Kontrak AI 2026: Klausul yang Mulai Tidak Bisa Diabaikan Perusahaan

Banyak perusahaan membeli AI seperti membeli SaaS biasa.

Lihat fitur.

Lihat harga.

Sign.

Masalahnya, AI bukan SaaS biasa.

Model bisa berubah.

Data bisa dipakai training.

Output bisa salah.

Agent bisa mengambil action.

Subprocessor bisa lintas negara.

Biaya bisa berubah berdasarkan token.

Kalau contract masih template software 2018, banyak risiko tidak tertangkap.

Pada 2026, kontrak AI mulai membutuhkan clause baru.

Bukan karena semua kontrak harus 100 halaman.

Tapi karena ada pertanyaan yang dulu tidak relevan.

Sekarang wajib dibahas.

Klausul pertama: AI use case

Jangan kontrak hanya bilang: “AI services.”

Terlalu vague.

Definisikan tujuan.

Customer support.

Document analysis.

Coding.

Fraud detection.

Agent transaction.

Use case menentukan risk.

Kalau vendor ingin expand function, change control.

Ini mencegah scope creep.

Fitur awal low risk.

Enam bulan kemudian jadi automated decision.

No.

Material change must review.

Klausul kedua: data use

Ini critical.

Apakah vendor boleh memakai input perusahaan untuk training?

Improve service?

Analytics?

Human review?

Harus clear.

Default terms consumer dan enterprise bisa beda.

Jangan assume.

Tuliskan: customer data ownership.

Permitted purpose.

Training opt-in or opt-out.

Retention.

Deletion.

Backup.

Derivative data.

Embedding.

Log.

AI contract is data contract.

Klausul ketiga: confidential information

Prompt bisa confidential.

Output bisa confidential.

System prompt internal.

Knowledge base.

Company secrets.

NDA biasa mungkin cukup sebagian.

Tapi AI processing perlu detail.

Apakah human reviewer vendor bisa lihat?

Di negara mana?

Subprocessor?

Support engineer?

Least access.

Confidentiality must map real architecture.

Klausul keempat: model provider

SaaS AI bisa memakai model pihak ketiga.

Customer perlu tahu.

Vendor lokal pakai OpenAI?

Google?

Anthropic?

Open source?

Tidak selalu harus disclose semua technical routing.

Tapi untuk material data, supply chain visibility penting.

Kalau model provider berubah, notify jika risk berubah.

AI stack layered.

Contract must acknowledge.

Klausul kelima: model change

Ini clause baru yang sangat penting.

Vendor update model.

Output berubah.

Accuracy berubah.

Safety berubah.

Kontrak perlu material change process.

Notice.

Testing.

Rollback.

Tidak semua update perlu permission.

Tapi high-impact system yes.

Customer tidak boleh bangun compliance di model A lalu vendor diam-diam pindah model B dengan behavior berbeda.

Change management.

Klausul keenam: performance metric

“Akurasi tinggi” tidak cukup.

Metric apa?

Dataset?

Language?

Latency?

Task success?

Define.

For customer support: factual accuracy.

For extraction: field accuracy.

For agent: successful completion without unsafe action.

KPI harus sesuai use case.

Benchmark vendor mungkin tidak relevan.

Acceptance test memakai data customer.

Klausul ketujuh: hallucination dan limitation

Vendor tidak bisa guarantee zero hallucination.

Customer juga jangan menuntut impossible.

Tapi contract bisa mengatur: known limitation disclosure.

Guardrail.

Human review requirement.

High-risk excluded use.

Misalnya service tidak untuk medical diagnosis.

Kalau customer misuse, liability berbeda.

Clear intended use protects both.

Klausul kedelapan: intellectual property output

Siapa punya output?

Prompt?

Fine-tuned model?

Custom dataset?

Feedback?

Jangan vague.

Untuk generative content, warranty juga tricky.

Vendor mungkin tidak menjamin output tidak infringing.

Customer perlu tahu.

Indemnity bisa negotiate.

Especially commercial content.

Rights clearance.

Contract must allocate.

Klausul kesembilan: copyright training

Apakah model menggunakan licensed data?

Vendor punya copyright policy?

Kalau regulator atau rights holder claim, siapa handle?

Tidak semua vendor bisa disclose dataset.

Tapi contract bisa meminta representation.

Compliance with applicable copyright law.

Notice.

Cooperation.

Ini makin penting 2026.

Indonesia sendiri sedang membahas hak cipta dan AI.

Klausul kesepuluh: data localization dan transfer

Data processing country.

Cross-border transfer.

Subprocessor.

UU PDP Indonesia punya ketentuan transfer luar negeri.

Contract harus support compliance.

SCC or binding safeguard mungkin relevant tergantung structure.

Legal review.

Jangan hanya percaya statement “global cloud.”

Where exactly?

Klausul kesebelas: privacy rights support

User minta correction.

Deletion.

Access.

Vendor harus membantu controller.

SLA.

Data export.

If AI memory stores data, deletion must include memory system where applicable.

Contract should define.

Kalau vendor tidak support data subject requests, customer compliance susah.

Klausul kedua belas: security

Encryption.

Access control.

Credential.

Pen test.

Incident.

AI-specific: prompt injection. Tool permission. Data exfiltration.

Security clause perlu update.

Agentic AI increases attack surface.

Vendor must have secure development.

Customer also has responsibility configuration.

Shared.

Klausul ketiga belas: incident notification

Berapa cepat?

Security incident.

AI malfunction.

Wrong action.

Material bias.

Model outage.

Incident taxonomy.

Critical: hours.

Others: days.

Need cooperation.

Root cause.

Logs.

Remediation.

No surprise via Twitter.

Klausul keempat belas: audit rights

Customer high-risk need evidence.

SOC report.

ISO.

AI evaluation.

Right to request info.

Independent audit.

Not necessarily source code.

But enough.

Vendor confidentiality protected.

For government and regulated sectors, stronger.

Trade secret is not excuse for zero audit.

Klausul kelima belas: transparency

Vendor must give information customer needs to disclose AI use to end users.

If chatbot must identify itself, platform supports.

If reason code needed, system provides.

Transparency requirement should flow down supply chain.

Customer cannot comply if vendor blocks info.

Contract aligns.

Klausul keenam belas: human oversight

For agent: approval workflow.

Override.

Limit.

Vendor guarantees capability.

Company defines policy.

Especially high-value transaction.

If platform cannot stop action, problem.

Human control should be product requirement.

Klausul ketujuh belas: liability

Hard.

Vendor wants cap.

Customer wants coverage.

Negotiate based risk.

Data breach.

IP claim.

Gross negligence.

AI error.

Not all same.

Do not accept liability cap blindly.

If system controls million-dollar transaction, USD 100 cap absurd.

Insurance maybe.

Shared responsibility.

Klausul kedelapan belas: autonomous transaction

Agent can purchase?

Send email?

Modify database?

Contract should define authorization boundary.

Transaction cap.

Third-party interaction.

Who bears unauthorized action?

Indonesia already has concept Agen Elektronik in UU ITE and PP 71/2019.

Modern AI agent may require careful legal mapping.

Contract should not leave ambiguity.

Klausul kesembilan belas: pricing

AI pricing dynamic.

Token.

Compute.

Tool call.

Agent task.

Set budget control.

Rate limit.

Cost alert.

Price change notice.

No runaway loop.

Maybe monthly cap.

FinOps.

Contract is financial control.

Klausul kedua puluh: service continuity

Vendor outage.

Model provider outage.

What fallback?

SLA.

Backup model.

Manual operation.

For critical system, continuity plan.

If one API down and company stops, concentration risk.

Contract can require resilience.

Klausul kedua puluh satu: exit and portability

When contract ends: data export.

Format.

Prompt.

Workflow.

Logs.

Embedding?

Fine-tune?

Delete.

Transition support.

Vendor lock-in often hides in integration.

Best time to negotiate exit is before entering.

Klausul kedua puluh dua: decommissioning

Credential revoked.

Data deleted.

Backup handled.

Agent disabled.

API key removed.

Certification.

Offboarding.

AI can leave persistent memory or derived data.

Contract needs closure.

Klausul kedua puluh tiga: regulatory change

AI law changes fast.

Perpres Indonesia.

UU AI future.

EU AI Act.

Contract multi-year must adapt.

Compliance cooperation.

Cost allocation.

Timeline.

If new requirement comes, who implements?

Without clause, dispute.

Klausul kedua puluh empat: subcontractor

Vendor may outsource labeling, support, hosting.

Customer needs visibility for critical functions.

Consent or notice.

Main vendor remains responsible.

Do not let liability disappear down chain.

Klausul kedua puluh lima: documentation

Architecture.

Data flow.

Model info.

Admin guide.

Recovery.

Evaluation.

Deliverables.

Without docs, customer hostage.

Documentation is exit asset.

AI contracting is becoming a recognized field globally.

European Commission in 2026 even moved to create an expert group focused on reducing risk in AI contracting for SMEs and developing model contract terms and guidance.

That signals something.

AI contract complexity is no longer niche.

It is becoming standard commercial law problem.

Perusahaan Indonesia tidak perlu menunggu template sempurna.

Mulai dari risk.

Low-risk SaaS: short terms.

High-impact AI: deep contract.

Proportional.

Jangan semua vendor disiksa 50 clause.

But don’t use clickwrap for critical system.

Kontrak AI 2026: Klausul yang Mulai Tidak Bisa Diabaikan Perusahaan bukan berarti kontrak harus lebih panjang.

Harus lebih tepat.

Karena sistem AI berubah, belajar, terhubung data, dan kadang bertindak.

Kontrak harus mengatur lifecycle.

Satu clause tambahan yang makin penting adalah acceptance testing. Jangan anggap kontrak selesai ketika akses diberikan. Untuk system material, vendor perlu lulus scenario yang sudah disepakati sebelum production.

Test data representatif.

Edge case.

Security.

Human override.

Performance.

Kalau tidak memenuhi threshold, customer punya hak meminta remediation atau menunda go-live.

Acceptance testing membuat KPI berubah dari marketing claim menjadi contractual evidence.

Kemudian perlu clause tentang evaluation cooperation. Customer mungkin perlu menguji model secara periodik. Vendor harus menyediakan sandbox, log, atau API yang cukup. Jangan sampai customer diwajibkan patuh regulasi tetapi contract melarang semua testing.

Ada juga isu data return versus data deletion. Dua hal berbeda. Customer mungkin ingin export seluruh data dulu, lalu vendor menghapus copy. Urutan dan format harus jelas. Kalau hanya ada “data deleted on termination,” migration bisa gagal.

Untuk agentic AI, clause tentang delegated authority juga perlu. Siapa yang boleh memberi agent instruction, siapa yang boleh approve, dan apakah vendor bertanggung jawab jika system mengeksekusi di luar configured limit.

Contract yang matang akan semakin mirip operating manual hukum.

Bukan sekadar terms penggunaan.

Perusahaan juga perlu memperhatikan hierarchy of documents. Master agreement, data processing agreement, AI addendum, order form, dan online policy bisa saling merujuk. Kalau ada konflik, mana yang menang?

Ini detail legal yang kelihatan receh sampai incident terjadi. Pastikan negotiated terms tidak diam-diam dikalahkan halaman kebijakan yang bisa berubah sepihak.

Untuk kontrak bernilai besar, buat document precedence jelas.

Itu penting banget.

Dan untuk sistem kritis, detail seperti ini tidak boleh ditunda.

Bukan hanya hari pertama subscription.

Kalau perusahaan hanya membaca harga dan SLA, risiko terbesar justru tersimpan di clause yang tidak pernah dibahas.