AI Contract Lawyers Adelaide: AI Tool Terms, Data Licensing, Training Data and Output Ownership
AI contracts and data licensing in South Australia
Every AI tool comes with terms that decide what the vendor may do with the information a business enters, and who carries the loss when an output is wrong. Talon Legal reviews AI tool and vendor contracts, and drafts data licence, data sharing and data analysis agreements, for Adelaide businesses buying AI tools, building AI into their products or licensing their data. Book a same-day free 30-minute consultation or call (08) 7094 2021.
AI contract key facts
| Issue | Position in South Australia |
|---|---|
| Vendor use of inputs | For a business bound by the APPs, personal information collected for one purpose must not be used or disclosed for another without consent, unless an exception applies (APP 6.1). |
| Confidential inputs | A contract definition of confidential information does not by itself exclude equitable obligations (Optus Networks v Telstra at [29]). |
| Overseas processing | Reasonable steps so that an overseas recipient does not breach the APPs (APP 8.1). The business can be liable for the recipient's acts (Privacy Act section 16C). |
| Who owns outputs | Copyright needs a human author (Telstra v Phone Directories, Perram J at [118] and Yates J at [169]; Acohs at [57] to [58]). |
| Consumer guarantees | A business paying $100,000 or less can be a consumer (ACL section 3 and regulation 77A). Terms cannot exclude the guarantees (section 64(1)). |
| Unfair terms | An unfair term in a standard form small business contract is void (section 23(1)). |
| Automated decisions | From 10 December 2026, an APP entity's privacy policy must cover computer programs that make significant decisions using personal information, or do things substantially and directly related to making them (APP 1.7 and 1.8). |
| False claims | Body corporate maximum for a section 29 contravention: the greater of $100,000,000 and three times the benefit (or 30% of adjusted turnover during the breach turnover period if the benefit cannot be determined). Anyone else: $2,500,000 (section 224). |
| First step | Same-day free 30-minute consultation. Call (08) 7094 2021. |
Need an AI contract lawyer in Adelaide?
Our AI contract lawyers in Adelaide act for businesses buying or building AI tools, and for both sides of data licences. The Privacy Act 1988 (Cth), the Copyright Act 1968 (Cth) and the Australian Consumer Law (ACL), in Schedule 2 of the Competition and Consumer Act 2010 (Cth), sit under every AI contract. This page states the law current to 7 November 2026.
This guide is part of our artificial intelligence practice. Related guides cover AI and copyright, AI and privacy and software and SaaS agreements.
Free Consultation. Send us the AI tool’s terms or the draft data agreement before you sign, and an AI contract lawyer will show you where the risk sits. Book a same-day free 30-minute consultation or call (08) 7094 2021.
On this page
- What should a business check before signing up to an AI tool?
- Can an AI vendor use what the business enters?
- What security and offshore terms does an AI contract need?
- Who owns what an AI tool produces?
- Who is liable when an AI tool gets it wrong?
- Can a small business challenge an AI vendor's standard terms?
- What should a data licence or sharing agreement cover?
- Can personal information in licensed data be used to train AI?
- What changes from 10 December 2026 for AI decisions about people?
- What can a business say about its own AI product?
- How similar matters tend to play out
- How we act on AI contracts
- Case law
- Frequently asked questions
What should a business check before signing up to an AI tool?
The vendor’s terms, read against how the tool will be used. Most AI tools are sold as subscriptions on standard online terms, so the software and SaaS agreements guide covers the basics. AI adds its own questions.
- May the vendor keep, review or train on what the business enters?
- Where is the data processed, and who can see it?
- What security and incident notice does the vendor promise?
- Who owns the outputs, and will the vendor defend an infringement claim?
- What does the vendor accept if an output is wrong, and may it change the tool or terms mid-subscription?
The OAIC’s Guidance on privacy and the use of commercially available AI products (21 October 2024, updated 17 January 2025) says a business should do due diligence before adopting one, covering testing for the intended uses, human oversight, privacy and security risks, and who can access personal information.
Can an AI vendor use what the business enters?
Only as far as its terms allow, and the business’s own obligations limit what it may enter. Personal information means information or an opinion about an identified or reasonably identifiable individual (Privacy Act section 6(1)).
For businesses bound by the APPs, personal information collected for a primary purpose must not be used or disclosed for a secondary purpose unless the individual consents or an exception applies (APP 6.1). One exception is a related purpose the individual would reasonably expect, or a directly related one for sensitive information (APP 6.2(a)). The OAIC’s Guidance on privacy and the use of commercially available AI products (21 October 2024, updated 17 January 2025) says those rules apply to AI inputs and, as best practice, recommends not entering personal information, particularly sensitive information, into publicly available generative AI tools.
The AI and privacy guide covers which businesses the APPs bind.
Confidential client information needs the same care: entering it into a tool whose vendor may keep or train on it can breach the business’s promises to that client. Equity protects it too. In Optus Networks Pty Ltd v Telstra Corporation Ltd [2010] FCAFC 21, the Full Court set out the elements of breach of confidence in equity: information identified with specificity, with the necessary quality of confidence, received in circumstances importing an obligation of confidence, and actual or threatened misuse without consent ([39]). An exhaustive contract definition of confidential information did not show an intention to exclude equitable obligations ([29]).
The contract should treat inputs and outputs as confidential, limit the vendor’s use to providing the service, and exclude training unless the business opts in.
What security and offshore terms does an AI contract need?
Terms that let the business meet its own obligations. An APP entity must take reasonable steps to protect the personal information it holds from misuse, interference and loss, and from unauthorised access, modification or disclosure (APP 11.1), including technical and organisational measures (APP 11.3). The data security clauses guide covers the contract terms.
Many AI tools process data outside Australia. Before disclosing personal information to an overseas recipient, an APP entity must take reasonable steps so that the recipient does not breach the APPs, other than APP 1 (APP 8.1). If the recipient, not itself bound by the APPs, does something that would breach them, the act is taken to be the entity’s own breach (section 16C).
The OAIC’s APP guidelines (Chapter 8, updated 3 October 2025) say engaging an overseas contractor is, in most circumstances, a disclosure needing APP 8 compliance, though in limited circumstances, where a binding contract keeps the entity in effective control, it may be a use.
Where APP 8.1 applied and the overseas recipient holds the information, the notifiable data breach rules apply as if the business held it (section 26WC(1)), so the contract should require the vendor to report incidents quickly. The cyber incident response guide explains the 30-day assessment.
Who owns what an AI tool produces?
Possibly no one, if no person shaped it. Copyright subsists in an original unpublished literary work whose author was a qualified person when it was made (Copyright Act section 32(1)), and literary works include computer programs (section 10(1)). The cases require a human author.
In Telstra Corporation Ltd v Phone Directories Company Pty Ltd [2010] FCAFC 149, copyright did not subsist in directories produced largely by automated processes. Perram J said that where a computer performs the functions of human authors, and no person directs or fashions the material form, copyright does not subsist ([118]). Yates J said originality requires that a work originate from an author, a question of fact and degree ([169]). In Acohs Pty Ltd v Ucorp Pty Ltd [2012] FCAFC 16, source code created by the operation of a software system was not an original work ([57] to [58]).
Neither case concerned an AI tool, but their reasoning is the starting point for AI outputs. A vendor’s term giving the user the outputs is a contract between the user and the vendor. Whether copyright subsists depends on section 32(1) and a human author, so the term may leave the business nothing to own. A business that needs to own what it builds should keep people directing the work, and keep records. The AI and copyright guide covers authorship and infringement.
What people create follows the ordinary rules. The author owns the copyright (section 35(2)), and an employer owns an employee’s work under a contract of service (section 35(6)). Any copyright in a contractor’s work stays with the contractor unless assigned in writing, signed by or on the contractor’s behalf (sections 35(2) and 196(3)), and an assignment can cover future work (section 197(1)).
A business that publishes or sells outputs should also look for a vendor warranty against infringement, backed by an indemnity.
Who is liable when an AI tool gets it wrong?
Usually the business that relied on the output, unless the consumer guarantees or the contract shift the loss. Vendor terms commonly disclaim accuracy and cap liability.
The consumer guarantees can protect a business buyer. A person is a consumer if the amount paid or payable is $100,000 or less (ACL section 3(1)(a) and (3)(a), and regulation 77A), or, for services, if they are of a kind ordinarily acquired for personal, domestic or household use (section 3(3)(b)). Goods, which include computer software (section 2(1)), acquired for re-supply are excluded (section 3(2)).
Goods must be of acceptable quality (section 54). Services must be rendered with due care and skill (section 60) and be reasonably fit for any purpose the consumer makes known (section 61(1)). A term is void to the extent it purports to exclude, restrict or modify the guarantees (section 64(1)). For goods or services not ordinarily acquired for personal, domestic or household use, the supplier can limit liability to repair, replacement or resupply, or its cost, unless the buyer shows that relying on the limit is not fair or reasonable (section 64A).
Where the buyer is not a consumer, the contract decides, subject to the unfair terms rules. A limitation or exclusion clause is construed by its natural and ordinary meaning, read in the light of the contract as a whole, and against the party relying on it where appropriate in case of ambiguity (Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82 at [16]). In that appeal from South Australia, a clause limited the broker’s liability to $100 for each unauthorised contract ([19]).
Can a small business challenge an AI vendor’s standard terms?
Yes, if a term is unfair. A contract is a small business contract if at least one party employs fewer than 100 persons or had turnover under $10,000,000 in its last income year (ACL section 23(4)). An unfair term in a standard form consumer or small business contract is void (section 23(1)), and a contract alleged to be standard form is presumed to be one unless proved otherwise (section 27(1)).
A term is unfair if it would cause a significant imbalance, is not reasonably necessary to protect the legitimate interests of the party it advantages, and would cause detriment if relied on (section 24(1)). The vendor must prove the term is reasonably necessary (section 24(4)). Examples of terms that may be unfair include one-sided rights to vary the terms (section 25(d)) or the services (section 25(g)), and limits on the right to sue (section 25(k)).
In ACCC v JJ Richards & Sons Pty Ltd [2017] FCA 1224, the Court declared, on agreed facts, that eight terms of a supplier’s small business standard form contracts were unfair and void ([3], [6]). The parties agreed, and the Court accepted, that a right to raise prices for any reason, without a right for the customer to terminate, caused a significant imbalance ([56](b)), as did an unlimited indemnity ([56](g)). In ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928, a supplier of equipment, software and support ([1]) conceded its template terms were unfair, and the Court made consent declarations that its unilateral variation and liability limitation terms were unfair and void ([3]; declaration).
Since 9 November 2023, making a standard form contract with an unfair term the business proposed, or relying on such a term, is also a contravention (section 23(2A) and (2C)). For a body corporate, the maximum penalty is the greater of $100,000,000 and three times the benefit (or 30% of adjusted turnover during the breach turnover period if the benefit cannot be determined). For anyone else it is $2,500,000 (section 224(3) and (3A)).
What should a data licence or sharing agreement cover?
Mainly the permitted purposes and who owns what is made from the data. Data licences, sharing agreements and data analysis agreements raise the same issues.
- The data, its source, and any personal information or third-party material in it.
- The licence: exclusive or not, term, territory and permitted purposes. If the data may be used to train AI models, say so; if not, say that too.
- Derived and combined data: who owns results, trained models and merged datasets.
- Warranties that the data may lawfully be supplied and used.
- Security, audit, breach notice, and deletion or de-identification at the end.
Data does not always carry copyright. In Telstra v Phone Directories, Yates J said the computer process was of such overwhelming significance to the directories’ form that they could not be said to originate from authors ([169]). Where a dataset has no copyright, the licence and the law of confidence do the protective work, so the data should be identified with specificity and supplied in confidence (Optus Networks at [39]).
De-identification is also a legal duty. An APP entity holding personal information it no longer needs for any permitted purpose must take reasonable steps to destroy or de-identify it, subject to limited exceptions (APP 11.2). The agreement should impose the same duty on the recipient, with a deadline.
Can personal information in licensed data be used to train AI?
Only within the Privacy Act. The OAIC’s Guidance on privacy and developing and training generative AI models (21 October 2024, updated 23 October 2024) says publicly available data is not automatically lawful to use for training or fine-tuning. It lists APPs 1, 3, 5, 6 and 10 as particularly relevant and recommends a privacy impact assessment. It says training on personal information already held, where that was not a primary purpose of collection, needs consent or a reasonable expectation and relatedness, or another exception, and that where that cannot be clearly established, the business should seek consent, offer a meaningful and informed opt-out, or both. It also says many photographs or recordings of individuals, including artificially generated ones, contain sensitive information.
A supplier bound by the APPs has to consider APP 6.1, which covers disclosure as well as use. The guidance also lists APP 3, which matters to the recipient. An organisation must not collect personal information, other than sensitive information, unless reasonably necessary for its functions or activities (APP 3.2). Sensitive information also needs consent, unless APP 3.4 applies (APP 3.3).
The licence should record what personal information is included, what individuals were told, and which party handles notices and complaints. Licence terms for material used in training are covered in the AI and copyright guide.
What changes from 10 December 2026 for AI decisions about people?
From 10 December 2026, an APP entity that has arranged for computer programs to make significant decisions about individuals, using their personal information, must say so in its privacy policy. The APP 1.7 trigger, from 10 December 2026, is a decision, or a thing substantially and directly related to making one, that could reasonably be expected to significantly affect an individual’s rights or interests.
From 10 December 2026, the policy must set out the kinds of personal information used, the kinds of decisions made solely by the programs, and the kinds of decisions for which the programs do a thing substantially and directly related to making them (APP 1.8). From 10 December 2026, failing or refusing to decide counts, and the examples include decisions affecting rights under a contract or access to a significant service or support (APP 1.9). The rules apply to decisions made from 10 December 2026, even if the arrangement or the information predates them (Privacy and Other Legislation Amendment Act 2024, Schedule 1, item 89).
From 10 December 2026, APP 1.7 also joins the principles enforceable by infringement and compliance notices, with a maximum civil penalty of 200 penalty units (section 13K). The vendor contract should require the vendor to explain what personal information the tool uses and what it decides alone. The AI and privacy guide covers the new rules.
What can a business say about its own AI product?
Only what it can prove. A person must not, in trade or commerce, engage in conduct that is misleading or deceptive or likely to mislead or deceive (ACL section 18(1)). A person must not make false or misleading representations that goods or services are of a particular standard or quality (section 29(1)(a) and (b)), or have performance characteristics, uses or benefits (section 29(1)(g)). A representation about a future matter is taken to be misleading if made without reasonable grounds (section 4(1)).
Accuracy rates, claims that no human review is needed, and claims that a product uses AI at all need evidence. The OAIC’s Guidance on privacy and developing and training generative AI models (21 October 2024, updated 23 October 2024) says developers should take reasonable steps for accuracy, such as testing, and that disclaimers may be appropriate. A disclaimer cannot exclude the consumer guarantees (section 64(1)), and misstating a customer’s rights is itself prohibited (section 29(1)(m)).
Section 29 carries the section 224 maximums set out above, and a customer who suffers loss from misleading conduct can recover damages (section 236(1)). The business’s own standard terms face the same unfair terms rules as its vendors’ terms.
How similar matters tend to play out
Illustrations of how the law on this page combines on ordinary facts, not predictions. Outcome depends on the documents and the evidence.
Lower range. An Adelaide engineering consultancy with 30 staff finds staff pasting client specifications into a free AI tool whose terms allow training and changes at any time. The specifications were received in confidence (Optus Networks at [39]). The vendor contract is a small business contract (ACL section 23(4)), and a one-sided right to vary may be unfair (section 25(d)). The fix is a plan that excludes training.
Middle range. A software company takes a licence of a retailer’s loyalty card data to train a forecasting model. The licence is silent on derived data, and on termination the retailer claims the model. Copyright may not subsist in the dataset (Telstra v Phone Directories, Yates J at [169]), so the dispute turns on the licence and confidence (Optus Networks at [39]). Data identifying cardholders is personal information (Privacy Act section 6(1)), and an APP entity must take reasonable steps to destroy or de-identify it once no longer needed (APP 11.2).
Upper range. A start-up sells property managers a tool that scores rental applicants, advertised as “99% accurate”, on terms letting it change the model at will and excluding all liability. If the claim is false or misleading, making it contravenes ACL section 29(1)(g), which carries the section 224 maximums. The exclusion is void so far as it excludes guarantees owed to consumers (section 64(1)), and the change-at-will term may be unfair (section 25(g)). From 10 December 2026, customers that are APP entities may need to describe those decisions in their privacy policies (APP 1.7).
How we act on AI contracts
Our AI contract lawyers act for buyers and sellers of AI tools, and for both sides of data licences.
| Stage | What happens | What we do |
|---|---|---|
| Choosing a tool | The business shortlists AI tools. | Review the terms against the planned use. |
| Negotiating | The vendor offers standard or enterprise terms. | Negotiate data use, confidentiality, IP warranties and the liability cap. |
| Data agreements | Data is licensed, shared or sent for analysis. | Draft purposes, derived data, privacy and deletion terms. |
| Launching a product | The business sells AI-enabled products. | Check claims, terms and the privacy policy, including the rules from 10 December 2026. |
| Disputes | An output causes loss or data is misused. | Advise on contract, consumer law and confidentiality claims. |
We cannot promise an outcome, and no lawyer can. We can make sure the terms are read before the data goes in.
Every hour matters. Book a same-day free 30-minute consultation, or call (08) 7094 2021 now.
AI contract case law
None of these cases concerned an AI tool or a data licence; each decided a point that applies to one.
| Case | Court | Principle | Pinpoint |
|---|---|---|---|
| Optus Networks Pty Ltd v Telstra Corporation Ltd [2010] FCAFC 21 | Full Federal Court | Confidence in equity survives a contract definition | [29], [39] |
| Telstra Corporation Ltd v Phone Directories Company Pty Ltd [2010] FCAFC 149 | Full Federal Court | Perram J and Yates J: works need a human author | [118], [169] |
| Acohs Pty Ltd v Ucorp Pty Ltd [2012] FCAFC 16 | Full Federal Court | Software-generated code not original | [57], [58] |
| Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82 | High Court | Reading limitation clauses | [16], [19] |
| ACCC v JJ Richards & Sons Pty Ltd [2017] FCA 1224 | Federal Court | Price variation and indemnity terms declared unfair | [3], [6], [56] |
| ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928 | Federal Court | Equipment and software contract terms declared void by consent | [1], [3] |
Case notes
Optus Networks Pty Ltd v Telstra Corporation Ltd [2010] FCAFC 21
An exhaustive contract definition of confidential information did not show an intention to exclude equitable obligations ([29]), and the Full Court stated the elements of breach of confidence ([39]).
Telstra Corporation Ltd v Phone Directories Company Pty Ltd [2010] FCAFC 149
The appeal was dismissed: copyright did not subsist in the directories. Perram J said an operator who does not control the material form is not its author ([118]); Yates J said the works did not originate from authors ([169]).
Acohs Pty Ltd v Ucorp Pty Ltd [2012] FCAFC 16
The Full Court agreed with the primary judge that source code created by a software system did not emanate from authors and was not an original work ([57] to [58]).
Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82
Exclusion and limitation clauses are read by their natural and ordinary meaning, in the light of the whole contract ([16]). A $100 limit applied to each unauthorised contract ([19]).
ACCC v JJ Richards & Sons Pty Ltd [2017] FCA 1224
Moshinsky J declared, on agreed facts, that eight small business contract terms were unfair and void ([3], [6]). The parties agreed, and the Court accepted, that price variation and indemnity terms caused a significant imbalance ([56]).
ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928
The supplier conceded its small business template terms were unfair, and the Court made consent declarations that they were unfair and void ([3]; declaration).
Frequently asked questions
Can an AI vendor train its models on a business's data?
Only if its terms allow it. For a business bound by the APPs, personal information must not be used or disclosed for a secondary purpose without consent unless an exception applies (APP 6.1).
Can staff put customer information into a public AI tool?
It is a risk to control. The OAIC’s Guidance on privacy and the use of commercially available AI products (21 October 2024, updated 17 January 2025) says that, as best practice, personal information should not be entered into publicly available generative AI tools.
Who owns content created with an AI tool?
Possibly no one, where the tool rather than a person shaped it (Telstra v Phone Directories, Perram J at [118]). A person’s contribution belongs to its author, an employer or a written assignee (Copyright Act sections 35(2), 35(6) and 196(3)).
Can an AI vendor exclude liability for wrong answers?
Partly. Terms cannot exclude the consumer guarantees, and a business paying $100,000 or less can be a consumer (ACL sections 3 and 64(1)). Otherwise the clause is read by its natural and ordinary meaning (Darlington at [16]).
Do the unfair contract terms laws apply to AI tool terms?
Yes, for standard form small business contracts, where a party employs fewer than 100 persons or had turnover under $10,000,000 in its last income year (ACL section 23(4)).
Who owns a model trained on licensed data?
The agreement should settle it. An assignment of copyright has no effect unless in writing signed by or on behalf of the assignor (Copyright Act section 196(3)). A dataset compiled largely by automated processes may carry no copyright (Telstra v Phone Directories, Yates J at [169]).
Can a business use an AI tool that processes data overseas?
Yes, with care. An APP entity must take reasonable steps so that the overseas recipient does not breach the APPs (APP 8.1), and may answer for its breaches (Privacy Act section 16C).
What changes in December 2026 for businesses using AI to make decisions?
From 10 December 2026, an APP entity’s privacy policy must describe significant decisions that computer programs make using personal information, or for which they do a thing substantially and directly related to making them (APP 1.7 and 1.8). From 10 December 2026, APP 1.7 can also be enforced by infringement and compliance notices (section 13K).
Can a business advertise its product as AI-powered?
Only if it is true. False or misleading claims about performance characteristics are prohibited (ACL section 29(1)(g)), and claims about future capability need reasonable grounds (section 4(1)).
Do I need an AI contract lawyer?
Before signing enterprise AI terms or a data licence, yes. An AI contract lawyer can read the terms against how the tool or data will be used. A free 30-minute consultation will tell you where you stand.