Facts, Musings & Other Field Notes

Nobody puts "material change" clauses in a normal software contract. Apps update, buttons move, you adapt. Fine.

AI is different, and most contracts haven't caught up. The model writing your customer emails or screening your resumes can shift overnight: tone, judgment, output. And nothing in the interface flags it. You don't get a changelog. You get a slightly different result and no idea why.

I'm not saying every update needs sign-off. Most don't. But somewhere in your stack is one AI tool where a quiet change would actually hurt, and right now, nothing in your contract requires anyone to tell you before it happens.

Go find that contract. Check for a notice clause. There probably isn't one.

Half your team is already using ChatGPT. Not officially. Not through a vendor contract IT reviewed. Just open a tab, paste, go.

Is that a crisis? Depends who you ask. It's also exactly what happened with Dropbox in 2011, and Slack before anyone had a Slack policy. New tool shows up, people use it because it works, and legal finds out eighteen months later.

The difference this time: your NDAs and vendor agreements almost certainly say nothing about it. Not because anyone decided AI tools were fine to skip. It's because the policy was written before the tools existed.

Ban it and you'll lose the compliance battle to convenience. Ignore it and you're one client contract paste away from a bad conversation. The actual move is boring: write the policy now, while it's still hypothetical.

Picture the product review. Marketing's slide says "AI-powered personalization." Someone from engineering, three seats down, mutters that it's mostly a rules engine with one small model bolted on for edge cases. Nobody stops the meeting over it.

That gap used to be harmless. Now it's the exact gap regulators are opening enforcement actions over. The FTC has already gone after companies for overstating what their AI does, and the standard for "how much AI is enough to call it AI-powered" is being set case by case, live, rather than handed down in advance.

Which puts marketing teams in a strange spot: writing legal-adjacent claims with no fixed legal standard to check them against.

If nobody at your company could stand behind every AI claim on the website, term by term, in front of a regulator, that's not a hypothetical anymore. That's this quarter's to-do list.