
Code, prompts and configuration: who owns each piece and what is only licensed.
Data: each party's role under the LGPD, Brazil's data protection law, permitted use and what happens to it at the end.
Acceptance and review: the number that approves the delivery and who checks what the AI produces.
Recurring cost: model usage, hosting and support after delivery.
Exit: what the vendor hands over, and how fast, when the contract ends.
The contract carries more weight because there's still no general AI law in force in Brazil. As an article in Congresso em Foco from June 11, 2026 points out, bill PL 2,338/2023 was approved in the Senate and is still moving through the Chamber of Deputies. The same article recommends that the purpose clause state whether the AI uses third-party models, whether the client's data can feed the system and where there's human intervention. These seven blocks follow the stages of AI implementation in companies, from pilot to operation.
Whose name are the accounts and keys under?
The accounts should be in the hiring company's name, on its card, and the vendor should get in by invitation, with access that can be revoked. This applies to the model provider account, the API key, hosting, the code repository, the database and the WhatsApp number, when there is one.
When the API key sits in the vendor's account, the company pays for usage inside the vendor's monthly fee and can't see how much it spends. It also loses the operation the day the relationship ends. Model usage is billed in dollars per token, as the article on how much it costs to implement AI shows, and that bill needs to reach the company with no middleman.
On the websites Wama delivers, that's already the rule: the project is transferred to the client's account and the subscription stays on the client's card. The AI contract should ask for the same, account by account, with an attached list of each access, who created it and who can revoke it.
Code, prompts and configuration: who owns each piece
The law gives a starting point, and the contract decides the rest. Under article 4 of Brazil's Software Law, from 1998, the rights to a program developed under a services contract belong to the client, unless otherwise stipulated. That exception is exactly what you need to look for in the text the vendor sends.
In an AI project, the code is only part of what gets built. System prompts, agent instructions, routing rules, the organized knowledge base and the test cases that measure quality also need to appear in the contract, with the right to export and modify them. In Wama's view, an agent without its prompts and test cases is hard to maintain, even with the code in hand.
Also ask for the list of components the vendor already had before the project and those that belong to third parties, with each one's license. Whatever isn't transferred needs a license that remains valid after the contract ends. The article on who owns the source code of custom software details this part of the law.
What does the contract say about data?
The contract needs to say that the vendor processes your company's data only to carry out the project and only according to your instructions. Brazil's General Data Protection Law (LGPD) already defines that role: under article 39, the processor handles data according to the controller's instructions, and article 37 requires both to keep records of the processing operations.
Article 16 of the same law requires personal data to be deleted at the end of processing, with exceptions such as legal obligations. In the contract, this becomes a clause for return or verified deletion when the relationship ends, with a defined deadline and format.
The ANBIMA best practices guide for contracting AI systems, published in December 2025 for Brazil's financial market, adds questions that work for any company. Can the data train models used with other clients? In which countries is it processed? The guide recommends avoiding contracts that authorize broad use of data with vague justifications, such as system improvement. The other precautions are in the article on LGPD in products with artificial intelligence.
Acceptance, human review and the cost that continues
Acceptance needs a number, not an impression. The contract should state which measure approves the delivery, such as response time, accuracy rate on a sample of cases or volume of requests resolved without intervention, compared with the baseline measured before the project.
Human review goes in the same block. The contract should name who checks what the AI produces before it reaches the end customer and what happens when it gets something wrong. At Wama, every AI output gets human review before it goes to the client, and it's reasonable to require an equivalent written rule from the vendor. If you don't have internal rules yet, you can start with the company AI usage policy.
After delivery, three costs continue: model usage, hosting and support. The contract should separate each one, say what's included in support and how much anything not included costs, such as a new integration or a larger volume of data.
Common mistakes
A generic ownership clause. "All IP belongs to the client" without listing code, prompts, knowledge base and test cases leaves room for dispute over precisely what matters most.
The API key on the vendor's card. The company loses visibility into spending and operational continuity at the same time.
Overly broad access. The agent needs minimal permissions in each system, as the article on what to grant the agent when integrating a CRM with AI explains.
Acceptance without a number. Without a written measure, the delivery gets approved out of fatigue.
No exit plan. Without a deadline and export format, switching vendors means redoing the project.
Frequently asked questions
Who should draft the AI implementation contract?
Your company's lawyer, or the vendor's reviewed by yours. The business side's role is to bring the list of points the text needs to cover: accounts, assets, data, acceptance, recurring cost and exit. A checklist like this one organizes the conversation, but it doesn't replace legal analysis of the specific case.
Does the AI implementation contract need to address the LGPD?
It does whenever the AI touches personal data, which happens in almost every customer service, sales or sign-up process. The contract should make clear that the vendor acts as processor, follows the client's instructions, keeps records of operations and deletes or returns the data at the end of the relationship.
What happens to the AI agent when the contract ends?
It depends on what's written. Without an exit clause, the vendor can shut down the agent and keep the prompts, configuration and history. With one, the company receives code, prompts, knowledge base, test cases and data in an open format, within a defined deadline, and can continue with another team.
Fixed-price project contract or monthly service?
Both work, as long as the contract says what's included. In a fixed-price project, delivery ends at acceptance and maintenance is contracted separately. In a monthly service, the vendor operates the system and the monthly fee needs to separate work, support and model usage, so the company knows what it's paying for.
Where do you start before signing an AI implementation contract?
With the scope. Without knowing which processes will get AI and how they work today, there's no way to write acceptance, cost or timeline. At Wama, that scope comes out of the AI Assessment, a small, paid first step whose fee is deducted from the first installment when the client moves on to the plan.
If your company is going to hire AI implementation and wants to reach the contract with the scope already defined, start with the process that takes up the most of your team's time. Talk to Wama about the AI Assessment.
