What to Check Before You Accept a SaaS Vendor's Default AI-Training Data Terms

Atlassian's new default AI-training data policy — full opt-out available only on its Enterprise tier, everyone else locked into metadata collection — is drawing real criticism as "privacy-by-paywall." Whatever you think of Atlassian specifically, the underlying pattern is now common across SaaS broadly: vendors defaulting customer data into AI training pipelines, with opt-out mechanisms that vary widely in how genuinely accessible they are. Every organization running SaaS tools that touch sensitive or regulated data needs an actual checklist for this, not a one-time reaction to whichever vendor makes headlines this month.

Why 'Can We Opt Out' Isn't the Only Question

The Atlassian case is instructive precisely because opt-out exists — just not for every tier. A vendor with a technically-available opt-out that's gated behind a pricing tier your organization can't justify, or buried in a settings page most admins never find, offers weaker real protection than the existence of an opt-out option suggests on paper. The actual question is whether your organization can realistically exercise the control, not whether the control technically exists somewhere in the product.

The Actual Vendor Checklist

• Confirm which of your specific pricing tiers has full opt-out access, not just whether the vendor offers opt-out at some tier — check this against your actual contract, not the vendor's general marketing page
• Read the Data Processing Addendum specifically for AI training data language — Atlassian's case shows this can be a real gap even when a public policy page describes the practice, and a DPA silence on AI training isn't the same as a DPA that explicitly excludes it
• Ask what happens to already-collected data and already-trained model behavior after you opt out — Atlassian's disclosed 30-day data removal and 90-day model retraining windows mean opting out isn't instantaneous, a detail worth knowing before you assume a switch flip is immediate
• Check data retention periods specifically for AI training purposes, which can differ from general data retention terms elsewhere in the same contract
• For any tool touching regulated data (healthcare, financial, legal), confirm your compliance team has specifically reviewed the AI-training terms, not just the general data processing terms signed at initial contract time — these policies are changing after the fact, sometimes without a fresh compliance sign-off being solicited

Why This Requires an Ongoing Process, Not a One-Time Review

SaaS vendors are rolling out or updating AI-training data policies on an ongoing basis, often well after your organization's original contract review — Atlassian's change took effect for existing customers, not just new signups. A vendor-terms review that only happens at initial procurement misses these mid-contract policy changes entirely. Building a standing practice of monitoring policy update notifications from your SaaS vendors specifically for AI-training language changes is a real, ongoing governance function now, not a one-time box to check during onboarding.

The Broader Point About Default Settings

The pattern across Atlassian and most other vendors making this shift is defaulting customers IN to data collection, requiring an active opt-out rather than an active opt-in. That default direction matters enormously for how much data actually gets collected in practice, since most organizations never revisit default settings once a tool is deployed. Treating "review AI-training defaults" as a standard step whenever any SaaS tool is newly deployed or meaningfully updated — not just at initial signup — closes a gap that a purely reactive, headline-driven approach to vendor privacy terms will otherwise leave open indefinitely.