← BACK TO DISCUSSIONS
Technology & Digital LawLEGAL ANALYSIS

May a SaaS provider train AI models on confidential customer information?

Situation and legal question

A SaaS vendor proposes using customer-uploaded business records to improve a shared AI model.

Begin by identifying the exact challenged transaction, omission or decision. A short question cannot establish the facts that determine liability. The documents may contain an earlier consent, an exception or a statutory deadline which changes the legal analysis. The same dispute may require different remedies depending on party status and the governing instrument.

The applicable law

Contractual permitted use, confidentiality, security commitments and applicable sector rules govern.

Read the operative legislation as of the relevant date, together with amendments, applicable rules and the full contractual text. An ordinary commercial practice does not displace express statutory conditions. If federal and provincial regimes might differ, identify which one governs before asserting a right. Statutory enforcement rights and private contractual remedies are also distinct, even when the same facts are involved.

Evidence and proof

MSA; data-processing terms; client consent; model logs; retention and vendor documents.

Keep original instruments and electronic correspondence in date order. Verify authorship, signature authority, receipt of notices, payments and the chronology of performance. Contested facts should be identified candidly rather than converted into assumptions. A complete evidentiary file includes the adverse material as well as records favourable to the applicant. Preserve source files where authenticity may later be questioned.

Procedure and forum

Audit purpose limitation, subprocessors, deletion rights, transfer restrictions and safeguards.

Identify the applicable forum and each limitation period immediately. A request for informal review, a contractually required notice, a statutory appeal and litigation are not interchangeable. Settlement discussions may not suspend time limits. For emergency protection, specify the actual harm and relief sought rather than asking a court or tribunal for an unnecessarily broad restraint.

Misconceptions to avoid

Assuming access permission entails training permission.

The opposite error is equally harmful: an unqualified statement of law may conceal exceptions, statutory safeguards, conditions precedent and contractual allocation of risk. A procedural defect does not always resolve the underlying merits. Similarly a credible commercial grievance may fail because the wrong forum was chosen or a mandatory notice was never given. Separate the strength of the allegation from the availability of a remedy.

Applying the rule to these facts

Obtain explicit lawful authority and segregate confidential inputs from unrelated model development.

For the situation described, first identify the operative duty and who owed it. Next ask whether the evidence establishes breach or compliance, and whether any remedy is barred or limited. If a decisive fact is missing, say precisely what document or testimony could establish it. Sound advice should identify competing arguments rather than promise a result before the record has been examined.

Recommended written response

A written response should name the relevant provisions, list admitted facts separately from disputed ones and state the requested remedy. For monetary claims, calculate each component and preserve the supporting schedule; for non-monetary relief, state exactly what conduct is to be required or prohibited. Be accurate about authority to act, available regulatory channels, and the evidentiary standard. Avoid unnecessary accusations that could expose the client to a separate dispute.

If negotiating, document any proposed compromise with payment milestones, releases, costs and default consequences. Do not casually waive claims in an email drafted to maintain a business relationship. Where formal proceedings are necessary, use the same record to create a narrow, coherent pleading that addresses the legal requirements of the selected forum.

Limits of this answer

This is general legal information concerning Technology & Digital Law. It is not a finding on particular parties' rights. A complete legal opinion requires the original documents, applicable local jurisdiction, the law in force at the relevant date, and all material facts. Changes in legislation or regulatory instructions may alter the analysis.