---
title: "Service-provider safeguards addendum"
url: "https://ailawframework.com/precedents/privacy-data-protection-and-cyber/us-vendor-safeguards-addendum"
type: "precedent"
site: "AI Law Framework"
id: "a25-us-vendor-safeguards-addendum"
area_id: "A25"
kind: "agreement"
ai_level: "yellow"
version: 1
task_ids: ["A25-T1-R5", "A25-A20260923-3"]
law_stated_as_at: "2026-10-22"
---

# Service-provider safeguards addendum

> A short contract addendum for a service provider that will hold customer information of a financial institution covered by the FTC Safeguards Rule. It follows 16 CFR § 314.4(f).…

Canonical page: https://ailawframework.com/precedents/privacy-data-protection-and-cyber/us-vendor-safeguards-addendum  
Law stated as at: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

A short contract addendum for a service provider that will hold customer information of a financial institution covered by the FTC Safeguards Rule. It follows 16 CFR § 314.4(f). It is not a HIPAA business-associate agreement.

## Key facts

- Kind: Agreement. A contract between two or more parties.
- Practice area: [Privacy, Data Protection & Cyber](https://ailawframework.com/precedents/privacy-data-protection-and-cyber.md)
- Jurisdictions: United States
- AI level: Yellow. You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at: 2026-10-22
- Status: Maintained. Checked on 2026-10-22 against the 2 authorities it cites, for United States.

## When to use it

Use when the customer may be a financial institution under 16 CFR § 314.1 and a vendor will handle customer information. If the lawyer decides part 314 does not apply, do not use this addendum. Do not use it as the only privacy schedule for a deal that is outside that rule.

## Used for these tasks

- [Build a vendor AI and subprocessors risk questionnaire](https://ailawframework.com/practice/privacy-data-protection-and-cyber/build-a-vendor-ai-and-subprocessors-risk-questionnaire.md)
- [Draft a data-processing agreement from the processing facts](https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-a-data-processing-agreement-from-the-processing-facts.md)

## How AI may be used

AI may insert the vendor's legal name and the description of customer information the lawyer writes. The lawyer decides whether part 314 applies and what safeguards are appropriate.

**AI may:**

- Insert the parties and the description of information from the lawyer's note
- Keep the safeguards as the phrase section 314.4(f) uses, unless the lawyer adds a specific control
- Flag any audit right, encryption standard, or notice period that is not in the rule and not written by the lawyer

**AI must not:**

- Must not decide that the customer is a financial institution
- Must not add a security control or a notice deadline the lawyer did not write
- Must not present this addendum as a business-associate agreement

**The lawyer checks:**

- Part 314 either applies, or this addendum is not used
- The information description matches what the vendor will actually hold
- No HIPAA business-associate clause has been pasted in

## Authorities

- [16 CFR § 314.1(b) (the Safeguards Rule applies to financial institutions over which the FTC has jurisdiction)](https://www.law.cornell.edu/cfr/text/16/314.1)
- [16 CFR § 314.4(f) (select and retain capable service providers, require safeguards by contract, and assess them periodically)](https://www.law.cornell.edu/cfr/text/16/314.4)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/privacy-data-protection-and-cyber/us-vendor-safeguards-addendum and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*