This document is NOT a complete MSA. It is a skeleton identifying the key sections and clauses needed, with notes for the drafting lawyer. The purpose is to accelerate the legal drafting process by clearly defining the business requirements and regulatory context (GDPR + EU AI Act). Each section contains instructions and context for the lawyer.
Table of Contents
- Definitions
- Scope of Services (Variant A / Variant B)
- Client Obligations (AI Act Article 26 -- Deployer Obligations)
- Permitted Use and Restrictions
- High-Risk Use-Case Notification
- Data Protection
- Intellectual Property
- Confidentiality
- Liability and Indemnification
- Term and Termination
- General Provisions
- Governing Law and Jurisdiction
- Annexes
Parties
Easylab AI SARL, a limited liability company (société à responsabilité limitée) incorporated under the laws of the Grand Duchy of Luxembourg, registered with the RCS Luxembourg under number B276290, having its registered office at 55, allée de la Poudrerie, L-1899 Roeser, Luxembourg (hereinafter the "Provider")
and
[Client Legal Name], a company incorporated under the laws of [jurisdiction], registered under number [registration number], having its registered office at [address] (hereinafter the "Client")
(each a "Party" and together the "Parties")
Agreement Variants
This MSA template supports two commercial models. Select the applicable variant:
Variant A: Services / Consultancy
Custom AI development projects, consulting engagements, deployment of EasyClaw/custom AI agents, bespoke integrations. Typically project-based with defined deliverables and milestones.
Typical products: EasyClaw deployments, custom AI solutions, consulting, training.
Variant B: Platform / SaaS
Subscription-based access to Easylab AI platforms. Recurring fees, standard terms of service, self-service onboarding. Multi-tenant or per-organization instances.
Typical products: Linkeme, EasyBlood, EasyBoard, LinkedInScope, EasyFund.
Consider whether a single MSA with variant-specific schedules is preferable, or two separate agreements. The variant approach is simpler to maintain but may create ambiguity. A single MSA with modular Order Forms / Statements of Work is the recommended approach.
Section 1: Definitions
Key Terms to Define
| "Agreement" | This MSA together with all Annexes, Order Forms, and Statements of Work. |
| "AI System" | Any artificial intelligence system, including large language models, machine learning models, autonomous agents, and related components provided by the Provider under this Agreement. [LAWYER: Align with EU AI Act Art. 3(1) definition] |
| "Deployer" | As defined in Article 3(4) of the EU AI Act (Regulation 2024/1689): a natural or legal person that deploys an AI system under its authority. [LAWYER: The Client is the "deployer" when using Easylab AI systems in its own operations] |
| "High-Risk AI System" | An AI system falling within the scope of Annex III of the EU AI Act. |
| "Provider" | Easylab AI SARL, acting as the "provider" of AI systems within the meaning of Article 3(3) of the EU AI Act. |
| "Services" | [Variant A: consulting, development, deployment services] / [Variant B: SaaS platform access and related support] |
| "Platform" | (Variant B) The specific Easylab AI SaaS product(s) identified in the applicable Order Form. |
| "Order Form" | A document executed by both Parties specifying the Services, fees, and any service-specific terms. |
| "Personal Data" | As defined in Article 4(1) of the GDPR. |
| "Confidential Information" | [LAWYER: Define scope and exclusions] |
The AI Act definitions are critical. Easylab AI is the "provider" (it develops and places on the market AI systems). The Client is the "deployer" (it uses those systems in its professional activities). This distinction drives the allocation of obligations throughout the agreement.
Section 2: Scope of Services
Variant A: Services / Consultancy
2.1. The Provider shall perform the services described in the applicable Statement of Work ("SOW"), which shall be agreed and signed by both Parties before work commences.
2.2. Each SOW shall specify: (a) scope and deliverables; (b) timeline and milestones; (c) acceptance criteria; (d) fees and payment schedule; (e) any AI systems to be deployed and their intended use.
2.3. Changes to a SOW require written agreement of both Parties (change order process).
Variant B: Platform / SaaS
2.1. The Provider grants the Client a non-exclusive, non-transferable right to access and use the Platform identified in the applicable Order Form during the subscription term.
2.2. The Provider shall maintain the Platform in accordance with the service levels specified in [Annex: SLA -- LAWYER: define SLA terms].
2.3. The Provider may update the Platform from time to time. Material changes affecting functionality or data processing shall be notified to the Client with [LAWYER: notice period, e.g., 30 days] advance notice.
For Variant B, consider whether an Acceptable Use Policy (AUP) should be a separate document or incorporated here. The AUP is especially important for AI-powered platforms to define prohibited uses.
Section 3: Client Obligations -- AI Act Deployer Responsibilities
This is the key section addressing Kramer Finding #7. Article 26 of the EU AI Act imposes specific obligations on "deployers" of AI systems. Since Easylab's clients deploy our AI systems in their operations, these obligations must be contractually allocated. The purpose is not to shift all risk to the client, but to ensure they understand and fulfill their legal duties as deployers.
3.1. Appropriate Use
The Client shall use the AI Systems in accordance with the instructions for use provided by the Provider, including any technical documentation, user guides, and limitations communicated by the Provider.
3.2. Review of AI System Designs
Before deploying any AI System in a production environment, the Client shall review the system's intended purpose, capabilities, and limitations as described in the Provider's documentation. The Client acknowledges that AI Systems may produce inaccurate, incomplete, or biased outputs and shall implement appropriate verification procedures.
3.3. Human Oversight (Art. 26(2))
The Client shall ensure that natural persons assigned to oversee the AI Systems have the necessary competence, training, and authority, and that such persons are supported by adequate resources. The Client shall not use AI System outputs as the sole basis for decisions that produce legal effects or similarly significant effects on natural persons without meaningful human review.
This is especially relevant for LinkedInScope (recruitment decisions), EasyBlood (health assessments), and any future high-risk deployments. The level of human oversight required should be proportionate to the risk.
3.4. Monitoring of AI Outputs
The Client shall monitor the operation and outputs of the AI Systems in production. If the Client identifies or reasonably suspects a serious incident, malfunction, or risk to health, safety, or fundamental rights, the Client shall: (a) immediately suspend use of the AI System; (b) notify the Provider without undue delay; and (c) cooperate with the Provider in investigating the incident.
3.5. Transparency to End Users (Art. 50)
The Client shall inform individuals interacting with the AI Systems that they are interacting with an AI system, unless this is obvious from the circumstances. Where the AI System generates or manipulates text, audio, image, or video content, the Client shall disclose that the content is AI-generated.
Article 50 transparency requirements apply to all AI systems, not only high-risk ones. This includes: EasyBoard (AI-generated minutes must be disclosed as AI-generated), EasyBlood (AI-generated health analysis), LinkedInScope (AI-generated profile assessments).
3.6. Data Governance
The Client is responsible for the quality, lawfulness, and relevance of the input data provided to the AI Systems. The Client shall ensure that all personal data provided to the AI Systems is collected and processed in compliance with applicable data protection laws, including the GDPR.
3.7. Record Keeping (Art. 26(5))
The Client shall retain the logs automatically generated by the AI Systems for a period of [LAWYER: minimum period -- AI Act suggests at least 6 months for high-risk, consider a standard period for all systems], to the extent such logs are under the Client's control.
3.8. Fundamental Rights Impact Assessment (Art. 27)
Where the Client is a body governed by public law, or a private entity providing public services, and the AI System is a high-risk system listed in Annex III, the Client shall perform a fundamental rights impact assessment before putting the system into use.
Article 27 applies to specific deployer categories. Include this clause even if most current clients are private companies -- it provides future coverage and demonstrates awareness.
Section 4: Permitted Use and Restrictions
4.1. Permitted Use
The Client may use the AI Systems solely for the purposes specified in the applicable Order Form or SOW, and in compliance with this Agreement, applicable law, and the Provider's documentation.
4.2. Absolute Prohibitions (AI Act Art. 5)
The Client shall not, under any circumstances, use the AI Systems for:
- (a) Subliminal, manipulative, or deceptive techniques that distort behavior and cause significant harm;
- (b) Exploitation of vulnerabilities related to age, disability, or social/economic situation;
- (c) Social scoring -- evaluating or classifying individuals based on social behavior or personal characteristics leading to detrimental or disproportionate treatment;
- (d) Real-time remote biometric identification in publicly accessible spaces for law enforcement;
- (e) Emotion recognition in the workplace or educational institutions (except for medical or safety reasons);
- (f) Untargeted scraping of facial images from the internet or CCTV footage to build facial recognition databases;
- (g) Any other use prohibited under Article 5 of the EU AI Act.
4.3. Restricted Use -- High-Risk Deployment
The Client shall not deploy the AI Systems in any Annex III high-risk context (as defined in Section 5 below) without prior written notification to the Provider as set forth in Section 5.
4.4. Consequences of Breach
[LAWYER: Define consequences for breach of Sections 4.2 and 4.3. Consider: (a) immediate termination right; (b) indemnification by Client; (c) Provider's right to suspend access. The prohibited use clause (4.2) should carry the strongest consequences -- material breach with no cure period.]
The AI Act prohibited practices (Art. 5) carry severe penalties -- up to EUR 35 million or 7% of worldwide annual turnover. The MSA must make absolutely clear that the Client bears full responsibility for any prohibited use. Consider requiring the Client to represent and warrant compliance at each Order Form.
Section 5: High-Risk Use-Case Notification
5.1. Notification Obligation
The Client shall notify the Provider in writing at least [LAWYER: e.g., 30 days] before deploying any AI System in a context that falls within, or may reasonably fall within, the scope of Annex III of the EU AI Act, including but not limited to:
- (a) Recruitment and HR management: Screening, filtering, or evaluating candidates; making decisions on hiring, promotion, termination, or task allocation;
- (b) Credit scoring and financial assessments: Evaluating creditworthiness or establishing credit scores;
- (c) Law enforcement: Risk assessments, polygraph or similar tools, evaluation of evidence;
- (d) Education and vocational training: Determining access to educational institutions, assessing students, monitoring behavior during tests;
- (e) Critical infrastructure: Safety components in management and operation of digital infrastructure, road traffic, water/gas/heating/electricity supply;
- (f) Healthcare: AI intended to be used as a medical device or as a safety component of a medical device;
- (g) Migration, asylum, and border control: Risk assessments, document authenticity verification;
- (h) Administration of justice and democratic processes: Assisting judicial authorities in researching and interpreting facts and law.
5.2. Provider's Rights Upon Notification
Upon receiving a high-risk deployment notification, the Provider may, at its sole discretion:
- (a) Approve the deployment subject to additional technical safeguards and documentation;
- (b) Require a joint risk assessment and/or DPIA before deployment proceeds;
- (c) Require modifications to the deployment plan to reduce risk;
- (d) Decline the deployment if, in the Provider's reasonable judgment, the risk cannot be adequately mitigated.
The Client shall not proceed with a high-risk deployment until it has received written approval from the Provider.
5.3. Additional High-Risk Requirements
For any deployment approved under Section 5.2(a), the Client shall additionally:
- (a) Appoint a designated person responsible for AI oversight within its organization;
- (b) Implement the human oversight measures specified by the Provider;
- (c) Maintain logs for the period specified in Section 3.7;
- (d) Report serious incidents to the Provider and, where required by law, to the relevant market surveillance authority;
- (e) Conduct a fundamental rights impact assessment where required under Article 27.
The notification mechanism is a key safeguard. Without it, a client could take an Easylab general-purpose AI tool (like EasyClaw) and deploy it in a high-risk context (like recruitment screening) without Easylab's knowledge. This would expose both parties to significant regulatory risk. The right to decline deployment (5.2(d)) is essential -- Easylab should not be forced to participate in high-risk deployments it cannot support.
Section 6: Data Protection
6.1. Roles
With respect to Personal Data processed in the context of the Services:
- (a) The Client acts as the Controller (or, where applicable, a Processor acting on behalf of its own controller);
- (b) The Provider acts as the Processor, processing Personal Data solely on behalf of and in accordance with the documented instructions of the Client.
In some cases (e.g., billing, account management), Easylab is the Controller for its own purposes. The DPA should distinguish between these processing activities. For the core service delivery, Easylab is the Processor.
6.2. Data Processing Agreement
The processing of Personal Data under this Agreement is governed by the Data Processing Agreement attached as Annex A, which forms an integral part of this Agreement. The DPA is executed pursuant to Article 28 of the GDPR.
Reference: The DPA structure follows the existing EasyBoard/EasyFund DPA format (Document EB-DPA-2026-001). Key articles: Subject Matter and Duration, Nature and Purpose, Types of Personal Data, Data Subject Categories, Processor Obligations, Sub-processing, Data Subject Rights, Security Measures, Breach Notification, Audit Rights, Data Deletion.
6.3. Sub-Processors
The current list of sub-processors is set forth in Annex C. The Provider shall notify the Client of any intended changes to sub-processors with at least [LAWYER: 30 days] prior notice, in accordance with the DPA.
6.4. International Data Transfers
Where Personal Data is transferred to sub-processors located outside the EEA (in particular: Anthropic LLC, USA; Resend Inc., USA), such transfers shall be subject to appropriate safeguards in accordance with Chapter V of the GDPR, including [LAWYER: Standard Contractual Clauses (SCCs), adequacy decisions, or other transfer mechanisms as applicable].
Transfers to the US remain a key compliance point post-Schrems II. The EU-US Data Privacy Framework (DPF) provides a basis for certified US companies. Verify whether Anthropic and Resend are DPF-certified. If not, SCCs + Transfer Impact Assessment (TIA) are needed. The TIA should be referenced as a separate document or annex.
Section 7: Intellectual Property
7.1. Provider IP
The Provider retains all intellectual property rights in the AI Systems, Platform, tools, methodologies, know-how, and pre-existing materials. Nothing in this Agreement transfers ownership of Provider IP to the Client.
Variant A: Services / Consultancy
7.2. Client Deliverables
[LAWYER: Define IP ownership for custom deliverables. Options: (a) Client owns custom deliverables, Provider retains underlying tools/models; (b) Provider owns all, Client gets license; (c) Joint ownership. Recommend option (a) as most commercially standard for consulting.]
Variant B: Platform / SaaS
7.2. Client Data and Outputs
The Client retains all rights in its input data and the outputs generated by the Platform from the Client's data. The Provider shall not use the Client's data or outputs for any purpose other than providing the Services, unless anonymized and aggregated for platform improvement purposes.
[LAWYER: Clarify whether AI-generated outputs (meeting minutes, health scores, profile analyses) are "owned" by the Client or licensed. Consider IP implications of AI-generated content under Luxembourg law.]
7.3. Feedback and Improvements
[LAWYER: Address whether the Provider can use anonymized/aggregated usage patterns and Client feedback to improve the AI Systems. Standard SaaS practice, but should be explicitly stated and limited.]
Section 8: Confidentiality
8.1. Obligations
Each Party shall keep confidential all Confidential Information received from the other Party and shall not disclose it to any third party except: (a) to employees, contractors, and advisors who need to know and are bound by equivalent confidentiality obligations; (b) as required by law or court order; (c) with the prior written consent of the disclosing Party.
8.2. Exclusions
Confidential Information does not include information that: (a) is or becomes publicly available through no fault of the receiving Party; (b) was already known to the receiving Party without restriction; (c) is independently developed by the receiving Party; (d) is received from a third party without restriction.
8.3. Duration
Confidentiality obligations survive termination of this Agreement for a period of [LAWYER: e.g., 3 or 5 years].
Given the nature of AI services (training data, model architecture, prompt engineering), be specific about what constitutes Provider Confidential Information. The Provider's AI model configurations, prompts, and fine-tuning data should be explicitly listed as confidential.
Section 9: Liability and Indemnification
9.1. Limitation of Liability
[LAWYER: Define liability caps. Considerations:
- Variant A: Cap at total fees paid under the relevant SOW in the 12 months preceding the claim
- Variant B: Cap at total subscription fees paid in the 12 months preceding the claim
- Exclusions from cap: fraud, willful misconduct, death/personal injury from negligence, breach of confidentiality, IP infringement indemnity, data protection breach indemnity
- Exclusion of indirect, consequential, incidental, and punitive damages]
9.2. Client Indemnification
The Client shall indemnify, defend, and hold harmless the Provider from and against any claims, damages, losses, costs, and expenses (including reasonable legal fees) arising from or relating to:
- (a) The Client's breach of its obligations under Section 3 (AI Act Deployer Obligations);
- (b) The Client's use of the AI Systems in violation of Section 4 (Permitted Use and Restrictions);
- (c) The Client's failure to notify the Provider of a high-risk deployment under Section 5;
- (d) The Client's processing of Personal Data in breach of applicable data protection laws;
- (e) Any claim by a third party arising from the Client's deployment of the AI Systems outside the scope of this Agreement.
9.3. Provider Indemnification
[LAWYER: Define Provider indemnification obligations. Consider: (a) IP infringement claims (Provider indemnifies Client if the Platform infringes third-party IP); (b) Provider's breach of the DPA; (c) Provider's gross negligence or willful misconduct.]
9.4. AI-Specific Disclaimers
The Client acknowledges that:
- (a) AI Systems may produce inaccurate, incomplete, biased, or inappropriate outputs ("hallucinations");
- (b) The Provider does not guarantee the accuracy, completeness, or fitness for any particular purpose of AI-generated outputs;
- (c) The Client is solely responsible for evaluating and acting upon AI-generated outputs;
- (d) The Provider shall not be liable for decisions made by the Client or its end users based on AI-generated outputs.
The AI-specific disclaimers (9.4) are commercially important but must be balanced. Under Luxembourg law, certain liability exclusions may not be enforceable (e.g., for gross negligence or fraud). The lawyer should also consider the upcoming AI Liability Directive (proposed) which may introduce strict liability or presumption of causality for AI systems. Additionally, under the EU AI Act, providers have specific obligations regarding system accuracy -- the disclaimers should not contradict those obligations.
Section 10: Term and Termination
Variant A: Services / Consultancy
10.1. This Agreement enters into force on the date of signature and remains in effect until all SOWs have been completed or terminated.
10.2. Either Party may terminate a SOW for convenience with [LAWYER: e.g., 30 days] written notice. Fees for work completed prior to termination remain due.
Variant B: Platform / SaaS
10.1. The initial subscription term is specified in the Order Form. The subscription shall automatically renew for successive periods of [LAWYER: e.g., 12 months] unless either Party provides written notice of non-renewal at least [LAWYER: e.g., 60 days] before the end of the then-current term.
10.3. Termination for Cause
Either Party may terminate this Agreement immediately upon written notice if:
- (a) The other Party commits a material breach that is not cured within [LAWYER: e.g., 30 days] of written notice;
- (b) The other Party becomes insolvent, enters bankruptcy, or ceases to carry on business;
- (c) The Client breaches Section 4.2 (Prohibited Uses) -- no cure period.
10.4. Effects of Termination
Upon termination: (a) the Client's access to the Platform/Services shall cease; (b) data deletion/return shall be handled in accordance with the DPA (Annex A); (c) accrued rights and obligations survive; (d) Sections 7 (IP), 8 (Confidentiality), 9 (Liability), and the DPA shall survive termination.
Section 11: General Provisions
11.1. Entire Agreement
This Agreement, together with its Annexes and any Order Forms or SOWs, constitutes the entire agreement between the Parties and supersedes all prior negotiations, representations, and agreements.
11.2. Amendments
No amendment to this Agreement shall be effective unless in writing and signed by both Parties.
11.3. Assignment
Neither Party may assign this Agreement without the prior written consent of the other Party, except in connection with a merger, acquisition, or sale of substantially all of its assets.
11.4. Severability
If any provision of this Agreement is held invalid or unenforceable, the remaining provisions shall continue in full force and effect.
11.5. Notices
All notices under this Agreement shall be in writing and delivered to the addresses specified in the Order Form. [LAWYER: Define acceptable delivery methods -- email, registered mail, etc.]
11.6. Force Majeure
[LAWYER: Standard force majeure clause. Consider whether AI model unavailability (e.g., Anthropic API outage) qualifies.]
11.7. Compliance with Laws
Each Party shall comply with all applicable laws and regulations, including without limitation the GDPR, the EU AI Act (Regulation 2024/1689), and any implementing national legislation.
Section 12: Governing Law and Jurisdiction
12.1. This Agreement shall be governed by and construed in accordance with the laws of the Grand Duchy of Luxembourg.
12.2. Any disputes arising out of or in connection with this Agreement shall be submitted to the exclusive jurisdiction of the courts of Luxembourg City.
[LAWYER: Consider whether an arbitration clause (e.g., ICC, Luxembourg Arbitration Center) would be preferable for international clients. Also consider whether the jurisdiction clause should be non-exclusive for Variant A (international consulting projects).]
Section 13: Annexes
The following Annexes form an integral part of this Agreement:
Annex A: Data Processing Agreement (DPA)
Pursuant to Article 28 GDPR. Defines Controller/Processor obligations, sub-processing, data subject rights, security measures, breach notification, audit rights, and data deletion.
Base: Existing EasyBoard DPA (EB-DPA-2026-001). Adapt to be product-agnostic for the MSA template. Key adaptations: replace EasyBoard-specific references with generic service references; update sub-processor list to cover all Easylab products; add AI-specific data processing descriptions.
Annex B: Technical and Organizational Measures (TOMs)
Detailed description of security measures implemented by the Provider. Covers: encryption (at rest, in transit), access control, infrastructure, data minimization, monitoring, incident response, business continuity.
Should be reviewed and updated at least annually. Cross-reference with DPIA mitigations.
Annex C: Sub-Processor List
Current list of sub-processors with: entity name, purpose, location, data categories processed, transfer mechanism (where applicable).
Base: Sub-processor table from EasyBoard DPA. Extend to include all sub-processors across all Easylab products. Update mechanism: Client notification with objection right per DPA terms.
Annex D: Annex III Use-Case Screening Checklist
A checklist for the Client to self-assess whether their intended deployment falls within an Annex III high-risk category. References the notification obligation in Section 5.
Create a simple checklist with the 8 Annex III categories and clear yes/no questions. If any answer is "yes" or "possibly", the Client must notify the Provider under Section 5.
Additional annexes to consider: (a) Service Level Agreement (SLA) for Variant B; (b) Acceptable Use Policy (AUP); (c) Standard Contractual Clauses (SCCs) for international transfers; (d) Order Form template; (e) Statement of Work template (Variant A).
Signatures
IN WITNESS WHEREOF, the Parties have executed this Agreement as of the date last signed below.
For the Provider (Easylab AI SARL)
Name:
Title:
Date:
For the Client
Name:
Title:
Date:
DRAFT DOCUMENT -- v0.1 -- March 2026
This document is a working draft pending legal review. It should not be relied upon as a definitive compliance document.
Easylab AI SARL | 55, allée de la Poudrerie, L-1899 Roeser, Luxembourg