A city rejects an AI vendor whose default terms train foundation models on customer prompts and outputs. What vendor-term evaluation is this?

Evaluating and rejecting vendor data-use terms that train on municipal prompts by default is the right response when a city’s vendor agreement permits foundation-model training on customer prompts and outputs. Municipal prompts may contain sensitive deliberations, resident information, or nonpublic drafts, so default training creates secondary-use and disclosure risks beyond the city’s intended purpose. Reviewing and challenging the terms keeps the city’s data-use posture under its control; contract defaults can govern actual practice unless buyers address them. Accepting default training-on-customer-data clauses to get a discount fails because a lower price does not remove confidentiality or secondary-use exposure. Treating municipal prompts as permissible training data whenever they come through a public-sector account fails because public-sector status does not make prompts free training data, particularly when they contain personal or nonpublic information. Ignoring contract language because the marketing site claims privacy fails because marketing claims do not replace the binding data-use terms. Exam caveat: the key governance action is rejecting or renegotiating the default; confirm any agreed restriction is documented in the contract. Practical check: review the data-use and training clauses before award, require city prompts and outputs to be excluded from training in writing, verify that product settings match the contract, and escalate default training terms to legal and the AI office.