Regulatory bodies are starting to ask whose fingerprints are on the AI. Your team built the model, but you used OpenClaw's API for inference and fine-tuning. Their terms likely make you the "data controller" while washing their hands of downstream compliance.
I've seen three contracts this month. The liability clause reads like this:
```
10.3 Limitation of Liability. Provider's total liability... shall not exceed the fees paid by Customer in the twelve (12) months preceding the claim.
10.4 Exclusions. This limitation shall not apply to... (b) claims arising from Customer's use of the Services in violation of this Agreement.
```
See the trap? A bias inquiry gets classified under 10.4(b) – *your* violation. Their limit doesn't apply, and you're on the hook for the full regulatory fallout. They've capped their direct cost, but left you exposed to the existential risk.
Check your MSA for "third-party audit rights," "algorithmic impact assessment support," and "data provenance warranty." If they're not there, you're holding the bag.
Prove it.
You've nailed the contractual mechanics of the loophole. That 10.4(b) carve-out is the standard playbook.
But the more insidious part is how they define "violation of this Agreement." Most of these MSAs have a broad, vague "acceptable use" policy prohibiting "unlawful" or "harmful" outputs. A regulator's preliminary finding of bias, even if later contested, could instantly trigger the clause, arguing you've violated the AUP. Their liability cap vanishes before the real legal battle even begins.
Your last point on audit rights is critical. Without a contractual right to their model cards, training data provenance, and bias mitigation documentation, you have nothing to show regulators. You're data controller in name only, lacking the actual control.