Artificial intelligence annex.

Article 1. Purpose and scope

1.1 Purpose. This annex supplements the Provider’s general terms and conditions of sale, hereinafter the “Common Provisions”. It governs the matters specific to the use of an AI Model.

1.2 Scope. It applies to any Service in which an AI Model is used, whether as a production tool of the Provider or as a component of a Deliverable. It is accordingly attached to the Quote as soon as either of these uses is implemented, whatever the regime of the Service may otherwise be. The operational conditions of the Service (inference providers and location of processing, scope of connectors and sources, cost cap, logging, quality indicators) are set by the “Special conditions relating to artificial intelligence” annex, hereinafter the “Technical Annex”, where it is attached; failing that, by the Quote.

1.3 Order of precedence. The terms defined in Article 1 of the Common Provisions have the same meaning in this annex. The Common Provisions remain applicable in all their provisions and prevail over this annex in the event of conflict, except on the matters that this annex is specifically intended to govern (AI Models, Prompts, Outputs and guardrails), for which it prevails. It operates together with the DPA for all matters relating to Personal Data, the DPA prevailing on the terms of paragraph 14.2 of the Common Provisions. This annex is physically attached to the Quote and forms an integral part of it.

Article 2. Transparency: inference providers and location of processing

2.1 The Provider declares that it uses generative artificial intelligence tools in its production work, in particular code generation and code review assistants. It informs the Client of the AI Models and providers selected for a Deliverable, the chosen mode of operation, the location of processing and the main known limitations of the model; this information is set out in the Technical Annex or, failing that, in the Quote or the architecture documentation. Any change of model or provider affecting the location of processing, the cost or the quality of the Outputs is notified to the Client before it is implemented.

2.2 The Provider further declares that, for the operation and administration of the environments it manages, it uses an assistance tool based on an AI Model supplied by a third party established outside the European Union, which may access configurations and extracts of technical logs, within the limits and subject to the exclusions of Article 8, which prevail over this Article. No production database, no backup and no authentication secret is sent to it. This tool is entered in the list of Sub-processors in the DPA where it processes Personal Data and is subject to the transfer safeguards of paragraph 14.6 of the Common Provisions. The Client may, by written notice, exclude the use of this tool for its own environments; the Provider then informs it of any impact on deadlines and price.

Article 3. Role of each Party

3.1 The Parties comply with Regulation (EU) 2024/1689 of 13 June 2024 laying down harmonised rules on artificial intelligence, according to the following allocation:

• the Client classifies its use cases. It is for the Client to determine whether a system falls within the prohibited practices of Article 5 or constitutes a high-risk system within the meaning of Annex III, and to assume the corresponding obligations. It informs the Provider of this classification before work starts;
• the Provider refuses to design, integrate or operate any system falling within a practice prohibited by Article 5 and may, if it discovers such a purpose during performance, suspend and then terminate the Contract for the Client’s fault on the terms of Article 20 of the Common Provisions;
• the transparency obligations of Article 50 are allocated by the Regulation itself: those in its paragraphs 1 and 2 are incumbent on the provider of the system or model, those in its paragraphs 3 and 4 on the deployer. The Provider technically implements the corresponding mechanisms where the Quote so provides; each Party assumes the obligations that the Regulation imposes on it according to the role it actually performs;
• the Provider ensures a sufficient level of AI literacy, within the meaning of Article 4, among its staff and assigned personnel, based on the written rules it imposes on itself in the use of AI Models (classification of data before any submission, prohibited categories of data, systematic review of Outputs, explicit human confirmation before any change in production) and on the operational experience of its personnel;
• the allocation of roles is as follows, as recorded by the Parties: the Provider acts as technical integrator on behalf of the Client (it configures, connects and delivers on the Client’s instructions, and uses assistance tools on its own behalf); the Client chooses the use case and the model provider, provides the data, decides on the configuration, checks the Outputs, decides on putting the system into service and operates it under its own name or trade mark; the Provider does not place any artificial intelligence system on the market under its name or trade mark and does not change its intended purpose; the AI Models come from third-party providers, which retain the obligations attached to that status.

The classification of each Party under Regulation (EU) 2024/1689 results from these facts and from the provisions of that Regulation. The Parties note that, under this allocation, placing the system on the market or putting it into service is a matter for the Client, and that each Party assumes the obligations that the Regulation imposes on it by reason of the role it actually performs. Any change to this allocation, in particular delivery by the Provider of a system under its own trade mark or a change by it of the system’s intended purpose, entails a review of this classification and, where appropriate, the immediate conclusion of an amendment allocating the corresponding obligations and adjusting the price.

Article 4. Prompts

4.1 Business Prompts written by the Client, or written by the Provider for the Client’s own needs and based on its context, constitute Deliverables and follow the assignment regime of paragraph 12.1 of the Common Provisions. The Provider’s system Prompts, instruction templates, orchestration pipelines and generic tools fall under paragraph 12.5 of the Common Provisions and remain its property, licensed to the Client to the extent necessary for the exploitation of the Deliverables. Where the Technical Annex is attached, the licence it grants over these items (in particular the right to have them adapted by a third party of the Client’s choice and their transferability together with the Deliverable) prevails over paragraph 12.5 of the Common Provisions.

Article 5. Outputs

5.1 The Outputs produced in the course of a Service are made available to the Client, which may exploit them freely for its own needs. The Provider expressly draws the Client’s attention to the following points:

• an Output without a distinct human creative contribution is not necessarily protectable by copyright; the Provider does not guarantee the Client any exclusive rights in the Outputs and therefore cannot assign any to it; consequently, Outputs fall within the assignment in paragraph 12.1 of the Common Provisions only to the extent that they constitute Deliverables within the meaning of Article 1 of the Common Provisions, the Provider granting, for the others, only a making available without any guarantee as to the existence or ownership of an exclusive right;
• the Provider guarantees neither the accuracy, completeness, currency or originality, nor the non-infringing nature, consistency or reproducibility of an Output; the same Prompt may produce different Outputs;
• an Output may contain erroneous statements, non-existent references or biases;
• the Client cannot claim any de facto exclusivity over an Output, as a third party may obtain identical or similar content from the same AI Model.

These exclusions do not deprive of their purpose the obligations relating to method, guardrails and human approval undertaken elsewhere.

Article 6. Human oversight of results

6.1 Artificial intelligence prepares, the person decides. No Output is applied to a production system, sent to a third party or relied on against a person without prior human approval. This approval is given by a natural person, explicitly, in advance and in a traceable manner; it may not be produced by an automated process, a script, a scheduler or an AI Model, nor inferred from silence, and it relates to a named and bounded operation. The Provider designs the processing pipelines accordingly: it provides for checkpoints, traceability of the decision and the possibility of manual takeover. Actual implementation of this approval within the Client’s organisation is the Client’s responsibility.

Article 7. Code produced with the assistance of an AI Model and warranty against eviction

7.1 Code produced with the assistance of an AI Model is reviewed, tested and integrated under the Provider’s responsibility, on the same terms as code written manually. The Provider warrants that, to its knowledge, there is no slavish reproduction of code subject to a licence incompatible with the intended use. At the date of these terms, it does not carry out any code similarity checks or any tool-based licence compliance analysis, and promises none; on written request, it provides the Client with the inventory of the third-party components of the Deliverable and their licences on the terms of paragraph 12.4 of the Common Provisions. This warranty is exercised within the limits of paragraph 12.7 of the Common Provisions.

7.2 The Provider’s warranty against eviction for the Deliverables, the arrangements for its implementation and its exclusion from the liability cap remain governed by paragraph 12.6 of the Common Provisions.

Article 8. Data and training

8.1 No Client data is used to train, fine-tune or evaluate an AI Model without the Client’s specific prior written consent. For the providers it uses, the Provider selects the contractual or technical options excluding training on the content sent and, where that option exists, retention of requests. The following are excluded from any transmission to an AI Model, and no consent of the Client may derogate from this: the content of production databases and backups; any password, private key, token, certificate or other authentication or encryption secret; any information covered by professional secrecy or of a financial or banking nature; and any data falling under Articles 9 and 10 of the GDPR. The Client’s trade secrets and technical identifiers not needed for the task are excluded from Prompts; extracts of technical logs are submitted only after removal of network addresses, identifiers and account names not needed for the analysis. Where the use case allows, the Provider favours minimisation, pseudonymisation or redaction of the data sent to the model.

Article 9. Guardrails and control of inference costs

9.1 The Technical Annex or, failing that, the specific contract or the Quote sets, for each use case: the cap on application programming interface consumption re-invoiced to the Client and the alert threshold, the exact scope of the connectors and sources accessible to the AI Model, the rules for logging calls and retaining Prompts and Outputs, and the quality indicators and when they are measured. The Provider alerts the Client when the alert threshold is crossed and suspends calls beyond the cap, unless the Client gives contrary written instructions raising the cap and accepting the additional cost. This suspension is not attributable to the Provider: it does not give rise to its liability, does not constitute unavailability within the meaning of any SLAs subscribed elsewhere and does not give rise to any penalty or credit note.

9.2 Application programming interface consumption from AI Model providers is re-invoiced at actual cost, on presentation of supporting documents, on the terms of paragraph 6.2 of the Common Provisions. Any increase by an upstream provider falls under paragraph 6.5 of the Common Provisions.

Article 10. No guarantee of result on the content produced

10.1 The Provider is bound by a best-efforts obligation (obligation de moyens) as regards the design, tuning and guardrails of the processing pipeline. It gives no guarantee of result as regards the content produced by the model. The Client has a procedure for reporting drift, hallucinations or inappropriate responses; the Provider analyses each report and implements, under the applicable maintenance contract, the corrective measures reasonably available, in particular adjusting Prompts, strengthening filters, restricting the document scope or changing the model.