Enterprise Terms of Service and DPA
On this page
The legal framework for Enterprise
Before an AI model enters production in your environment, your legal team will want to know exactly what xAI is committing to. Approach this requirement with the right documents in hand. The Enterprise offer comes with specific contractual texts, available at x.ai/legal, that govern the relationship between your organization and xAI. Two of them structure the discussion: the Enterprise Terms of Service and the Data Processing Agreement.
What the Enterprise Terms of Service say
The Enterprise Terms of Service differ from the standard terms on points that correspond to questions someone will ask you sooner or later.
Data ownership is what worries business leaders. Your prompts and the model’s responses remain your property: xAI claims no intellectual property rights over generated content, and data transmitted to the API is not used to train models under the Enterprise plan. Have Grok analyze client contracts, and the content of those contracts will not feed any future learning.
Liability matters more to your finance team. The 99.9% SLA is contractually guaranteed, with penalties provided for non-compliance; this is not just a marketing promise. xAI’s liability is however capped by limits defined in the contract, which are negotiable based on commitment volume. In other words, the amount you can expect to recover in the event of a major incident depends on what you discussed before signing, never after.
Term and termination conditions finally determine your operational flexibility. The minimum commitment is 30 days for provisioned throughput, early termination conditions are defined contractually, and notice is generally required for capacity changes. If you are expecting a seasonal spike, plan the adjustment several weeks in advance: no one switches capacity on the same day.
The DPA, cornerstone of GDPR compliance
The Data Processing Agreement defines xAI’s obligations as a personal data processor. This is the document your DPO will read line by line and the one an auditor will request first. It first specifies the purposes of processing, limiting data use to providing the requested API service, then the categories of personal data you are likely to transmit—an HR service and an e-commerce platform obviously do not check the same boxes. Next come the technical and organizational measures implemented by xAI to protect this data.
The second half of the document concerns the processing chain. The DPA lists the subsequent subprocessors xAI may call upon, details the guarantees applicable to data transfers outside the European Union, and describes the procedures for responding to data subject rights requests. This last section is not theoretical: the day an employee requests deletion of data concerning them, this is what will tell you which procedure to trigger and within what timeframe.
For a European company, four sections call for particularly careful reading. Article 28 of the GDPR states that xAI acts on documented instructions, which assumes your internal documentation describes what you are having processed instead of just referring to the contract. Data residency can be requested to keep processing within a given geographic region, which radically changes the conversation with a national regulator. Breach notification commits xAI to report incidents within the deadlines provided by the GDPR, deadlines that your own internal procedure must be able to absorb without improvising. Audit rights, finally, authorize you to audit xAI’s practices or mandate a third party to do so; provided you have designated, on your end, who would exercise this right the day the question arises.
What is negotiable
This is the most misunderstood difference between the two regimes. Standard terms are accepted with a click and are not discussed; Enterprise terms, however, are negotiable. Your legal team can request adaptations on liability caps, confidentiality clauses, termination conditions, guarantees specific to your sector—healthcare, finance, defense—and exclusivity or non-compete clauses. A healthcare institution is therefore not forced to align with a generic text, provided you use this discussion space before signing and not after.
A few best practices make this review much faster. Have your DPO examine the DPA before any signing, never after account activation. Check the list of subsequent subprocessors as well as their location, as this is often where the gap with your internal policy lies. Ensure that international transfer clauses comply with this same policy. And compare the technical measures announced by xAI with your own requirements: this mapping table is built painlessly during negotiation, much less so a year later in front of an auditor.
Key takeaways
- Enterprise ToS and DPA are available at x.ai/legal
- Your data remains your property and is not used for model training
- The DPA covers xAI’s GDPR obligations as a processor
- Enterprise terms are negotiable, unlike standard terms
- Involve your DPO and legal team before any signing