In today’s hyper-evolving digital landscape, software (and now AI) powers virtually every business. Since the original 2023 version of this primer, cloud models have become the delivery backbone for the AI revolution. GPU clusters on AWS/Azure (IaaS), model-training platforms like Vertex AI or SageMaker (PaaS), end-user tools like ChatGPT, Claude, or GitHub Copilot (SaaS), and dedicated AI inference APIs (the new AIaaS layer) dominate the market.
Yet the legal stakes have skyrocketed: EU AI Act prohibitions already apply (Feb 2025), high-risk rules hit in August 2026, the EU Data Act’s cloud-switching rights are live since September 2025, and the US patchwork of state AI laws (Colorado AI Act effective 2026, California transparency rules, etc.) plus a federal push for light-touch innovation (Trump Executive Order of December 2025) means every contract now needs AI-specific guardrails.
This updated primer keeps the original accessible structure—quick overviews for busy readers, pros/cons for decision-makers, and detailed contract provisions for legal teams—while adding AI overlays everywhere and a brand-new AIaaS section. Whether you’re a founder, in-house counsel, procurement lead, or IT pro, you’ll walk away knowing which model fits your risk profile in 2026.
Quick Overviews (2‑minute version)
Traditional software
License purchased once (or with maintenance), installed on your hardware. You control everything; provider has minimal ongoing obligations.
Software as a Service (SaaS)
Hosted web/app access on subscription. Provider runs the entire stack. Now the default delivery vehicle for AI-powered tools (Salesforce Einstein, Microsoft Copilot, Notion AI).
Platform as a Service (PaaS)
Provider supplies OS, databases, dev tools. You build and deploy your own apps. AI twist: full AI development platforms (Google Vertex AI, Azure ML, AWS SageMaker).
Infrastructure as a Service (IaaS)
Raw compute, storage, networking (VMs, GPUs). You manage OS and above. AI supercharged it—spot instances for training runs, dedicated GPU clusters.
Open Source
Free code you can modify/distribute. Massive AI impact: Llama 3, Mistral, Stable Diffusion—all open weights changing the game.
Freemium
Free tier + paid upgrades. Ubiquitous in AI (ChatGPT free → Plus/Team/Enterprise; Midjourney free trials → subscriptions).
NEW — AI as a Service (AIaaS) / Generative AI Services
Hosted access to pre-trained models via API or web UI. Provider handles training/inference; you pay per token/call. Examples: OpenAI API, Anthropic Claude API, Google Gemini API, Grok API, Hugging Face Inference Endpoints. Often layered on top of the models above.
Advantages & Disadvantages at a Glance (5‑minute version)
| Model | Developer Pros | Developer Cons | Customer Pros | Customer Cons |
| Traditional | Full control, high margins | Distribution & support burden | Offline use, data control | Maintenance, upgrade costs |
| SaaS | Recurring revenue, auto-updates | Multi-tenancy security | Zero infra, instant access | Data privacy, lock-in, rising costs |
| PaaS | Focus on code, not servers | Platform limitations | Fast dev, scalability | Vendor feature constraints |
| IaaS | Total customization | Heavy ops burden | Pay-for-what-you-use | Requires expertise, cost surprises |
| Open Source | Community contributions, free base | Support/revenue model hard | Free, fully customizable | No SLA, security patching on you |
| Freemium | Viral growth, upsell funnel | Free users drain resources | Low barrier to entry | Feature gating, ads, data harvesting |
| AIaaS | Massive scale, usage-based revenue | Model drift, regulatory risk | Zero training cost, instant intelligence | Black-box, hallucination liability, token pricing volatility |
AI Overlay note across all models
If your offering (or use-case) involves generative AI, add: acceptable-use policies for prompts, data-usage rights (can the provider train on your inputs?), output-ownership clauses, and indemnities for IP infringement or biased/hallucinated outputs. The EU Data Act now mandates easy switching and zero egress fees after Jan 2027 for all cloud/AI services.
Detailed Breakdowns with Key Contract Provisions (5‑minute deeper dive)
1. Traditional Software Model
Unchanged core, but fewer new AI deployments use pure on-prem licenses (except highly regulated sectors like defense or finance).
Typical EULA provisions (unchanged): grant of license, IP retention by provider, restrictions, limited warranty, termination.
2026 AI note: If the software includes embedded AI (e.g., local LLM inference), add model-version pinning, bias-testing requirements, and human-oversight clauses to survive EU AI Act high-risk classification.
2. Software as a Service (SaaS)
Still the king for end-user tools.
Typical SaaS Agreement additions in 2026:
- Service Level Agreement (SLA): 99.9% uptime + AI-specific latency SLAs for inference.
- Data ownership & usage: You own your inputs/outputs; provider gets limited license only if you opt in to model improvement (many now default “no training on customer data”).
- AI addendum: Acceptable Use Policy (no illegal prompts), indemnity for provider IP claims on outputs, hallucination disclaimer.
- EU Data Act clause: Mandatory 30-day switching assistance + data export in structured format.
- Termination & portability: No lock-in penalties; data return within 30 days.
Examples: Salesforce Einstein, Slack AI, Dropbox with AI search.
3. Platform as a Service (PaaS)
The go-to for building custom apps.
Typical PaaS Agreement:
- License to platform tools.
- SLA for underlying infra.
- Customer owns apps/data; provider owns platform.
- AI-specific: Model deployment rights, monitoring/logging obligations (required for EU AI Act transparency), rate limits on GPU usage.
Examples: Heroku + AI extensions, Vercel AI SDK, full MLaaS platforms.
4. Infrastructure as a Service (IaaS)
The raw horsepower behind the AI boom (training runs eat entire data centers).
Typical IaaS Agreement:
- Usage-based billing (now with spot/preemptible GPU pricing).
- Customer controls OS/apps/data.
- 2026 AI additions: Dedicated GPU reservation SLAs, energy-consumption reporting (EU sustainability rules), security for model weights.
Examples: AWS EC2 GPU instances, Azure Virtual Machines, Google Compute Engine.
5. Open Source Software
Exploded with AI. Meta’s Llama series, Mistral, EleutherAI models are fully open or open-weights.
Key licenses (GPL, Apache 2.0, MIT):
- Copyleft vs. permissive.
- No warranties.
- 2026 reality: Many “open” AI models still restrict commercial use or add acceptable-use clauses (Llama 3 license). Community patches for safety now critical.
6. Freemium Software
Dominates consumer AI (ChatGPT, Perplexity, Midjourney).
Typical Freemium Agreement:
- Tiered limits (queries/tokens per month).
- Upsell paths.
- Data usage for training often opt-out now required in EU.
7. NEW: AI as a Service (AIaaS) / Generative AI Services
Hosted pre-trained models via API/web. You don’t train; you prompt/infer.
How it works: Provider manages massive GPU clusters and model weights. You pay per 1k tokens or per image.
Typical AIaaS Agreement (2026-specific addendum on top of SaaS):
- Grant of access: Non-exclusive, revocable right to use model via API.
- Data rights: Explicit “no training on customer prompts” (OpenAI, Anthropic default in 2026) + option to opt in for fine-tuning credits.
- Output ownership: You own outputs; provider gets license to use for service improvement (unless enterprise plan).
- Risk allocation:
— Hallucination / inaccuracy disclaimer + limited indemnity.
— Bias/discrimination indemnity (critical for high-risk uses).
— Compliance warranty: provider certifies adherence to applicable AI Act obligations.
- Transparency: Model cards, training-data summaries (EU AI Act Art. 50+).
- Usage limits and pricing: Dynamic token pricing, rate limits, abuse monitoring.
- Termination and Data Act: Full data portability (prompt history, fine-tunes) within 30 days; no switching fees after Jan 2027.
- Insurance and audit: Provider carries cyber + professional liability; customer audit rights on compliance.
Pros for developers: Infinite scale, predictable usage revenue.
Cons: Systemic-risk obligations under EU AI Act for models >10²⁵ FLOPs, massive compliance cost.
Pros for customers: Instant superpower, no infra.
Cons: Vendor lock-in (fine-tunes), output liability, token-cost volatility.
Examples (2026): OpenAI API, Anthropic Claude 3.5 API, Google Gemini 2.0 API, xAI Grok API, Cohere, Mistral AI platform, AWS Bedrock, Azure OpenAI Service.
Regulatory Horizon 2026 – What You Must Know
- EU AI Act (in force since Aug 2024): Prohibitions live, GPAI transparency Aug 2025, high-risk systems full obligations August 2026 (risk management, technical docs, CE marking, human oversight). Fines up to €35M or 7% global turnover.
- EU Data Act (core since Sep 2025): Cloud/AIaaS providers must enable switching in ≤30 days, provide interoperability, zero egress fees from Jan 2027. Mandatory standard contractual clauses available.
- US landscape: No federal AI law yet; Trump EO (Dec 2025) directs preemption of “burdensome” state rules. Colorado AI Act (risk assessments for high-risk AI) and California/CPRA expansions remain in force. Expect more state movement in 2026–27.
- Global tip: If you operate in EU, classify your system early (prohibited / high-risk / GPAI / minimal). Build DPIA + conformity assessment into every AI contract.
Conclusion
The “right” software model in 2026 is no longer just about cost or control — it’s about risk appetite, regulatory exposure, and AI strategy. Traditional and pure open-source still have roles, but most serious deployments now sit on SaaS/PaaS/IaaS with heavy AIaaS layering. Whichever you choose, bake in:
- Clear data & IP ownership
- Hallucination / bias disclaimers & indemnities
- EU Data Act switching rights
- AI Act compliance warranties
…or risk expensive surprises when the next regulation wave hits.
Need help drafting an AIaaS addendum, reviewing your current vendor agreements, or classifying your system under the AI Act? Drop us a line at info@lexquill.com — we live and breathe this stuff.
* * *
This article is for general informational and educational purposes only and provides a high-level overview of risks, considerations, and practical questions related to software delivery models (SaaS, PaaS, IaaS, AIaaS), cloud computing services, and AI technologies. It does not constitute legal, financial, regulatory, or professional advice of any kind.
Rules, regulations, and best practices in SaaS, PaaS, IaaS, AIaaS contracts, data protection, AI governance, and related areas vary by jurisdiction, evolve rapidly, and depend on specific circumstances like industry sector, company size, data usage patterns, risk classifications under the EU AI Act, economic conditions, vendor relationships, and applicable laws or treaties. What may be effective in one scenario could introduce risks in another.
The content is generic and not tailored to your situation; do not rely on it as a substitute for advice from qualified professionals such as lawyers, technology counsel, data privacy experts, or regulatory experts. Note that the list of issues discussed is not exhaustive.
No professional relationship forms from reading this or subsequent communications unless a formal engagement agreement is executed.
The authors and affiliates disclaim all liability for any loss, damage, or consequences arising from use or reliance on this information.
For discussion of your software model, cloud, or AI-related plans or concerns, reach out via our contact form or info@lexquill.com—we are happy to assist.