Does your AI acceptable use policy cover contractors and freelancers?

By the Shadow AI Policy team

Not unless your contract says so: an employee handbook binds employees, so a contractor or freelancer is only bound by AI rules that are written into their agreement (or incorporated into it by reference) and acknowledged in writing. The fix is a short AI clause in every contractor agreement, a signed acknowledgment, matching indemnity and termination terms, and the same obligations passed down through any agency or vendor that supplies the worker.

This post covers the contract language to use, how to run a contractor acknowledgment that actually holds up, how to allocate liability when a contractor's AI use goes wrong, what to require from staffing agencies and outsourcing vendors, and when you can end the engagement over an AI breach. It also includes a table showing which enforcement lever reaches which kind of non-employee worker.

1. Why doesn't your employee AI policy already apply to contractors?

Because a policy is an instruction to staff, and contractors aren't staff. Your handbook and acceptable use policy apply to employees through the employment relationship; a freelancer, consultant or agency worker is bound by the contract they signed, and nothing else. If that contract says nothing about AI tools, you have no clean basis to tell them which tools they can or can't paste your data into.

That gap matters more than it looks. Contractors often bring their own laptops, their own software subscriptions and their own habits, and they usually sit outside your single sign-on, your data loss prevention tools and your approved-app list. A contractor drafting a proposal on a personal chatbot account is the same shadow AI problem you're fighting internally, with fewer controls and less visibility.

The answer isn't a separate, longer policy for contractors. It's using the policy you already have and attaching it to the contract, so the same rules apply to everyone who touches your data, whatever their employment status.

2. What contract clause should restrict a contractor's AI tool use?

Use a clause that covers four things: which tools are allowed, what data may never go into them, disclosure of AI-generated work, and incorporation of your AI policy by reference. Keep it short and specific; vague language like "use AI responsibly" gives you nothing to enforce.

A workable starting point, to adapt with your own counsel:

"Contractor shall not input, upload or otherwise disclose any Confidential Information, personal data or Client materials into any artificial intelligence tool, model or service except tools approved in writing by Client and used under Client-provided or Client-approved accounts. Contractor shall disclose in writing any material use of AI tools in producing Deliverables. Contractor shall comply with Client's AI Acceptable Use Policy, as provided to Contractor and updated from time to time, which is incorporated into this Agreement by reference."

Three drafting points make this clause stronger:

• Define "AI tool" broadly. Cover chatbots, writing assistants, meeting transcription and note-taking tools, code assistants, and AI features built into ordinary software. Many leaks happen through an AI feature inside a tool nobody thinks of as "AI".
• Name the approved list, don't describe it. Attach it as a schedule or point to a page you control. "Enterprise-grade tools" is a debate; "the tools listed in Schedule C" isn't.
• Tie it to your existing confidentiality and IP terms. Say that a prohibited AI disclosure is a breach of confidentiality, and that AI-assisted deliverables still carry the same ownership and originality warranties as everything else.

One caution: restrict what happens to your data and your deliverables, not how the contractor runs their business day to day. Detailed control over a contractor's working methods can blur the line between contractor and employee in some jurisdictions. Data-handling rules are easier to justify than rules about their workflow.

3. How do you get contractors to acknowledge the AI policy?

Make acknowledgment a condition of starting work: no signed acknowledgment, no system access. Incorporation by reference in the contract is the legal anchor, but a separate, dated sign-off proves the contractor actually received the current version.

A simple process that holds up:

1. Send the policy with the contract, not after. Attach your AI acceptable use policy (or a one-page contractor summary of it) to the onboarding packet. If you don't have a policy yet, start from our AI acceptable use policy template.
2. Collect a dated, versioned acknowledgment. Record the policy version number, the date, and the contractor's name. An e-signature or a click-through with a logged timestamp both work.
3. Gate access on it. Whoever provisions accounts checks for the acknowledgment before granting access to shared drives, repositories or client data.
4. Re-acknowledge on material changes. The contract clause says the policy can be updated; your process should push the new version and collect a fresh sign-off when the approved-tool list or the data rules change.

Keep the contractor version short. A freelancer working on one project needs the approved tools, the forbidden data types and who to ask, not your full governance framework.

4. Who pays if a contractor's AI use causes a breach or an IP problem?

The contractor should, up to a sensible limit, and your agreement has to say so explicitly. Standard indemnities often cover confidentiality breaches and IP infringement in general terms; add language that names unauthorized AI use as a covered event so there's no argument later.

The clauses to check or add:

• Indemnity for unauthorized AI disclosure. The contractor indemnifies you for losses, regulatory costs and third-party claims arising from inputting your data into an unapproved AI tool.
• Warranty on AI-assisted deliverables. The contractor warrants that deliverables don't infringe third-party rights and discloses which parts were materially AI-generated. Copyright protection for purely AI-generated material is uncertain, so you want to know what you're actually getting before you rely on owning it.
• Liability cap carve-out. Many contracts cap liability at the fees paid. Consider carving confidentiality and data-protection breaches out of that cap, or setting a separate, higher cap for them.
• Insurance. For contractors handling sensitive data, require professional liability or cyber cover and ask for the certificate.

Be realistic about solo freelancers. An indemnity from a one-person business is worth only what that person can pay, so your real protection is prevention: approved accounts you control, and limited access to the data that would hurt most.

5. What do you owe when the contractor comes through an agency or vendor?

You owe yourself a flow-down: the agency or vendor must sign your AI terms and contractually bind every individual it puts on your work. You usually have no direct contract with the person doing the work, so the agency agreement is the only place your rules can live.

Different worker types need different levers. This table maps who you're dealing with to where the AI obligation has to sit:

Worker type	Where the AI obligation lives	How you verify it	Main enforcement lever
Direct freelancer or consultant	Your contract, with the policy incorporated by reference	Signed, versioned acknowledgment	Termination and indemnity
Staffing agency worker	Agency agreement, with a duty to flow terms down	Agency confirms each worker signed; you collect the acknowledgment too	Right to remove the worker; agency indemnity
Outsourcing vendor team	Master services agreement and data processing terms	Vendor's own AI policy, security questionnaire, audit right	Breach notice, audit, contract termination
Freelance marketplace hire	Your own side agreement or statement of work, not the platform's terms alone	Acknowledgment before any files are shared	Ending the engagement; limiting what you share

For agencies and vendors, require three things in writing: that they bind their personnel to AI restrictions at least as strict as yours, that they tell you promptly if one of their people puts your data into an unapproved tool, and that they disclose which AI tools their own team uses on your work. Ask vendors whether they have their own AI policy; if they don't, yours applies to their team on your account.

Don't assume a freelance platform's terms protect you. Those terms govern the platform's relationship with each side; they won't contain your approved-tool list or your data rules.

6. Can you terminate a contractor for breaking the AI rules?

Yes, if the contract makes an AI breach a ground for termination; without that, you're arguing over whether it counts as a material breach. Write it in plainly so the decision is yours to make, not a dispute to win.

The termination language should cover:

• Immediate termination for prohibited disclosure. Inputting confidential or personal data into an unapproved AI tool is a material breach that allows termination without a cure period.
• Cure period for lesser breaches. Failing to disclose AI use in a deliverable, or using an approved tool in the wrong way, can carry a short cure period instead. Not every slip warrants ending the relationship.
• Exit obligations. On termination, the contractor deletes your data, including anything held in AI tool histories, chat logs or uploaded files, and certifies the deletion in writing.
• Cooperation. The contractor cooperates with your investigation, including identifying which tool was used and what was entered, so you can assess whether you have a notification obligation.

Set the internal decision rule now, before the first incident. Decide who can trigger termination (usually the engagement owner plus legal or HR), and which breaches are automatic exits. When the contract, the acknowledgment and the decision rule all line up, enforcement is quick and defensible.

If you want this as ready-to-use documents rather than a blank page, you can generate a tailored policy kit and attach the policy to your contractor agreements.

About Shadow AI Policy: We build AI acceptable use policy tools for HR and operations teams at 50–500 person companies. We publish guides on shadow AI, acceptable use policies, and AI governance, updated as regulations and AI tools change.