From chips to customers: where the risk sits in AI infrastructure contracts

An AI product looks like software to its users. Underneath, it runs on a chain of contracts. Someone financed the chips. Someone bought the servers and runs them. Someone leased the power and floor space. Someone sold the compute, licensed the model, and signed the enterprise customer. Each link is a separate agreement, usually negotiated by different people at different times.

Two things make these contracts harder than they look. First, the market is young. Forms and positions that are settled in older industries, such as what a fair outage credit looks like or who carries the risk of late delivery, are still being worked out deal by deal. Second, nearly every company in the chain is both a customer and a supplier. A GPU cloud buys power and hardware and sells capacity. An AI application company buys compute and model access and sells to enterprises. That means most of the risk doesn't sit inside any one contract. It sits in the gap between what you promised downstream and what you were promised upstream.

This guide walks through the chain one link at a time, then shows how to line the links up.

1. GPU financing: when the collateral depreciates

Lenders now treat GPUs as collateral. GPU clouds have borrowed tens of billions of dollars secured by their chips since 2023, when one of the largest closed a $2.3 billion GPU-backed facility. The structures vary, from term loans and private credit facilities to equipment leases and sale-leasebacks, but lenders tend to focus on the same few questions.

• What is the collateral worth, and for how long? Rental prices for a GPU generation can fall sharply once the next one ships, and useful-life assumptions are moving. Effective January 1, 2025, Amazon shortened the estimated useful life of a subset of its servers and networking equipment from six years to five, citing the faster pace of AI development. Expect loan-to-value tests, amortization tied to depreciation, and pressure to prepay if values fall.
• Whose revenue backs the loan? Lenders often size facilities against contracted customer revenue. That brings covenants on customer concentration, limits on amending key customer contracts, and collateral assignments of those contracts, which may trigger consent or notice provisions in them.
• Where is the collateral? Chips sit in someone else's data center. Lenders will want access and step-in rights there, which means your colocation provider may need to sign an agreement with your lender.
• Is it a lease or a loan? Under the Uniform Commercial Code, a "lease" can be treated as a secured sale on credit depending on its economics, for example if the lessee is effectively bound to end up owning the equipment. The label doesn't decide it. A lessor that hasn't made a precautionary filing risks being treated as an unperfected secured creditor if the deal is recharacterized, and can end up unsecured in the lessee's bankruptcy.

What to negotiate: covenants you can meet when prices move, cure periods before cross-defaults bite, the right to substitute or upgrade equipment, and clarity on which customer contract changes need lender consent.

2. Hardware purchase and managed services: allocation, acceptance and export controls

Buying a GPU cluster isn't like buying servers. Supply is allocated, deposits are common, and the hardware often arrives in phases.

• Deposits and allocation. Prepayments made to secure an allocation are often non-refundable. Tie them to a firm delivery window and get them back, or credited, if the supplier misses it.
• Delivery and acceptance. Supplier delivery dates are usually stated as estimates. Define acceptance by performance testing of the installed cluster, not by delivery to the dock, and say what happens if nodes fail burn-in.
• Title and risk of loss. These often pass at different points. Make sure your insurance is in place for the moment risk passes to you, not the moment you take title.
• Warranty and replacement. Manufacturer warranties usually reach you only through the reseller, and only to the extent it can pass them through. Agree replacement times for failed parts and a spares pool on site, because one failed node can take a training job down.
• Managed services. If a third party runs the cluster, its service levels should measure what you sell: node availability, job completion and response times, not just whether the facility had power.

Advanced AI chips are also subject to US export controls that have changed repeatedly since 2022. In May 2025 the government stopped enforcing a broad rule on worldwide chip exports and said it would replace it. No replacement had been published by October 2026, though officials have signaled new rules are coming, and country-specific rules keep changing, such as a July 2026 rule easing some controls for the UAE. Separate 2026 guidance also confirmed license requirements for entities headquartered in certain countries, even when they operate elsewhere. Contracts for hardware and capacity that cross borders need compliance representations, end-use and end-user commitments, cooperation on licenses, and a clear outcome if a shipment or service can't lawfully go ahead.

3. Data centers and colocation: buying power on a deadline

At the bottom of the stack, an AI deal is a construction and real estate project. A rack of current-generation GPU systems can draw well over 100 kilowatts (Nvidia's GB200 NVL72 is about 120 kW) and needs liquid cooling, against the single-digit kilowatts a typical enterprise rack was built for. What an AI tenant is really contracting for is megawatts of power and cooling, available by a specific date.

• Ready-for-service dates. Capacity for AI workloads is often contracted before the hall is finished. The provider's delivery date depends on its own construction schedule, equipment deliveries and utility interconnection. Ask for meaningful remedies if the date slips: service credits that grow with the delay, a right to terminate after a long delay, and regular reporting on construction progress.
• Phased ramps. If capacity comes online in phases, match your payment obligations to power actually delivered, not to the schedule as originally promised.
• Power pricing. Is power billed at cost, metered with a markup, or included in a fixed fee? Who carries utility rate increases?
• Uptime and outage remedies. Provider forms typically make service credits the sole remedy for outages. For workloads where an outage costs far more than the rent, that allocation deserves a hard look, along with termination rights for chronic failures.
• Term. Colocation commitments can run longer than the economic life of the hardware they house. Expansion rights, rights to sublet or assign, and early termination options matter more than they used to.

If you build or own the facility, the risk moves one level down, into the construction contracts, the equipment supply agreements and the utility agreements that decide whether the date holds. Our guide to data center contracts for electrical subcontractors covers that side.

4. Compute capacity and cloud: paying for what isn't built yet

Capacity reservation agreements let a buyer secure GPUs for a term, usually in exchange for a firm commitment to pay. For the buyer, that commitment is the main risk. For the seller, it's often the basis of its financing.

• Take-or-pay. Most reservations require payment whether or not you use the capacity. Negotiate the right to resell or reassign unused capacity, and a ramp that follows your real demand.
• Delivery. If the capacity isn't built yet, the contract should define the delivery date, the remedy for missing it and when you can walk away.
• What exactly you're buying. Name the GPU model, the interconnect, the storage and the network performance. Limit the provider's right to substitute different hardware.
• Maintenance and availability. Planned maintenance windows, how availability is measured and what counts as an outage all need to be written down.
• Credit support. Sellers often ask for prepayments, letters of credit or parent guarantees. Size them to the real exposure, and step them down as you pay.

5. Inference and revenue share: define the money

GPU rental and revenue-share arrangements, where one party supplies the compute and the other the customers or the model, live and die on definitions.

• What counts as revenue. Gross or net? After refunds, chargebacks, discounts and third-party fees? Who sets prices?
• Reporting and audit. Monthly usage and revenue reports, access to the underlying data, and audit rights with a cost-shifting threshold if an audit finds an underpayment.
• Minimum guarantees and what happens when they aren't met.
• Customer ownership. Who owns the end-customer relationship, whether either side can sell direct, and what non-solicitation applies after the deal ends.
• Exclusivity, if any, and how long it lasts.

Inference services agreements raise a separate set of questions: latency and throughput commitments, rate limits, notice before a model version is changed or retired, and whether prompts and outputs are retained or used for anything beyond serving the request.

6. Model licensing: open weights aren't the same as open source

Many companies build on open-weight models, but the licenses differ widely. Some models are released under permissive licenses such as Apache 2.0. Others come with custom terms. Meta's Llama 3.3 license, for example, requires a licensee whose products, together with its affiliates', had more than 700 million monthly active users in the month before the model's release to request a separate license from Meta. It requires a "Built with Llama" notice when the model, derivatives or products containing them are distributed or made available, requires any distributed model built with Llama or its outputs to have a name beginning with "Llama," incorporates an acceptable use policy, and is governed by California law.

Hosted model APIs raise different questions: whether your data is used for training, how long it's retained, which subprocessors handle it and where. Some large providers offer to defend enterprise customers against copyright claims based on outputs, but these commitments come with conditions. Microsoft's, for example, requires customers to use the product's content filters and other safeguards, not to try to generate infringing material, and to have rights to their inputs.

The point to carry forward: your model license and provider terms set a ceiling on what you can promise your own customers about use rights, data and IP.

7. Enterprise customer contracts: the questions now come first

Enterprise buyers increasingly ask about AI before they sign anything else. Expect an AI schedule or questionnaire covering whether customer data is used for training, which model providers process it, how outputs are reviewed, what accuracy commitments you make, and who owns and indemnifies outputs. A data processing addendum usually comes with it.

Regulated customers add another layer:

• Banks. The Federal Reserve, FDIC and OCC issued joint guidance in 2023 on managing third-party relationships across their full life cycle. Its contract factors include audit rights, information and data, subcontracting, performance measures, and default and termination, and bank procurement teams turn them into diligence questionnaires and contract terms. In September 2026 the agencies proposed replacing it with a more principles-based version. Until that is final, the 2023 guidance applies.
• Insurers. The National Association of Insurance Commissioners adopted a model bulletin on insurers' use of AI in December 2023, and 29 jurisdictions had adopted it by October 2026. It expects insurers to oversee AI vendors, including through audit rights and vendor cooperation with regulators.

These requests aren't unreasonable, but each one is a promise about something you may not fully control, because it depends on your model provider, your cloud or your data center. That's where the stack has to line up. 10 legal risks AI startups underestimate covers the customer-facing basics.

Build the stack back-to-back

The most expensive problems in AI infrastructure rarely come from a bad clause in a single contract. They come from contracts that don't match: a firm, long upstream commitment against a flexible, short downstream one, or a promise to a customer that no supplier made to you.

A simple discipline helps: before signing any link in the chain, put the upstream and downstream versions of the same clause side by side, such as term, delivery, service levels, data, IP and exit, and close the gaps you can. Price the ones you can't.

Standards in this market are still forming, so many of these terms are still open to negotiation. Use that while it lasts.

For general information only, not legal advice. Export control, data protection and financial regulation in this area change frequently. Get advice on the specific transaction before you sign.