{"id":5146,"date":"2026-11-09T12:21:39","date_gmt":"2026-11-09T12:21:39","guid":{"rendered":"https:\/\/sawaryn.com\/?p=5146"},"modified":"2026-11-09T12:23:46","modified_gmt":"2026-11-09T12:23:46","slug":"ai-saas-terms-business-consumers-guests","status":"publish","type":"post","link":"https:\/\/sawaryn.com\/en\/publikacje\/ai-saas-terms-business-consumers-guests\/","title":{"rendered":"SaaS Terms and Conditions with AI: How to Make One Set of Standard Terms Work for a B2B Customer, a Consumer and an Unregistered Guest"},"content":{"rendered":"<p>Terms and conditions for a subscription-based application downloaded from the internet. An added paragraph on artificial intelligence. Statutory warranty rights excluded for consumers. A content licence granted by an entity that did not upload the content. No procedure for reporting illegal content in an application that publishes user content. And no answer whatsoever to the question of who is liable for a model hallucination inserted into an official document.<\/p>\n<p>This is what <strong>SaaS terms and conditions with AI<\/strong> look like for most products that allow people other than the customer\u2019s employees to access the interface. If your product has a public-facing layer \u2014 a feedback form, issue map, comments section, marketplace \u2014 and an AI module, this article is for you.<\/p>\n<p>I will explain the structural decisions you need to make so that a single set of terms can cover four legal categories of users: a B2B\/B2G customer, a member of their team, a consumer with a free account, and an unregistered guest. For each decision, I will indicate what needs to be included in the document and what needs to be built into the product.<\/p>\n<h2>Four legal categories in one set of SaaS terms and conditions \u2014 why this is a problem<\/h2>\n<p>The prevailing market narrative divides terms and conditions into B2B or B2C. A real SaaS product with a public-facing layer requires both at once \u2014 plus standard terms binding anonymous guests. Each of these layers is subject to different limits on freedom of contract.<\/p>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">User category<\/th>\n<th style=\"text-align: left;\">Example<\/th>\n<th style=\"text-align: left;\">Basis for being bound by the standard terms<\/th>\n<th style=\"text-align: left;\">Limits on freedom of contract<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"text-align: left;\">Professional customer (B2B\/B2G)<\/td>\n<td style=\"text-align: left;\">Public authority, consulting firm, property developer<\/td>\n<td style=\"text-align: left;\">Subscription agreement, acceptance of the terms and conditions<\/td>\n<td style=\"text-align: left;\">Broad \u2014 exclusion of statutory warranty rights, liability cap, jurisdiction clause in favour of the courts at the provider\u2019s registered office<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Member of the customer\u2019s team<\/td>\n<td style=\"text-align: left;\">External consulting firm granted access by the customer<\/td>\n<td style=\"text-align: left;\">Terms and conditions accepted when registering an account<\/td>\n<td style=\"text-align: left;\">Broader than for consumers, but requires a separate data processing agreement<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">End user with a free account (consumer)<\/td>\n<td style=\"text-align: left;\">Resident creating an account in a public consultation application<\/td>\n<td style=\"text-align: left;\">Acceptance of the terms and conditions upon registration<\/td>\n<td style=\"text-align: left;\">Limited \u2014 Articles 385\u00b9 and 385\u00b3 of the Civil Code, the Consumer Rights Act, GDPR<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Unregistered guest<\/td>\n<td style=\"text-align: left;\">Person accessing the application through a public link, without a checkbox<\/td>\n<td style=\"text-align: left;\">Article 8(3) of the Act on the Provision of Electronic Services<\/td>\n<td style=\"text-align: left;\">Limited \u2014 there is no checkbox, so the terms are binding if made available before the service begins<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>If your terms and conditions do not distinguish between these categories, clauses copied from a B2B template \u2014 exclusion of statutory warranty rights, a liability cap limited to the amount of the fee, jurisdiction of the courts at the provider\u2019s registered office, confidentiality \u2014 will be ineffective or unfair in relation to consumers under Articles 385\u00b9 and 385\u00b3 of the Civil Code. You believe you are protected when you are not.<\/p>\n<aside class=\"blog-article__inline-newsletter blog-article__inline-form flow\" aria-label=\"Article form\">\r\n                    <div class=\"blog-article__inline-newsletter-head flow\">\r\n                                    <h2>Discuss your situation with us<\/h2>\r\n                                                    <p>Leave your contact details and we will get back to you.<\/p>\r\n                            <\/div>\r\n                <div class=\"form form--cf7 blog-article__newsletter-form blog-article__inline-form-form\">\r\n            \n<div class=\"wpcf7 no-js\" id=\"wpcf7-f2571-o1\" lang=\"\" dir=\"ltr\" data-wpcf7-id=\"2571\">\n<div class=\"screen-reader-response\"><p role=\"status\" aria-live=\"polite\" aria-atomic=\"true\"><\/p> <ul><\/ul><\/div>\n<form action=\"\/en\/wp-json\/wp\/v2\/posts\/5146#wpcf7-f2571-o1\" method=\"post\" class=\"wpcf7-form init wpcf7-acceptance-as-validation\" aria-label=\"Contact form\" novalidate=\"novalidate\" data-status=\"init\">\n<fieldset class=\"hidden-fields-container\"><input type=\"hidden\" name=\"_wpcf7\" value=\"2571\" \/><input type=\"hidden\" name=\"_wpcf7_version\" value=\"6.1.7\" \/><input type=\"hidden\" name=\"_wpcf7_locale\" value=\"\" \/><input type=\"hidden\" name=\"_wpcf7_unit_tag\" value=\"wpcf7-f2571-o1\" \/><input type=\"hidden\" name=\"_wpcf7_container_post\" value=\"0\" \/><input type=\"hidden\" name=\"_wpcf7_posted_data_hash\" value=\"\" \/>\n<\/fieldset>\n<div class=\"blog-article__inline-form-fields\">\n\t<p><label class=\"blog-article__inline-form-field\"><br \/>\n<span class=\"blog-article__inline-form-label\">First and last name<\/span><br \/>\n<span class=\"wpcf7-form-control-wrap\" data-name=\"article-form-name\"><input size=\"40\" maxlength=\"400\" class=\"wpcf7-form-control wpcf7-text wpcf7-validates-as-required blog-article__inline-form-input\" autocomplete=\"name\" aria-required=\"true\" aria-invalid=\"false\" placeholder=\"Jan Kowalski\" value=\"\" type=\"text\" name=\"article-form-name\" \/><\/span><br \/>\n<\/label>\n\t<\/p>\n\t<p><label class=\"blog-article__inline-form-field\"><br \/>\n<span class=\"blog-article__inline-form-label\">E-mail<\/span><br \/>\n<span class=\"wpcf7-form-control-wrap\" data-name=\"article-form-email\"><input size=\"40\" maxlength=\"400\" class=\"wpcf7-form-control wpcf7-email wpcf7-validates-as-required wpcf7-text wpcf7-validates-as-email blog-article__inline-form-input\" autocomplete=\"email\" aria-required=\"true\" aria-invalid=\"false\" placeholder=\"jankowalski@xyz.com\" value=\"\" type=\"email\" name=\"article-form-email\" \/><\/span><br \/>\n<\/label>\n\t<\/p>\n<\/div>\n<p><label class=\"blog-article__inline-form-field\"><br \/>\n<span class=\"blog-article__inline-form-label\">Message<\/span><br \/>\n<span class=\"wpcf7-form-control-wrap\" data-name=\"article-form-message\"><textarea cols=\"40\" rows=\"10\" maxlength=\"2000\" class=\"wpcf7-form-control wpcf7-textarea wpcf7-validates-as-required blog-article__inline-form-textarea\" aria-required=\"true\" aria-invalid=\"false\" placeholder=\"Tell us briefly what you need...\" name=\"article-form-message\"><\/textarea><\/span><br \/>\n<\/label>\n<\/p>\n<div class=\"blog-article__newsletter-consent\">\n\t<p><span class=\"wpcf7-form-control-wrap\" data-name=\"article-form-privacy\"><span class=\"wpcf7-form-control wpcf7-acceptance\"><span class=\"wpcf7-list-item\"><label><input type=\"checkbox\" name=\"article-form-privacy\" value=\"1\" class=\"blog-article__newsletter-checkbox\" aria-invalid=\"false\" \/><span class=\"wpcf7-list-item-label\">Zgadzam si\u0119 na kontakt w sprawie przes\u0142anej wiadomo\u015bci i akceptuj\u0119 <a href=\"https:\/\/sawaryn.com\/app\/uploads\/2026\/11\/Sawaryn-i-Partnerzy-Privacy-Policy-v1.0-en-GB.pdf\" target=\"_blank\" rel=\"noopener noreferrer\">polityk\u0119 prywatno\u015bci<\/a>.<\/span><\/label><\/span><\/span><\/span>\n\t<\/p>\n<\/div>\n<p class=\"blog-article__newsletter-submit-row\"><button type=\"submit\" class=\"button blog-article__newsletter-submit\">\r\n    <span class=\"button__label\">Submit<\/span>\r\n            <span class=\"button__icon\" aria-hidden=\"true\">\r\n                <span class=\"icon\" data-icon-size=\"sm\">\n        <img src=\"https:\/\/sawaryn.com\/app\/uploads\/2026\/05\/arrow-01.svg\" alt=\"\" class=\"icon__image\" loading=\"lazy\" decoding=\"async\" aria-hidden=\"true\" width=\"11\" height=\"13\">\n    <\/span>\n            <\/span>\r\n    <\/button>\n<\/p><div hidden aria-hidden=\"true\"><label>Leave this field blank<input type=\"text\" name=\"asl_website\" value=\"\" tabindex=\"-1\" autocomplete=\"off\"><\/label><\/div><input type=\"hidden\" name=\"asl_started_at\" value=\"1794408653.cedb21ee105391d1f7290aa5b27af6de7751b1ddd4ff9ab5bb3f4c5c2fc7860c\"><div id=\"sawaryn-turnstile-1\" class=\"cf-turnstile\" data-sitekey=\"0x4AAAAAAEM6UD_FpW1mXB2Y\" data-theme=\"light\" data-action=\"contact\" data-language=\"en\"><\/div><div class=\"wpcf7-response-output\" aria-hidden=\"true\"><\/div>\n<\/form>\n<\/div>\n        <\/div>\r\n    <\/aside>\n<h2>Key concepts you need to know<\/h2>\n<p>Before we move on to specific structural decisions, it is worth clarifying the terminology. The concepts below appear later in this article and have precise legal meanings.<\/p>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">Concept<\/th>\n<th style=\"text-align: left;\">What it means<\/th>\n<th style=\"text-align: left;\">Why it matters for the terms and conditions<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"text-align: left;\"><strong>Input Data<\/strong><\/td>\n<td style=\"text-align: left;\">Anything entered into the application \u2014 text, files, prompts, comments<\/td>\n<td style=\"text-align: left;\">Without this definition, you cannot establish a licence for user content or draft a model-training clause<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Output<\/strong><\/td>\n<td style=\"text-align: left;\">Anything the application generates automatically \u2014 summaries, classifications, ratings, alerts, visualisations<\/td>\n<td style=\"text-align: left;\">Without this definition, you cannot distinguish liability for a model error from the customer\u2019s liability<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Verification buffer<\/strong><\/td>\n<td style=\"text-align: left;\">A system state in which generated content exists but has not been published \u2014 publication requires approval by a professional user<\/td>\n<td style=\"text-align: left;\">Turns a statement about the \u201cneed for verification&#8221; into a product feature<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Right of access<\/strong><\/td>\n<td style=\"text-align: left;\">A non-exclusive, non-transferable right, limited to the subscription term, to use the features through the interface \u2014 instead of a software licence<\/td>\n<td style=\"text-align: left;\">In a cloud model, the code is not reproduced on the user\u2019s side, so a copyright licence is imprecise<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\"><strong>Unfair contract term<\/strong><\/td>\n<td style=\"text-align: left;\">A contractual provision that has not been individually negotiated and shapes the consumer\u2019s rights in a manner contrary to good practice, grossly infringing their interests (Article 385\u00b9 of the Civil Code)<\/td>\n<td style=\"text-align: left;\">Exclusion of statutory warranty rights, binding provider measurements, jurisdiction at the provider\u2019s registered office \u2014 these may be ineffective against consumers<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><a href=\"https:\/\/sawaryn.com\/en\/contact\/\">Get in touch<\/a> \u2014 if you are unsure which of your clauses need to be revised.<\/p>\n<h2>How to bind someone who has not clicked a checkbox to the terms and conditions<\/h2>\n<p>This is one of the most common questions asked by SaaS providers with a public-facing layer. The answer is provided by Article 8(3) of the Act on the Provision of Electronic Services: the terms and conditions are binding if they were <strong>made available before the service began<\/strong> in a manner that allows them to be obtained, reproduced and stored.<\/p>\n<p>For an unregistered guest, this means three requirements:<\/p>\n<ol>\n<li>The terms and conditions must be visible and accessible <strong>before<\/strong> the guest begins using the features \u2014 for example, on the public-link page, before the form is opened.<\/li>\n<li>The guest must be able to download the terms and conditions in a format that can be saved (e.g. PDF).<\/li>\n<li>The interface must document this \u2014 for example, by logging when the terms and conditions were displayed before the first interaction.<\/li>\n<\/ol>\n<p>A checkbox is not required. But if you do not use one, you must design the interface to meet the requirements of Article 8. This is a product decision, not a legal one.<\/p>\n<p><strong>Recommendation:<\/strong> make participation with an account the default configuration. Leave the decision to enable anonymous mode to the customer \u2014 together with their <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/gdpr-privacy-notice-guide\/\">obligation to provide information<\/a> to end users.<\/p>\n<h2>Layering the terms and conditions \u2014 three regimes within a single clause<\/h2>\n<p>The standard approach is to create two versions of the document: one for B2B customers and one for consumers. This approach does not work in a product with four user categories \u2014 it creates gaps and inconsistencies.<\/p>\n<p>A better solution is <strong>one set of terms and conditions, layered according to the party\u2019s status rather than by subject matter<\/strong>. Each clause concerning liability, confidentiality, disputes or payments contains three regimes:<\/p>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">Regime<\/th>\n<th style=\"text-align: left;\">Who it covers<\/th>\n<th style=\"text-align: left;\">Example liability clause<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"text-align: left;\">Business user<\/td>\n<td style=\"text-align: left;\">B2B\/B2G customer, team member acting in the course of business<\/td>\n<td style=\"text-align: left;\">Exclusion of statutory warranty rights (Article 558 \u00a7 1 of the Civil Code), liability capped at the fees for 12 months, jurisdiction of the courts at the provider\u2019s registered office<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Consumer and sole trader with consumer rights<\/td>\n<td style=\"text-align: left;\">End user with a free account, sole trader acting outside their professional field<\/td>\n<td style=\"text-align: left;\">No exclusion of statutory warranty rights, liability for failure of the digital service to conform to the contract (Articles 43m and 43n of the Consumer Rights Act), jurisdiction determined under the general rules<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Common regime<\/td>\n<td style=\"text-align: left;\">All users<\/td>\n<td style=\"text-align: left;\">Exclusion of liability for force majeure (including sudden unavailability of cloud provider interfaces, failures of external models, or an administrative ban on the use of AI technology), the specific characteristics of AI output<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>This technique eliminates the need for two documents and makes each clause clear for every user category.<\/p>\n<h2>Six structural decisions for the AI layer in the terms and conditions<\/h2>\n<h3>Decision 1 \u2014 a verification buffer instead of a declaration about verification<\/h3>\n<p>The sentence \u201cthe user should verify the outputs&#8221; has no legal value if the interface does not enforce verification. A probabilistic model may produce different outputs for the same input data, and an output may simply be false.<\/p>\n<p>If an institution bases a report on an automated summary and the report becomes part of official records, the model error ceases to be a software quality issue and becomes a defect in the administrative process.<\/p>\n<p><strong>What to include in the terms and conditions:<\/strong><\/p>\n<ol>\n<li>State explicitly that AI output is probabilistic and may contain errors.<\/li>\n<li>Prohibit decisions with external effects from being based solely on automated output (consistent with Article 22 GDPR and Articles 14 and 50 of the <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/PL\/TXT\/?uri=CELEX:32024R1689\" target=\"_blank\" rel=\"noopener\">Artificial Intelligence Act<\/a>).<\/li>\n<li>Describe the verification buffer as a system state: generated content exists but is not published until approved by the customer.<\/li>\n<\/ol>\n<p><strong>What to build into the product:<\/strong><\/p>\n<ol>\n<li>An intermediate state \u2014 generated content visible to the professional user but not published.<\/li>\n<li>An approval button without which the content cannot enter the public view.<\/li>\n<li>Logging of the approval time and the identity of the person who approved it.<\/li>\n<\/ol>\n<h3>Decision 2 \u2014 labelling AI content in the interface and metadata<\/h3>\n<p>Article 50 of the <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/PL\/TXT\/?uri=CELEX:32024R1689\" target=\"_blank\" rel=\"noopener\">Artificial Intelligence Act<\/a> imposes an obligation to label <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/what-is-an-ai-system-under-the-ai-act\/\">AI system outputs<\/a> in a machine-readable format. It applies from <strong>2 August 2026<\/strong>. The obligation applies to every natural person interacting with the system \u2014 regardless of their contractual status in relation to the provider.<\/p>\n<p>Labelling in the interface alone is not enough. A user exports a report to a file and removes the label. Two layers are therefore required:<\/p>\n<ol>\n<li><strong>Interface label<\/strong> \u2014 visible information that the content was generated or assisted by AI.<\/li>\n<li><strong>Metadata in exported files<\/strong> \u2014 a machine-readable label that survives export.<\/li>\n<\/ol>\n<p>And a third layer \u2014 <strong>a prohibition on users removing labels<\/strong>, included in the terms and conditions. Without this prohibition, the label disappears at the first stage of the document workflow.<\/p>\n<h3>Decision 3 \u2014 status of AI output: no exclusivity<\/h3>\n<p>During negotiations, the customer asks: \u201cIs a visualisation generated by the tool exclusively mine? Can I prohibit others from using a similar one?&#8221;<\/p>\n<p>An answer set out in the terms and conditions is cheaper than a dispute. Material generated entirely automatically may not constitute a work within the meaning of Article 1 of the Copyright Act. The customer acquires a right to use it, but not exclusive rights. Another user may obtain a similar output from a similar query.<\/p>\n<p><strong>What to include in the terms and conditions:<\/strong><\/p>\n<ol>\n<li>AI output does not constitute a work within the meaning of copyright law unless the user\u2019s creative contribution is significant enough for the output to satisfy the criteria of Article 1.<\/li>\n<li>The customer acquires a non-exclusive, non-transferable right to use the output.<\/li>\n<li>The provider does not guarantee that the output will be unique.<\/li>\n<\/ol>\n<h3>Decision 4 \u2014 a licence for content from a user who is not your customer<\/h3>\n<p>The provider needs a licence for the content in order to process it using the model. But it cannot obtain that licence from the author because the author (e.g. a resident using a public consultation form) does not enter into any agreement with the provider.<\/p>\n<p>The solution is a <strong>two-track structure<\/strong>:<\/p>\n<ol>\n<li><strong>For the end user and guest:<\/strong> a licence granted when the content is submitted, linked to information displayed next to the form or on the project page \u2014 before the user types the first character.<\/li>\n<li><strong>For the professional customer:<\/strong> a representation and warranty that they hold the rights and consents required for data entered into the application, together with a clause indemnifying the provider against claims concerning copyright, personality rights and privacy.<\/li>\n<\/ol>\n<h3>Decision 5 \u2014 a two-way model-training clause<\/h3>\n<p>The training clause must be symmetrical. Without that symmetry, it reads like a unilateral appropriation of the customer\u2019s data.<\/p>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">Direction<\/th>\n<th style=\"text-align: left;\">What it governs<\/th>\n<th style=\"text-align: left;\">Sample provision<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"text-align: left;\">Third-party provider models<\/td>\n<td style=\"text-align: left;\">Exclusion of input data from the training of public commercial models<\/td>\n<td style=\"text-align: left;\">\u201cThe customer\u2019s input data is not used to train or fine-tune public models operated by third-party providers&#8221;<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">The provider\u2019s own models<\/td>\n<td style=\"text-align: left;\">The right to aggregate and irreversibly anonymise data to train the provider\u2019s own models<\/td>\n<td style=\"text-align: left;\">\u201cThe provider may use anonymised and aggregated data to develop its own models, provided that the data is irreversibly anonymised&#8221;<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Competing models<\/td>\n<td style=\"text-align: left;\">Prohibition on training competing models using the outputs<\/td>\n<td style=\"text-align: left;\">\u201cThe customer may not use outputs to train or fine-tune models that compete with the application&#8221;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The first point must be confirmed in agreements with <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/azure-openai-responsibility\/\">model providers<\/a> \u2014 a provision in the terms and conditions alone is not enough.<\/p>\n<h3>Decision 6 \u2014 the DSA layer for an application that publishes user content<\/h3>\n<p>If your application stores and publicly disseminates user content, it may qualify as a <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/dsa-rules-online-platforms-intermediaries\/\">hosting service<\/a> or an online platform within the meaning of the <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/PL\/TXT\/?uri=celex:32022R2065\" target=\"_blank\" rel=\"noopener\">Digital Services Act (DSA)<\/a>. The President of UKE is Poland\u2019s Digital Services Coordinator, and the <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/download.xsp\/WDU20260001296\/T\/D20261296L.pdf\" target=\"_blank\" rel=\"noopener\">Act of 4 September 2026<\/a> provides for the possibility of imposing a periodic penalty payment of up to <strong>5% of the average daily turnover<\/strong> of the intermediary service provider for each day of non-compliance.<\/p>\n<p>Minimum elements of the DSA layer in the terms and conditions:<\/p>\n<ol>\n<li>A point of contact (Articles 11 and 12 DSA).<\/li>\n<li>A mechanism for reporting illegal content, including formal requirements for notices (Article 16 DSA).<\/li>\n<li>A statement of reasons for decisions restricting content, including information about the use of automated tools (Article 17 DSA).<\/li>\n<li>An internal complaint-handling system \u2014 a free appeal within six months, reviewed by qualified staff (Article 20 DSA).<\/li>\n<li>Measures against misuse of the notice system (Article 23 DSA).<\/li>\n<li>Separate catalogues of illegal content and content that breaches the terms and conditions.<\/li>\n<\/ol>\n<p>Providers that are micro or small enterprises may benefit from the exemption from Section 3 of Chapter III DSA (Article 19), but <strong>only if their service qualifies as an online platform<\/strong> and they meet the size criterion in <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/PL\/TXT\/?uri=celex:32003H0361\" target=\"_blank\" rel=\"noopener\">Recommendation 2003\/361\/EC<\/a>. The exemption does not cover the entire DSA \u2014 the hosting provider obligations under Articles 16\u201318 remain applicable.<\/p>\n<p>An important boundary: technical support should not include advice on moderating end-user content. This deliberately distances the provider from the role of substantive moderator in someone else\u2019s process.<\/p>\n<h2>GDPR \u2014 allocation of roles and special categories of data<\/h2>\n<p>The terms and conditions must assign GDPR roles and refer to a <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/safely-entrust-personal-data-processor\/\">separate data processing agreement<\/a>, specifying that it takes precedence in the event of a conflict. Three obligations that providers forget:<\/p>\n<ol>\n<li><strong>Requiring the customer to enter into its own data processing agreement<\/strong> with an external entity to which it grants access as a team member (e.g. a consulting firm conducting consultations on behalf of a public authority).<\/li>\n<li><strong>Limiting the scope of data in unregistered mode<\/strong> \u2014 a recommendation not to disclose special categories of data (Article 9 GDPR) in free-text statements. A resident\u2019s comment in a consultation on a road development may contain information about their health, family circumstances and address. Special-category data may be disclosed incidentally.<\/li>\n<li><strong><a href=\"https:\/\/sawaryn.com\/en\/publikacje\/gdpr-data-subject-rights-procedure\/\">Information obligations towards third parties<\/a> (Article 14 GDPR)<\/strong> \u2014 where user content contains the data of individuals who do not themselves interact with the application.<\/li>\n<\/ol>\n<p>Processing content containing data covered by Article 9 GDPR requires a separate legal basis under Article 9(2) \u2014 a legal basis under Article 6(1) alone is not sufficient. If content is subsequently reused to train a model, the purpose of processing must be specified more precisely and a data protection impact assessment must be conducted (Article 35 GDPR).<\/p>\n<h2>SLA, billing and offboarding \u2014 what to change in standard clauses<\/h2>\n<h3>Availability \u2014 what the guarantee actually covers<\/h3>\n<p>If you exclude failures of the cloud and <a href=\"https:\/\/sawaryn.com\/en\/publikacje\/azure-openai-ai-software-development\/\">cloud provider<\/a> interfaces from downtime, the guarantee covers only a narrow layer under your own control. AI operations are processed asynchronously and independently of connection bandwidth \u2014 excluding them from a responsiveness guarantee is justified, but the customer must be aware of it.<\/p>\n<p>A provision stating that measurements taken using the provider\u2019s tools are binding may be considered unfair in relation to consumers (Article 385\u00b3 point 19 of the Civil Code \u2014 granting an exclusive right to alter the characteristics of the performance).<\/p>\n<h3>Billing \u2014 billing unit and AI operations allowance<\/h3>\n<p>A billing model based on the actual unit of sale (e.g. project rather than seat), plus a separate allowance of units for AI operations, requires three provisions:<\/p>\n<ol>\n<li>Unused units do not roll over between billing periods.<\/li>\n<li>AI features are blocked when the allowance is exhausted \u2014 with a clear message in the interface.<\/li>\n<li>Top-ups are charged pro rata based on the number of days remaining in the period.<\/li>\n<\/ol>\n<p>For automatically renewing subscriptions, provide: a reminder before renewal, an easy way to cancel before the fee is charged (no later than 1 day before the next period begins), and a separate procedure for changing prices for consumers, requiring active consent.<\/p>\n<h3>Offboarding \u2014 grace period and data export<\/h3>\n<p>After termination of the agreement, data should remain available in read-only mode and for export for a specified period (e.g. six months), in a machine-readable format \u2014 consistent with the requirements of the <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/PL\/TXT\/?uri=CELEX:32023R2854\" target=\"_blank\" rel=\"noopener\">Data Act (2023\/2854)<\/a> and the obligation to provide content following a consumer\u2019s withdrawal from the contract.<\/p>\n<p>After the grace period \u2014 irreversible deletion or complete anonymisation. But be careful: if your customer is a public-sector entity, the standard clause stating that \u201call data will be deleted after the service ends&#8221; may conflict with archiving obligations under the <a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/download.xsp\/WDU20110140067\" target=\"_blank\" rel=\"noopener\">Regulation of the Prime Minister of 18 January 2011<\/a> and the Act on the National Archival Resources. The terms and conditions must provide for deletion to be suspended for the duration of the archiving obligation and for export in an agreed format.<\/p>\n<h2>Public-sector customers \u2014 what to change in the standard terms so they pass the procurement process<\/h2>\n<p>If you sell to public-sector entities, compare your standard terms with their obligations:<\/p>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">Standard SaaS clause<\/th>\n<th style=\"text-align: left;\">Problem for the public-sector customer<\/th>\n<th style=\"text-align: left;\">What to change<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"text-align: left;\">Non-refundable fees<\/td>\n<td style=\"text-align: left;\">Public procurement rules and public finance discipline \u2014 non-refundability must be justified by the service model<\/td>\n<td style=\"text-align: left;\">Describe the setup and resource reservation costs that justify non-refundability<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Price adjustment without an amendment<\/td>\n<td style=\"text-align: left;\">Article 439(1) of the Public Procurement Law requires a price adjustment mechanism in contracts lasting more than 6 months, but the mechanism cannot transfer all risk to the contracting authority<\/td>\n<td style=\"text-align: left;\">Specify an objective index (e.g. Statistics Poland), a trigger threshold and a price adjustment cap<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Deletion of data after the agreement ends<\/td>\n<td style=\"text-align: left;\">Consultation records are subject to archiving, and outputs may constitute public information (<a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/DocDetails.xsp?id=wdu20011121198\" target=\"_blank\" rel=\"noopener\">Act on Access to Public Information<\/a>)<\/td>\n<td style=\"text-align: left;\">Provide for export before deletion and suspend deletion for the duration of the archiving obligation<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">Liability cap<\/td>\n<td style=\"text-align: left;\">Article 433 of the Public Procurement Law prohibits transferring the contractor\u2019s sole liability to the contracting authority<\/td>\n<td style=\"text-align: left;\">A monetary cap is permitted, but it cannot exclude liability for intentional harm, breaches of confidentiality or breaches involving personal data<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">No digital accessibility requirements<\/td>\n<td style=\"text-align: left;\"><a href=\"https:\/\/isap.sejm.gov.pl\/isap.nsf\/download.xsp\/WDU20190000848\/U\/D20190848Lj.pdf\" target=\"_blank\" rel=\"noopener\">Digital Accessibility Act<\/a> \u2014 a public-sector entity must ensure that the application is accessible in accordance with EN 301 549\/WCAG<\/td>\n<td style=\"text-align: left;\">Include an obligation in the agreement to design and maintain the application in accordance with WCAG; the public authority remains responsible towards residents, but the provider is contractually liable<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Checklist \u2014 what to review in SaaS terms and conditions with AI<\/h2>\n<table>\n<thead>\n<tr>\n<th style=\"text-align: left;\">No.<\/th>\n<th style=\"text-align: left;\">Area<\/th>\n<th style=\"text-align: left;\">Review question<\/th>\n<th style=\"text-align: left;\">Priority<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"text-align: left;\">1<\/td>\n<td style=\"text-align: left;\">User categories<\/td>\n<td style=\"text-align: left;\">Do the terms and conditions distinguish between all categories of people using the product, including unregistered guests?<\/td>\n<td style=\"text-align: left;\">Required<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">2<\/td>\n<td style=\"text-align: left;\">Incorporation of standard terms<\/td>\n<td style=\"text-align: left;\">Does a guest without an account see the terms and conditions before they begin using the features, and can they download them?<\/td>\n<td style=\"text-align: left;\">Required<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">3<\/td>\n<td style=\"text-align: left;\">Unfair contract terms<\/td>\n<td style=\"text-align: left;\">Does every clause limiting liability, excluding statutory warranty rights or specifying court jurisdiction include an explicit carve-out for consumers?<\/td>\n<td style=\"text-align: left;\">Required<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">4<\/td>\n<td style=\"text-align: left;\">AI definitions<\/td>\n<td style=\"text-align: left;\">Do the terms and conditions define input data and output separately?<\/td>\n<td style=\"text-align: left;\">Required<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">5<\/td>\n<td style=\"text-align: left;\">Verification buffer<\/td>\n<td style=\"text-align: left;\">Is verification of AI outputs a product feature rather than merely a sentence in the terms and conditions?<\/td>\n<td style=\"text-align: left;\">Required<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">6<\/td>\n<td style=\"text-align: left;\">Labelling AI content<\/td>\n<td style=\"text-align: left;\">Is AI content labelled in the interface and in the metadata of exported files, and do the terms and conditions prohibit the removal of labels?<\/td>\n<td style=\"text-align: left;\">Required<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">7<\/td>\n<td style=\"text-align: left;\">Status of the output<\/td>\n<td style=\"text-align: left;\">Do the terms and conditions describe the output as non-exclusive and explain the uncertainty as to whether it qualifies as a work?<\/td>\n<td style=\"text-align: left;\">Required<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">8<\/td>\n<td style=\"text-align: left;\">Licence for user content<\/td>\n<td style=\"text-align: left;\">Is the content licence granted upon submission (for the end user) and supported by a representation from the customer (for B2B)?<\/td>\n<td style=\"text-align: left;\">Required<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">9<\/td>\n<td style=\"text-align: left;\">Training clause<\/td>\n<td style=\"text-align: left;\">Does the clause distinguish between three directions: external models, proprietary models and competing models?<\/td>\n<td style=\"text-align: left;\">Required<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">10<\/td>\n<td style=\"text-align: left;\">GDPR<\/td>\n<td style=\"text-align: left;\">Are the roles assigned, is the data processing agreement separate, and is the customer required to enter into its own data processing agreement with external team members?<\/td>\n<td style=\"text-align: left;\">Required<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">11<\/td>\n<td style=\"text-align: left;\">DSA<\/td>\n<td style=\"text-align: left;\">Does the application publishing user content have a point of contact, a notice mechanism, reasons for sanctions and an appeal procedure?<\/td>\n<td style=\"text-align: left;\">Required<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">12<\/td>\n<td style=\"text-align: left;\">SLA<\/td>\n<td style=\"text-align: left;\">Has the customer knowingly accepted the list of exclusions from the availability guarantee?<\/td>\n<td style=\"text-align: left;\">Recommended<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">13<\/td>\n<td style=\"text-align: left;\">AI billing<\/td>\n<td style=\"text-align: left;\">Do the terms and conditions describe what happens when the allowance is exhausted, the absence of rollover and the pro rata top-up rule?<\/td>\n<td style=\"text-align: left;\">Recommended<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">14<\/td>\n<td style=\"text-align: left;\">Offboarding<\/td>\n<td style=\"text-align: left;\">After the agreement ends, is the data available in read-only mode and for export in a machine-readable format?<\/td>\n<td style=\"text-align: left;\">Recommended<\/td>\n<\/tr>\n<tr>\n<td style=\"text-align: left;\">15<\/td>\n<td style=\"text-align: left;\">Public-sector customer<\/td>\n<td style=\"text-align: left;\">Do the standard terms account for archiving, public information, digital accessibility and the public procurement regime?<\/td>\n<td style=\"text-align: left;\">Recommended<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>How we can help organise the terms and conditions for your SaaS product with AI<\/h2>\n<p><strong>SaaS terms and conditions with AI are not a document to copy \u2014 they are a set of product decisions.<\/strong> Three of them \u2014 the verification buffer, labelling AI content and the notice procedure \u2014 do not exist unless they are implemented in the code.<\/p>\n<p>We help SaaS providers move from a template downloaded from the internet to terms and conditions that reflect the actual product and cover every legal category of user. We work at three levels:<\/p>\n<ol>\n<li><strong>Audit of the current standard terms<\/strong> \u2014 a review of the terms and conditions for ineffective clauses, missing layers (consumer, DSA, AI Act) and discrepancies with the product. Outcome: a list of critical revisions with a risk assessment.<\/li>\n<li><strong>Restructuring the terms and conditions<\/strong> \u2014 layered standard terms with AI definitions, training clauses, a licence for user content, a data processing agreement and a billing model tailored to the product.<\/li>\n<li><strong>Complete documentation<\/strong> \u2014 terms and conditions, AI policy, DSA procedure, data processing agreement and a sales pathway for public-sector entities that takes account of WCAG, archiving and the public procurement regime.<\/li>\n<\/ol>\n<p>We understand the realities of product teams: rapid deployments, concurrent projects and limited resources. That is why we design rules where the risk actually arises \u2014 we do not create documents just in case.<\/p>\n<p><a href=\"https:\/\/sawaryn.com\/en\/contact\/\">Contact us<\/a> \u2014 we will determine which option is right for your product\u2019s current stage.<\/p>\n<h2>Summary<\/h2>\n<p>A single set of SaaS terms and conditions with AI must cover four legal categories of users \u2014 otherwise, the clauses you rely on will be ineffective against some of them. Each of the six structural decisions described in this article requires changes both to the document and to the product. The transparency obligations under the <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/PL\/TXT\/?uri=CELEX:32024R1689\" target=\"_blank\" rel=\"noopener\">Artificial Intelligence Act<\/a> (Article 50, applicable from 2 August 2026) and the requirements of the <a href=\"https:\/\/eur-lex.europa.eu\/legal-content\/PL\/TXT\/?uri=celex:32022R2065\" target=\"_blank\" rel=\"noopener\">Digital Services Act<\/a> apply to your product regardless of whether you address them in the terms and conditions.<\/p>\n<p>Review your standard terms. Identify the gaps. If you need support \u2014 <a href=\"https:\/\/sawaryn.com\/en\/contact\/\">contact us<\/a>.<\/p>\n<h2>Frequently asked questions<\/h2>\n<p><strong>Are my terms and conditions binding on someone who uses the application without registering and does not accept any checkbox?<\/strong><br \/>\nYes, provided that the requirements of Article 8(3) of the Act on the Provision of Electronic Services are met \u2014 the terms and conditions must be made available before the service begins, in a manner that allows them to be obtained, reproduced and stored. A checkbox is not required, but the interface must document when the terms and conditions were made available.<\/p>\n<p><strong>Do I need two separate documents \u2014 one for business customers and another for end users?<\/strong><br \/>\nNo. A better solution is one set of terms and conditions layered according to the party\u2019s status. Each clause concerning liability, confidentiality or disputes contains three regimes: one for business users, one for consumers and sole traders with consumer rights, and a common regime. This eliminates gaps and inconsistencies between two documents.<\/p>\n<p><strong>Which of my current clauses are ineffective against consumers?<\/strong><br \/>\nMost commonly: exclusion of statutory warranty rights (Article 558 \u00a7 1 of the Civil Code applies only to business users), a liability cap limited to the amount of the fee, jurisdiction of the courts at the provider\u2019s registered office, a confidentiality clause, and a provision stating that the provider\u2019s measurements are binding. In relation to consumers and sole traders with consumer rights, these may be deemed unfair under Articles 385\u00b9 and 385\u00b3 of the Civil Code.<\/p>\n<p><strong>Who is liable if the model generates a false summary and my customer uses it in an official document?<\/strong><br \/>\nThe terms and conditions should allocate liability: the provider is responsible for making a verification mechanism available (the verification buffer), while the customer is responsible for approving the content before publication or use in a process. Without a verification buffer in the product, the allocation of liability described in the terms and conditions may be difficult to enforce.<\/p>\n<p><strong>Is my application an online platform within the meaning of the DSA?<\/strong><br \/>\nIf it stores and publicly disseminates user content \u2014 it may be. An online platform within the meaning of Article 3(i) DSA is a hosting service that stores <strong>and publicly disseminates<\/strong> information at the request of a recipient. Storage alone, without public access, does not qualify as a platform. Classification requires an assessment of your product\u2019s technical and contractual model.<\/p>\n<p><strong>Can I train my own models using customer data if I anonymise it?<\/strong><br \/>\nThe terms and conditions should expressly provide for this possibility \u2014 the right to aggregate and irreversibly anonymise data to train proprietary models. However, the anonymisation must genuinely be irreversible (not pseudonymisation), and if the content may contain data covered by Article 9 GDPR, you need a separate legal basis under Article 9(2) and a data protection impact assessment (Article 35 GDPR). A provision in the terms and conditions alone does not replace technical verification of the anonymisation process.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Learn how to structure AI SaaS terms for business customers, consumers and unregistered guests, with practical clauses and product controls for Polish law.<\/p>\n","protected":false},"author":13,"featured_media":4240,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","sip_alt_url":"","sip_en_pl_url":"","sip_pair_uuid":"7b615896-9659-4a69-aa85-5f4543a58547","sip_pair_state":"draft_ready"},"categories":[1577],"tags":[1545,1538,1446,1539,1588],"specialization":[1211],"practice_area":[],"class_list":["post-5146","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-it-ai-ip-law","tag-ai-act-en","tag-copyright-law","tag-gdpr","tag-license","tag-sla-en","specialization-it-ai-ip-law"],"acf":[],"_links":{"self":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/5146","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/comments?post=5146"}],"version-history":[{"count":7,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/5146\/revisions"}],"predecessor-version":[{"id":5157,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/posts\/5146\/revisions\/5157"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media\/4240"}],"wp:attachment":[{"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/media?parent=5146"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/categories?post=5146"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/tags?post=5146"},{"taxonomy":"specialization","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/specialization?post=5146"},{"taxonomy":"practice_area","embeddable":true,"href":"https:\/\/sawaryn.com\/en\/wp-json\/wp\/v2\/practice_area?post=5146"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}