Growth-stage companies are sitting on an AI governance gap that regulators, enterprise customers, and investors are no longer willing to overlook, and Baker Donelson attorneys Emily Strack and Chris Sloan make the case for building a compliance framework now rather than retrofitting it after a Series B. Their argument, laid out in this Bloomberg Law analysis<\/a>, covers three pressure points: data and AI governance mapping, intellectual property risk from AI-generated code and training data provenance, and liability exposure in vendor contracts that were written for SaaS, not generative AI.<\/p>\n The companies most exposed here are not necessarily the smallest ones. Any growth-stage vendor pitching into regulated enterprise buyers, whether in health, finance, or HR, is already being evaluated on AI governance posture during procurement diligence. If your organization buys from those vendors, the governance gap in your supply chain becomes your audit finding. The question is not whether your AI vendors have a compliance program; it’s whether their program survives the specific questions your legal and procurement teams should already be asking.<\/p>\n The IP argument is sharper than it first appears. US copyright law requires human authorship, and code produced primarily by AI tools, which is increasingly the default in “vibe coding” environments where developers prompt their way to working software, may not qualify for copyright protection at all. That matters the moment an acquirer or enterprise customer runs IP due diligence. Startups that cannot demonstrate documented human creative contribution to their core codebase are carrying an unpriced liability, and the enterprises buying from or partnering with them inherit a version of that risk through indemnification gaps in standard SaaS agreements.<\/p>\n Vendor contracts written for SaaS are genuinely underbuilt for AI exposure. Standard SaaS agreements rarely address model training opt-outs, sublicensing of proprietary data ingested by third-party AI platforms, or explainability obligations tied to autonomous decisions. The practical implication for enterprise buyers is that AI-specific representations, warranties, and indemnities need to be negotiated as standard terms, not exceptions. The CISO or general counsel who treats AI vendor contracts as routine SaaS renewals is leaving liability allocation to chance, and the counterparty’s boilerplate is not written in your favor.<\/p>\n Written by lawyers who advise growth-stage companies, this piece naturally tilts toward framing compliance as achievable and low-cost, which softens how hard it actually is to retrofit governance mid-scale. The harder truth for enterprise buyers is that the vendors you’re already live with are the ones most likely to have skipped this. A targeted review of your highest-data-exposure AI vendors, focused specifically on training data rights and contract indemnification, is the decision this reframes, not a future procurement policy update.<\/p>\nWhat this means for your business<\/h2>\n