--- title: What an AI vendor contract can and cannot do for your association description: What AI vendor contracts cover on data use, IP indemnity, liability caps and change control, where the law is heading, and what a contract cannot show. image: https://www.cimbiotic.ai/hubfs/cimbiotic-og.png --- [Skip to content](https://www.cimbiotic.ai/insights/what-an-ai-vendor-contract-can-and-cannot-do-for-your-association#main) [Cimbiotic](https://www.cimbiotic.ai/) Menu [Home](https://www.cimbiotic.ai/)[AI Red Teaming](https://www.cimbiotic.ai/ai-red-teaming)[CimAssure](https://www.cimbiotic.ai/cimassure)[Pricing](https://www.cimbiotic.ai/pricing)[About](https://www.cimbiotic.ai/about)[Insights](https://www.cimbiotic.ai/insights) [Free Scorecard](https://www.cimbiotic.ai/scorecard) --- Insights # What an AI vendor contract can and cannot do for your association Oct 19, 2026, 1:52:12 PM · Rick Bawcum [← All insights](https://www.cimbiotic.ai/insights) *Disclaimer: This is general information, not legal advice. Laws and vendor terms change, and the dates here are current as of October 18, 2026. Have counsel review any contract before you sign it or renew it.* **In brief** - Your association answers for what its AI tells members. A vendor's contract does not change that. - Four contract terms matter most: data use, IP indemnity, liability caps and change control. Large vendors' published terms cover some of this, with conditions. - The law moved in 2026. Colorado replaced its AI Act, and the EU's high-risk obligations slipped to December 2, 2027. - ISO/IEC 42001 certifies a vendor's management system, not its product. Only independent testing shows whether a system works. ## Your association answers for what its AI tells members In February 2024 a British Columbia tribunal ordered Air Canada to compensate a customer who had relied on wrong bereavement-fare information from the airline's website chatbot ([the decision](https://decisions.civilresolutionbc.ca/crt/crtd/en/525448/1/document.do), [Dentons](https://www.dentonsdata.com/airline-ordered-to-compensate-a-b-c-man-because-its-chatbot-provided-inaccurate-information/), [McCarthy Tétrault](https://www.mccarthy.ca/en/insights/blogs/techlex/moffatt-v-air-canada-misrepresentation-ai-chatbot)). Air Canada argued the chatbot was a separate entity responsible for its own actions. The tribunal disagreed: "It should be obvious to Air Canada that it is responsible for all the information on its website," and "It makes no difference whether the information comes from a static page or a chatbot." It found negligent misrepresentation, because the airline "did not take reasonable care to ensure its chatbot was accurate." The total award was $812.02. The award was small, and one tribunal decision does not make settled law. What carries over is the reasoning. A member who gets the wrong dues deadline or certification requirement from your assistant did not deal with the vendor. They dealt with you. The tribunal needed no special rule for AI. It treated the chatbot as part of the website. Vendors can be pulled in too. In July 2024 a federal judge in California let claims against the HR software vendor Workday go forward on the theory that it acted as the employers' agent in screening job candidates ([Seyfarth](https://seyfarth.com/news-insights/mobley-v-workday-court-holds-ai-service-providers-could-be-directly-liable-for-employment-discrimination-under-agent-theory.html)). The case is unresolved. The latest status available runs through December 2025 and shows a preliminary collective certification of an age-discrimination claim in May 2025 ([Clearinghouse](https://clearinghouse.net/case/44074/)). Neither case shows a vendor carrying an organization's risk for it. The law-firm commentary on Workday advises employers to be able to explain what role their AI tools play in decisions. ## What a contract can do Four terms do most of the work. Each is checked below against what large vendors publish. Terms differ by product and tier, so read the ones that apply to what you actually buy. ### Data use Large vendors say in writing that they do not train on business customers' content by default. | Vendor | What it says | Where it applies | | --- | --- | --- | | [OpenAI](https://openai.com/policies/business-terms/) | It "will not use Customer Content to develop or improve the Services, unless Customer explicitly agrees to such use." | Business Terms. The [enterprise privacy page](https://openai.com/enterprise-privacy/) names Business, Enterprise, Healthcare, Edu, Teachers and the API. | | [Microsoft](https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy) | Prompts, responses and Microsoft Graph data "aren't used to train foundation LLMs." | Microsoft 365 Copilot. | | [Google](https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub) | "Workspace does not use customer data for training models without customer's prior permission or instruction." | Qualifying Workspace editions. Excludes Gemini for Education. | A no-training term is a default on these business products, and it attaches to a named product and tier. Confirm yours in writing. Zero retention is a different matter. OpenAI offers zero data retention only on its API, for eligible endpoints, on request and for a qualifying use case. API inputs and outputs may otherwise be kept for up to 30 days. If a smaller vendor sits between you and one of these models, ask what its own terms say and what it passes on. ### IP indemnity An IP indemnity makes the vendor defend you if a third party claims the AI's output infringes its rights. Large vendors offer one, with conditions. | Vendor | What is covered | Main conditions | | --- | --- | --- | | [OpenAI](https://openai.com/policies/service-terms/) | Output claims on the API and on ChatGPT Enterprise, Edu and Healthcare. ChatGPT Business is not named in the clause, so check your tier. | No cover if the customer knew or should have known the output infringed, disabled or ignored citation, filtering or safety features, modified or combined the output, or lacked rights to the input. | | [Microsoft](https://learn.microsoft.com/en-us/legal/cognitive-services/openai/customer-copyright-commitment) | Output from Azure OpenAI and configurable services. The page names Copilot Studio and GitHub Copilot. | For Azure OpenAI: a metaprompt that directs the model to prevent infringing output, an evaluation for third-party content, and specified filters left on. A customer who tenders a claim must show it complied. | | [Google Cloud](https://cloud.google.com/terms/generative-ai-indemnified-services) | A list of covered services, including Gemini in Workspace and Gemini Enterprise. The page was last modified July 20, 2026. | The conditions sit in service-specific terms that this article did not review. | The OpenAI and Microsoft indemnities respond to intellectual property claims. They do not address a claim like Air Canada's, where the output was simply wrong. ### Liability caps - OpenAI's business terms cap each party's total liability at what the customer paid in the previous twelve months. They carve out gross negligence or willful misconduct, indemnification obligations and payment obligations ([OpenAI business terms](https://openai.com/policies/business-terms/)). - A June 2026 guide to technology contracts says suppliers often propose a cap equal to twelve months of fees, mid-market caps often sit between 100% and 200% of annual fees, and "there is no fixed market standard" ([Jonathan Lea Network](https://www.jonathanlea.net/blog/liability-caps-technology-contracts/)). - The same guide says data protection, confidentiality and security risks are often carved out of the general cap or given a higher one. Ask which of those your contract does, and have it say so in the text. A small association may have little room to negotiate with a large vendor, so compare caps across vendors before you choose one. ### Change control AI services change, often without users' knowledge, due to model changes and product configuration updates. In a 2023 study, researchers compared the March and June 2023 versions of GPT-3.5 and GPT-4. They reported that GPT-4's accuracy at telling prime numbers from composite ones fell from 84% to 51%, and concluded that a single service can change substantially in a short time and needs continuous monitoring ([Chen, Zaharia and Zou](https://arxiv.org/abs/2307.09009)). That is one task in one study, and it says nothing about your vendor. It does show why a contract should require: - advance written notice of material model or guardrail changes - a version identifier you can record - a right to leave if behavior changes A notice clause only covers the changes a vendor tells you about. ## Where the law is heading Regulation is moving toward the organizations that use AI, not only the companies that build it. The detail changed a good deal in 2026, so the dates matter. ### Dates to keep straight | Date | What happens | | --- | --- | | April 27, 2026 | A stipulated order in xAI's suit in Colorado: enforcement waits on final rulemaking and a court ruling ([McDermott](https://www.mcdermottlaw.com/insights/colorado-ai-law-in-flux-comprehensive-replacement-bill-signed-after-federal-court-blocks-predecessors-enforcement/)). | | May 14, 2026 | Colorado's SB 26-189 is signed, repealing and replacing SB 24-205 ([Eckert Seamans](https://www.eckertseamans.com/legal-updates/colorado-repeals-and-replaces-its-landmark-ai-statute-what-businesses-need-to-know)). | | July 24, 2026 | Regulation (EU) 2026/1744 is published in the Official Journal. It enters into force on July 27 ([Cuatrecasas](https://www.cuatrecasas.com/en/spain/intellectual-property/art/digital-omnibus-ai-has-been-published)). | | August 2, 2026 | The EU Article 50 chatbot-disclosure duty applies to providers ([Article 50](https://artificialintelligenceact.eu/article/50/)). | | January 1, 2027 | Colorado's SB 26-189 takes effect ([signed act](https://www.jacksonlewis.com/sites/default/files/2026-05/Colorado-2026a_189_signed-act.pdf)). | | December 2, 2027 | EU Annex III high-risk obligations apply, moved from August 2, 2026 ([Orrick](https://www.orrick.com/en/Insights/2026/07/EU-AI-Act-Update-Digital-Omnibus-Finalizes-8-Compliance-Changes)). | ### European Union The AI Act defines a deployer as an organization "using an AI system under its authority," excluding personal, non-professional use ([Article 3](https://artificialintelligenceact.eu/article/3/)). It applies to deployers established or located in the EU, and to deployers elsewhere where the system's output is used in the Union ([Article 2](https://artificialintelligenceact.eu/article/2/)). An association outside Europe with EU members or EU-facing services should ask counsel whether that second rule reaches it. The heavy obligations fall on high-risk systems. Annex III includes AI used to ([Annex III](https://artificialintelligenceact.eu/annex/3/)): - evaluate learning outcomes - monitor students for prohibited behavior during tests - recruit or select people Whether an AI-assisted professional certification exam counts as education or training is a question for counsel. The essential-services entry covers public assistance benefits, credit scoring, certain insurance pricing and emergency dispatch. It has no entry for membership benefits. From December 2, 2027, deployers of high-risk systems must ([Article 26](https://artificialintelligenceact.eu/article/26/)): - use the system as the provider instructs - give human oversight to people with the competence, authority and support to exercise it - monitor operation - keep the logs under their control for at least six months - inform people affected by Annex III decisions A fundamental rights impact assessment under Article 27 applies to public-law bodies, private entities providing public services, and deployers of certain credit and insurance systems ([Article 27](https://artificialintelligenceact.eu/article/27/)). Most associations are unlikely to fall in those groups, but counsel should confirm. Two duties are not deferred: - A chatbot must tell people they are dealing with AI unless that is obvious. That duty sits with the provider and applies from August 2, 2026 ([Article 50](https://artificialintelligenceact.eu/article/50/)). An organization that puts a system into service under its own name or trademark can be a provider ([Article 3](https://artificialintelligenceact.eu/article/3/)). - Providers and deployers must take measures to support the AI literacy of their staff. The omnibus kept that duty, reworded it, and set no specific level ([Cuatrecasas](https://www.cuatrecasas.com/en/spain/intellectual-property/art/digital-omnibus-ai-has-been-published)). ### Colorado Colorado's 2024 AI Act, SB 24-205, no longer stands as written. SB 26-189 repeals and replaces it, effective January 1, 2027 ([signed act](https://www.jacksonlewis.com/sites/default/files/2026-05/Colorado-2026a_189_signed-act.pdf), [Eckert Seamans](https://www.eckertseamans.com/legal-updates/colorado-repeals-and-replaces-its-landmark-ai-statute-what-businesses-need-to-know)). The new law is built around notice, not advance risk management. A deployer is a person doing business in Colorado that deploys a covered automated decision-making technology. Before using it to influence a consequential decision, a deployer must: - give clear notice - explain an adverse decision in plain language within 30 days - let the person request correction of inaccurate data and "meaningful human review and reconsideration, to the extent commercially reasonable" - keep records for three years The covered domains include education, employment, health care and essential government services. The annual impact assessments and risk-management programs of the 2024 act are gone ([Buchalter](https://www.buchalter.com/insights/colorado-rewrites-its-ai-law-what-employers-must-know-about-sb-26-189/), [Eckert Seamans](https://www.eckertseamans.com/legal-updates/colorado-repeals-and-replaces-its-landmark-ai-statute-what-businesses-need-to-know)). The signed text, as reviewed for this article, contains no exemption for non-profits or small organizations. The Attorney General has exclusive enforcement authority, with a 60-day cure period in most cases and no private right of action. Enforcement timing is unsettled. In April 2026 a federal magistrate judge entered a stipulated order in xAI's lawsuit under which enforcement waits on final rulemaking and a ruling on xAI's expected preliminary-injunction motion ([McDermott](https://www.mcdermottlaw.com/insights/colorado-ai-law-in-flux-comprehensive-replacement-bill-signed-after-federal-court-blocks-predecessors-enforcement/)). Another summary reports that the Attorney General has said he will not enforce the new law until rulemaking concludes ([Buchalter](https://www.buchalter.com/insights/colorado-rewrites-its-ai-law-what-employers-must-know-about-sb-26-189/)). The summaries differ on details, and none gives a firm enforcement date. ### What the two have in common Both moved toward telling people and letting them contest. Colorado requires notice, explanation, correction and human review. The EU's deployer duties center on human oversight, monitoring and logs. Neither requires an annual impact assessment of every deployer. Two laws do not make a trend, and this article did not survey other states. The practical reading is to keep a record of where AI touches decisions about members or staff, who reviews outputs, and what logs exist. ## What ISO/IEC 42001 covers, and what a certificate does not show ISO/IEC 42001 was published on December 18, 2023. It sets requirements for establishing, running, maintaining and continually improving an AI management system inside an organization. It applies to organizations of any size that develop, provide or use AI, including non-profits ([ISO](https://www.iso.org/standard/42001)). It is a standard for how an organization governs AI, not for how a particular product performs. ### What it offers an association A management system of this kind pushes you to settle questions that many small organizations leave open: - who approves a new AI tool - how its outputs are reviewed - what happens when it gets something wrong It can also serve as a buying checklist, with one caution. ### What a vendor's certificate shows Certification is framed around the certified organization's AI management system and its stated scope. One certification body's guidance gives example scopes such as "The Artificial Intelligence Management System (AIMS), acting as an AI User, of a cloud/hosted services platform" ([ISOQAR](https://isoqar.com/wp-content/uploads/2025/09/ISOQAR-ISO-42001-2023-Customer-Guidance.pdf)). A certificate therefore shows that an organization runs a management system within a stated boundary. The guidance reviewed for this article does not describe certification as testing a product's outputs. Ask a vendor for: - the certificate - its scope statement - confirmation that the product you are buying sits inside that scope Treat "ISO 42001 certified" as a statement about the vendor's governance, not about whether its chatbot answers your members correctly. ## Questions to put to a vendor Six questions turn the sections above into a buying checklist. Put the answers in the contract, not in a sales call. | Question | What a good answer looks like | | --- | --- | | Is our content used to train models, and on which product and tier? | A written no by default, naming the product and tier. | | How long is our data kept, and can retention be set to zero? | A stated retention period. Zero retention, where offered, is a request on named endpoints, not a default. | | Does the IP indemnity cover our tier, and what must we do to keep it? | The tier is named. The conditions, such as filters left on, output left unmodified and rights to the inputs, are listed and you can meet them. | | What is the liability cap, and what sits outside it? | A figure tied to fees, with data security and confidentiality either carved out or given a separate higher cap, in the text. | | How will we be told about model or guardrail changes? | A written notice period, a version identifier and a right to leave. | | Does the vendor hold ISO/IEC 42001, and does the scope cover this product? | A certificate, its scope statement, and the product named inside the scope. | ## What the contract cannot show A contract may give you a claim against the vendor if something goes wrong. It does not show whether the system is behaving as promised today. The Colorado and EU rules above both assume an organization can explain what its AI did and who reviewed it. That takes evidence, and a vendor's own testing is not independent evidence. Independent testing fills that gap. It checks the system from the outside, on a schedule, so a change in behavior shows up whether or not the vendor announced it, and it produces something you can show a board or a funder who asks what stands behind an AI claim. Disclosure on its own is an admission. Disclosure backed by independent assurance is a claim of competence. Cimbiotic offers independent AI assurance for associations and non-profits. CimAssure tests chatbots and agents on a regular schedule, and re-tests on demand when a vendor notifies us of a change. Agent testing is available now. To see where your organization stands first, take the [Trust Readiness Scorecard](https://www.cimbiotic.ai/scorecard) (17 questions, free). For a fixed-price, three-week review, see the [CimAssure Baseline](https://www.cimbiotic.ai/cimassure#baseline). ## Limits of this article This is general information, not legal advice. Laws and vendor terms change, and the dates here are current as of October 18, 2026. Have counsel review any contract before you sign it or renew it. Every source listed below was opened and read for this article. Three things were not: - the official EU text on EUR-Lex (the AI Act articles come from artificialintelligenceact.eu and the omnibus dates from law-firm notes) - Google's service-specific terms for its indemnity - Microsoft's Product Terms Colorado details come from a copy of the signed act and law-firm summaries, which differ on enforcement. The Workday case may have moved since the last status found. *Assurance, not a guarantee. Aligning to ISO/IEC 17065. Not currently accredited. CimAssure is not a certification, audit or attestation.* ## Sources 1. [Dentons, "Airline ordered to compensate a B.C. man because its chatbot provided inaccurate information"](https://www.dentonsdata.com/airline-ordered-to-compensate-a-b-c-man-because-its-chatbot-provided-inaccurate-information/). The tribunal's reasoning, quotations and award in Moffatt v. Air Canada, 2024 BCCRT 149. 2. [McCarthy Tétrault, "Moffatt v. Air Canada: misrepresentation by an AI chatbot"](https://www.mccarthy.ca/en/insights/blogs/techlex/moffatt-v-air-canada-misrepresentation-ai-chatbot). Legal basis (negligent misrepresentation) and Air Canada's separate-entity argument. 3. [Lerners, "It was my chatbot, not me"](https://lerners.ca/lernx/it-was-my-chatbot-not-me). The tribunal's statement on the separate-legal-entity argument. 4. [Seyfarth, Mobley v. Workday agent-theory ruling](https://seyfarth.com/news-insights/mobley-v-workday-court-holds-ai-service-providers-could-be-directly-liable-for-employment-discrimination-under-agent-theory.html). July 12, 2024 ruling, N.D. Cal. 5. [Civil Rights Litigation Clearinghouse, Mobley v. Workday](https://clearinghouse.net/case/44074/). Case status through December 17, 2025. 6. [OpenAI, Business Terms](https://openai.com/policies/business-terms/). Data use, indemnification and liability cap. 7. [OpenAI, Service Terms](https://openai.com/policies/service-terms/). Output IP indemnity and its conditions. 8. [OpenAI, Enterprise privacy](https://openai.com/enterprise-privacy/). Training default, retention and zero data retention. 9. [Microsoft, Customer Copyright Commitment](https://learn.microsoft.com/en-us/legal/cognitive-services/openai/customer-copyright-commitment). Required mitigations. 10. [Microsoft, Microsoft 365 Copilot privacy](https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy). Training statement. 11. [Google Cloud, generative AI indemnified services](https://cloud.google.com/terms/generative-ai-indemnified-services). List of covered services, last modified July 20, 2026. 12. [Google, Generative AI in Google Workspace privacy hub](https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub). Training statement and exclusions. 13. [Jonathan Lea Network, "Liability caps in technology contracts"](https://www.jonathanlea.net/blog/liability-caps-technology-contracts/). Stephanie Williams, June 23, 2026. 14. [Chen, Zaharia and Zou, "How is ChatGPT's behavior changing over time?"](https://arxiv.org/abs/2307.09009). arXiv 2307.09009. 15. [EU AI Act, Article 2](https://artificialintelligenceact.eu/article/2/). Scope. 16. [EU AI Act, Article 3](https://artificialintelligenceact.eu/article/3/). Definitions of provider and deployer. 17. [EU AI Act, Article 26](https://artificialintelligenceact.eu/article/26/). Deployer obligations for high-risk systems. 18. [EU AI Act, Article 27](https://artificialintelligenceact.eu/article/27/). Fundamental rights impact assessment. 19. [EU AI Act, Article 50](https://artificialintelligenceact.eu/article/50/). Transparency for systems that interact with people. 20. [EU AI Act, Annex III](https://artificialintelligenceact.eu/annex/3/). High-risk areas. 21. [Cuatrecasas, "Digital Omnibus on AI has been published"](https://www.cuatrecasas.com/en/spain/intellectual-property/art/digital-omnibus-ai-has-been-published). Regulation (EU) 2026/1744, publication and entry into force, new dates, Article 4. 22. [Orrick, "EU AI Act update: Digital Omnibus finalizes 8 compliance changes"](https://www.orrick.com/en/Insights/2026/07/EU-AI-Act-Update-Digital-Omnibus-Finalizes-8-Compliance-Changes). July 2026. Cross-check of the new dates. 23. [Gibson Dunn, "EU AI Act omnibus agreement"](https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/). May 27, 2026, written before adoption. Cross-check that Article 50 timing was not deferred. 24. [Colorado SB 26-189, signed act](https://www.jacksonlewis.com/sites/default/files/2026-05/Colorado-2026a_189_signed-act.pdf). Copy hosted by Jackson Lewis. Definitions, duties, exemptions, enforcement. 25. [McDermott, "Colorado AI law in flux"](https://www.mcdermottlaw.com/insights/colorado-ai-law-in-flux-comprehensive-replacement-bill-signed-after-federal-court-blocks-predecessors-enforcement/). Signing, effective date, April 27, 2026 stipulated order. 26. [Buchalter, "Colorado rewrites its AI law"](https://www.buchalter.com/insights/colorado-rewrites-its-ai-law-what-employers-must-know-about-sb-26-189/). Differences from SB 24-205 and enforcement statements. 27. [Eckert Seamans, "Colorado repeals and replaces its landmark AI statute"](https://www.eckertseamans.com/legal-updates/colorado-repeals-and-replaces-its-landmark-ai-statute-what-businesses-need-to-know). Repeal, signing date, deployer duties. 28. [ISO, ISO/IEC 42001:2023](https://www.iso.org/standard/42001). Publication date and scope. 29. [ISOQAR, ISO 42001:2023 customer guidance](https://isoqar.com/wp-content/uploads/2025/09/ISOQAR-ISO-42001-2023-Customer-Guidance.pdf). How certification is scoped. 30. [Civil Resolution Tribunal of British Columbia, Moffatt v. Air Canada, 2024 BCCRT 149](https://decisions.civilresolutionbc.ca/crt/crtd/en/525448/1/document.do). The decision itself: February 14, 2024, Tribunal Member Christopher C. Rivers; the quoted passages; damages of $650.88 plus interest and fees, $812.02 in total. The text does not use the term "electronic agent." ## Where does your organization actually stand? Seventeen questions, about five minutes, no sign-up to see your result. [Take the free Scorecard](https://www.cimbiotic.ai/scorecard) [Book a 30-minute call](https://calendly.com/rbawcum?utm_source=website&utm_medium=blog&utm_campaign=general&utm_content=post-cta) Cimbiotic Independent AI assurance for professional and trade associations, and the wider non-profit sector. Humans Leading Change #### Cimbiotic - [CimAssure](https://www.cimbiotic.ai/cimassure) - [Framework & approach](https://www.cimbiotic.ai/framework) - [Pricing](https://www.cimbiotic.ai/pricing) - [About](https://www.cimbiotic.ai/about) - [Insights](https://www.cimbiotic.ai/insights) - [Questions we get](https://www.cimbiotic.ai/questions) #### Start - [Free Trust Readiness Scorecard](https://www.cimbiotic.ai/scorecard) - [Book a 30-minute call](https://calendly.com/rbawcum?utm_source=website&utm_medium=footer&utm_campaign=general&utm_content=footer) - [inquiries@cimbiotic.ai](mailto:inquiries@cimbiotic.ai) © 2026 Cimbiotic. Assurance, not a guarantee. Aligning to ISO/IEC 17065. Not currently accredited. [Privacy](https://www.cimbiotic.ai/privacy) Cookie settings ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Rick Bawcum", "url" : "https://www.cimbiotic.ai/insights/author/rick-bawcum" }, "dateModified" : "2026-10-29T20:21:32.899Z", "datePublished" : "2026-10-19T17:52:12.000Z", "headline" : "What an AI vendor contract can and cannot do for your association", "mainEntityOfPage" : { "@id" : "https://www.cimbiotic.ai/insights/what-an-ai-vendor-contract-can-and-cannot-do-for-your-association", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.cimbiotic.ai/hubfs/cimbiotic.svg" }, "name" : "Cimbiotic LLC" } } ```