The evaluated package
Exact document versions, connected terms and the contract’s Data-Risk Profile.
AI addendum negotiation
Keep AI vendor permissions inside your approved boundary.
Evaluate training, model improvement and retention terms alongside the connected DPA and MSA. Give Privacy, Security and Legal the real data-use decision—not another addendum to review in isolation.
- Privacy
- Legal
- Security
- Third-Party Risk
From changed terms to a clear decision
Model improvement changes more than the AI addendum.
Follow one illustrative request. See what changed, why authority is missing and what can happen next.
Step 1 of 3: Changed terms.
AI addendum + DPA + connected MSA
The returned package
- Proposed data use
- New permission to use customer data for model improvement.
- Connected change
- Longer retention for prompts and outputs.
The connected agreements stay in scope throughout the check.
Requested action
Send the next vendor response.
The vendor asks to use de-identified customer data for model improvement and extends the retention period for prompts and outputs. Both changes must be evaluated together.
External response held
The request is not permission to send.
Less repeat review. Clearer ownership.
A new AI permission can change the entire data-risk package.
A model-training request can change the meaning of DPA purpose limitation, retention, data transfer, security assurance and liability provisions. A simple redline comparison does not establish whether the combined package is permitted.
Reviewer rights and approval scope
Agree which functions must decide, who may act and the limits of their authority. Validate the approval path in the pilot; a department label or administrator role alone does not confer approval rights.
- 01
Protect approved data-use positions
Compare vendor training, service-improvement and evaluation rights with the approved data-use position and prohibited floors.
- 02
Link evidence and risk context
Require the customer-defined AI risk assessment, data-flow, subprocessor or residency evidence for this proposed use and exact agreement. An assessment for another purpose, entity or version does not settle the current action.
- 03
Keep human judgment for connected exceptions
Bring the proposed data use, evidence gap and connected DPA and MSA terms to the authorised owner. Record their decision, show what still needs approval and recheck the response before human-approved sending.
Authority, not just advice
A decision is only as current as the package behind it.
The versioned authority record connects the evaluated documents, customer policy, supporting evidence and responsible decisions. Changed terms or stale evidence require a fresh evaluation before a governed external action progresses.
The basis for the decision
Inspect the documents, policy, evidence and decisions behind each pilot outcome. Validate that missing, outdated, conflicting or unverified information is made clear. Missing historical information remains missing.
The exact next action
Live vendor responses require human approval and a fresh check of current authority, exact content and destination. A permit or wording approval alone is not permission to send.
These controls apply to actions routed through DataHalt’s supported gateway. They do not govern activity outside that path or confer corporate signing authority.
Test what happens when supplier circumstances, evidence or approval rights change after review. Validate that the response stays held until its current requirements are resolved.
See the exact-action checkKeep the package connected
Where this workflow goes next.
Validate one workflow in Shadow Mode, then review the evidence before agreeing any human-approved live scope.
Decision history and agreement handoff
Recorded decisions retain their evaluated policy, document versions, evidence and responsible owners; missing historical information remains explicit. Resolving this workflow is one step toward an authorised agreement. Final-package acceptance checks the complete document set; ready for signature does not grant signing authority.
Start with one recurring agreement
Start with the workflow.
See the decision clearly.
A 15-minute conversation about one recurring vendor workflow, the teams involved and whether a scoped pilot is a fit. No contract upload needed for the first conversation.
Deployment scope. These workflows are available for pilot validation, not presented as verified live capabilities. Confirm the enabled scope and current release evidence before live use. Examples are illustrative, not customer outcomes or permissions. Live vendor responses require human approval and a fresh check of current authority, exact content and destination. A permit or wording approval alone is not permission to send.