Agentic AI enterprise software defensibility rests on customer data rights and audit records rather than model quality, in a market projected to reach $190 billion by 2030. The clause that decides whether an agentic AI company owns anything was written before generative AI existed. It sits in the definitions section of the standard customer agreement, it permits the vendor to use customer data to improve its products, and it is the entire legal basis for the proprietary learning loop that every pitch deck in this category describes as a moat. Enterprise counsel started reading it in 2026. Investor counsel largely has not.
The commercial setup is unambiguous. Spend across analytic platforms, customer relationship management, enterprise resource planning, knowledge management, supply chain management, and other application software is estimated at $65 billion in 2025 and about $190 billion in 2030, a compound annual rate of 23.9 percent. AI related venture deals accounted for 64.3 percent of all venture deal value in 2025 through the third quarter, against 12 percent in 2017. Median pre money valuation in enterprise SaaS moved from $40.0 million in 2024 to $56.5 million in 2025.
Adoption and outcomes have decoupled. Seventy eight percent of organizations used AI in at least one business function in 2024, up from 55 percent the year before. A 2025 study of enterprise deployments found roughly 95 percent of generative AI pilots produced no measurable revenue gain, and only 1 percent of surveyed leaders called their own organizations mature in deployment. That gap is where the returns are, and closing it is a legal exercise as much as a technical one.
Start with what a moat actually consists of now. Model access is purchasable, and a thin interface layer over a purchased model is reproducible in a quarter. What is not reproducible is the accumulated record of how a specific workflow actually runs: the inputs, the intermediate states, the decisions, the outcomes, and the corrections a human supervisor made. A vendor holding secured rights to that record improves its product in a way a better funded new entrant cannot match, because the entrant has no history. Strip the rights and the loop is a courtesy the customer may withdraw at renewal.
Contract review across AI vendor agreements published in 2026 found that a large majority claim data usage rights broader than service delivery requires. The operative words are almost never training. They are improve, enhance, develop, and build. Three questions decide enforceability. Does the agreement define training data or rely on general improvement language? Does the vendor own the patterns and inferences derived from customer data or only the raw records? Does a model change trigger notice to the customer? A right that survives only because nobody read it is a revocable asset.
The regulatory position tightened on both flanks. The Federal Trade Commission stated in February 2024 that a company cannot unilaterally revise privacy commitments to permit model training, an application of Section 5 of the Federal Trade Commission Act, 15 U.S.C. 45. On the copyright side, Thomson Reuters Enterprise Centre GmbH v. Ross Intelligence Inc. (D. Del. 2025) rejected a fair use defense under 17 U.S.C. 107 for copyrighted editorial material used as training input, the first federal ruling to reach that question directly.
Then there is the question of who answers when the agent acts. Under most enterprise agreements in force today the customer does. Suppliers deliver the service on an as is basis, disclaim fitness for purpose, and confine indemnity to narrowly drafted third party intellectual property claims written for a product whose output a human reviewed before use. An agent that miscodes a ledger entry, issues a refund outside policy, or grants a permission it should have escalated has taken an action with legal consequence, and the standard indemnity does not reach it.
Two dates now sit on every roadmap. Article 50 of Regulation (EU) 2024/1689 applies from August 2, 2026 and requires disclosure that a user is interacting with a machine, machine readable marking of AI generated content, and labeling of synthetic media. Directive (EU) 2024/2853 must be implemented by member states by December 9, 2026 and treats software and AI systems as products, permitting strict liability where a system is defective. Any vendor selling a customer facing agent into a European enterprise is inside both.
Securities exposure is closer to home and applies to private companies. The Securities and Exchange Commission settled charges in January 2025 against a Nasdaq listed restaurant technology company that described a voice ordering product as artificial intelligence while a third party ran the speech recognition and human agents corrected the transcription. The theory was ordinary anti fraud liability under Section 10(b) of the Securities Exchange Act of 1934, 15 U.S.C. 78j(b). Section 17(a) of the Securities Act of 1933, 15 U.S.C. 77q(a), reaches the same misstatement in a private placement under Rule 506 of Regulation D, 17 C.F.R. 230.506, and the Form D filed under 17 C.F.R. 239.500 fixes the date of the offer.
Pricing changes the accounting, and the accounting changes what reported revenue means. Under Accounting Standards Codification Topic 606 the judgment is whether the vendor promises continuous access to the agent, recognized over time, or a quantity of successful outcomes, recognized as they occur. A vendor charging per resolution or per reconciled transaction carries revenue that moves directly with agent performance, so a model regression that raises human intervention shows up in the current period rather than at renewal eighteen months later. Recurring revenue from that vendor is not comparable to seat based recurring revenue, and treating the two alike overstates predictability.
So the diligence request set is short and specific. Percentage of workflow steps executed without human approval, with documented override thresholds. Human intervention rate and its trend across the last several model releases. Evaluation coverage against real workloads, not synthetic prompts. Lineage documentation identifying which data, model, retrieved passage, and policy applied to a given action. A live demonstration of rollback where the agent writes to a system of record. And the signed contract language that secures the data rights everything else depends on.
What remains unsettled is worth naming. No United States appellate court has decided whether an autonomous agent’s action is attributable to the deploying enterprise, to the vendor, or to neither, which leaves allocation entirely to contract terms most parties have not negotiated. Whether the roughly $190 billion 2030 estimate materializes depends on net new spend for agent completed work rather than reallocation of existing seat budgets. And if enterprise counsel systematically strikes broad improvement rights across 2026 and 2027 renewals, the proprietary data loop supporting current valuations erodes on a two year cycle rather than compounding.
Interested in analysis about the intersection of venture capital, tech, policy and the law? Check out my Substack channel. https://theinnovationattorney.substack.com/
