3. Put your salesperson, your attorney, and your data owner in the same room
Review contracts with three people present: the attorney, the salesperson, and the person who actually owns the data at your company. One of Morrison's clients has built this into how it sells. Everyone involved in the deal works from the same tight timeline, which cuts down on internal back-and-forth.
Including everyone from the start makes it easier to get on the same page. Salespeople often don't know the specifics of how their own company governs data, and the contract will be written to match whatever was sold. "The data folks and their chief data officer will say, 'That's not how we do that,'" Morrison says. When the data owner is in the room, those questions get answered, and the contract gets corrected before signing.
4. Write down how you handle data before a customer asks
Build a clear, technical account of how your product handles customer data and have it ready before contract review starts. Morrison says scrutiny lands unevenly, and that smaller vendors absorb more of it than the large platforms do.
"Large, best-in-class providers like Anthropic, Microsoft, Google, are often totally fine," he says. "It is rare that clients have any problem with those cloud tools, but people are really skeptical of non-bulge-bracket, brand-name AI tools."
What contract reviewers want is a company that can account for how it handles data: where it goes, who touches it, what the AI model does with it, what the model retains, and what your agreements with your own vendors allow. Most small vendors cannot answer that in writing on short notice. Prepare in advance for a faster review.
5. Ban consumer AI tools for company data
Morrison advises clients not to put company information into consumer AI tools, and to write that rule down so they can hand it to anyone who asks. Customer legal teams ask about it, and client data privacy and AI policies can cover the same ground. A company that is loose with its own data has a hard time arguing it will be careful with a customer's.
"Just forbid your employees from using off-the-shelf, public AI [GARBLED: "toolqueries"], because a lot of those tools are unrestricted environments that will commercially use your data to train their products or systems," Morrison says. "You're giving this counterparty pretty heavy use of your data and sometimes, client data, if the team is not conscientious."
The exposure he has in mind is confidential material and HR records, handed to a counterparty with broad rights to use it. For anything sensitive, his position is that the work has to happen inside a private cloud environment.
Where Ann Arbor founders can get help paying for this
Founders trying to close a deal don't have to absorb the legal cost alone. Ann Arbor SPARK offers grant programs that can be applied toward professional services, including legal and intellectual property work, and additional statewide funding is available to bring in third-party specialists for early-stage technology companies. Each program has its own eligibility criteria (company stage, industry, location, and how the money can be spent all vary), so the first step is usually a conversation about which programs a company qualifies for.
SPARK sits at the center of a dense network of support organizations, university programs, and investors, and for most founders building here, SPARK is the first call. It also administers the Michigan Angel Fund, alongside its SPARK Capital pre-seed fund. Companies that reach those programs have usually come through earlier-stage support first, including the eight-week Entrepreneur Boot Camp and the Entrepreneur-in-Residence program, which pairs founders with experienced operators for ongoing mentorship.
The same regional network that helps with a first contract is where founders find their next customers, hires, and investors.