Google Workspace Terms Update: AI Agents and Responsible Use Guidelines

Quick Answer

Google announced updates to the Google Workspace Service-Specific Terms, Google Cloud Terms of Service, and new Google Cloud Agentic AI Responsible Use Guidelines, effective October 12, 2026. The changes clarify responsibilities when organizations deploy AI agents, including intellectual property, access to business systems, acceptable use, and liability.

Google Workspace administrators and organizations using applicable AI services should review the updated contractual terms, assess the permissions granted to AI agents, and establish appropriate safeguards and human approval processes. The supplied Google Workspace partner notification states that these changes do not affect customers covered by offline Google Workspace agreements. Customers should confirm which terms apply to their subscriptions.

What Has Changed?

The Google Workspace partner notification identifies three principal areas of change and an additional contractual update dated September 2, 2026.

1. Google Workspace Service-Specific Terms

Google updated Sections 12 and 13 of the Google Workspace Service-Specific Terms in connection with new agentic AI offerings, including long-running agents. According to the notification, these changes clarify intellectual property ownership and liability when customers interact with different types of AI agents.

An AI agent is a goal-oriented system or workflow that performs tasks on behalf of a customer, either under supervision or autonomously. Depending on its configuration, an agent may interact with files, applications, connected services, and business data rather than simply generating text.

2. Google Cloud Agentic AI Responsible Use Guidelines

Google introduced guidelines that supplement its Acceptable Use Policy and Generative AI Prohibited Use Policy. These guidelines provide restrictions and recommendations intended to reduce agent-related risks, protect privacy, and support responsible deployment.

The official guidelines address system security, deceptive activity, privacy, unauthorized transactions, agent permissions, and human oversight. They also explain that customers are responsible for determining whether an agent is suitable for its intended purpose and for supervising its use.

3. Google Cloud Terms of Service

The notification states that Google updated Sections 3.3 and 13.2 of the online Google Cloud Terms of Service. These changes clarify that applicable use restrictions extend to customers' AI agents and address indemnification for Google if a customer's AI agents violate the Acceptable Use Policy.

Indemnification is a contractual allocation of certain legal costs or liabilities. The precise obligations depend on the applicable agreement and circumstances. Organizations should read the actual contractual wording rather than assume that every incident creates identical liability.

4. Additional Update Dated September 2, 2026

The notification also identifies a change to Section 8.3 concerning immediate termination when Google determines that a breach is incapable of being cured. Organizations should review the relevant agreement to understand the applicable termination provisions.

Who Is Affected?

The updates are relevant to organizations using applicable Google Workspace or Google Cloud services, particularly those that deploy AI agents or allow AI-powered features to interact with business information and applications.

• Google Workspace administrators: Review the AI features available to users and the permissions granted to connected applications.
• Business owners and management: Understand contractual responsibilities and potential operational or financial risks.
• IT and security teams: Assess access controls, monitoring, approval procedures, and data protection measures.
• Google Workspace partners and resellers: Inform affected customers and direct them to the relevant contractual documents.
• Organizations using AI agents: Ensure that agent activities remain within authorized business purposes and applicable policies.

The supplied notification states that the changes do not affect customers with offline Google Workspace agreements. Organizations with negotiated agreements should confirm their applicable terms with their authorized representative.

What Should Google Workspace Administrators Do?

Step 1: Review the Applicable Terms

Read the current Google Workspace Service-Specific Terms, the Google Cloud Service-Specific Terms, and the agreement governing your subscription.

Pay particular attention to provisions concerning AI agents, intellectual property, customer responsibilities, use restrictions, indemnification, and termination. Contractual obligations can vary by product and agreement.

Step 2: Inventory AI Agents and Connected Applications

Identify the AI features, agents, and automated workflows used within your organization. Include custom agents and third-party agents connected to company systems.

• Document the business purpose of each agent.
• Identify the files, applications, and systems it can access.
• Confirm that permissions are limited to what the agent needs.
• Remove unnecessary access and revoke permissions that are no longer required.
• Verify that integrations and automated workflows have appropriate authorization.

Step 3: Require Human Approval for Consequential Actions

Establish suitable human review and explicit approval procedures for sensitive or consequential operations. Examples include financial transactions, legal commitments, changes to production systems, and transfers or deletion of important data.

Preserve confirmation safeguards provided by the service unless there is a properly assessed and authorized reason to change them. Google's guidelines specifically recommend human oversight and approval mechanisms for critical or consequential AI agent actions.

Step 4: Protect Business and Customer Data

Review the information an AI agent can access and where it can transfer that information. Apply your organization's confidentiality, privacy, retention, and access-control requirements.

• Grant access only to the files and systems required for the assigned task.
• Avoid placing passwords, authentication codes, or other secrets unnecessarily in agent instructions.
• Assess how agents handle personal information and confidential customer records.
• Monitor agent activity and investigate unexpected access or data transfers.
• Test workflows in a controlled environment before permitting changes to production data.

Step 5: Monitor Usage and Costs

AI agents may consume resources or incur charges on Google and third-party services. Configure available budgets, usage limits, alerts, and approval requirements. Review billing records and investigate unexpected consumption.

Google's guidelines explicitly remind customers that they remain responsible for charges accrued by their agents.

Step 6: Update Internal Policies

Review your organization's AI usage policy, security procedures, employee guidance, vendor assessments, and incident-response processes. Document who may authorize agents, what data they may access, which actions require approval, and who is responsible for investigating incidents.

Important AI Agent Security Risks

Organizations should assess the following risks when deploying AI agents. The controls listed are practical security recommendations; the exact requirements depend on the applicable service, contractual terms, and business environment.

Risk	Recommended control
Unauthorized access	Apply least-privilege permissions and authorized credentials.
Prompt injection	Test how agents handle malicious instructions embedded in external content and restrict their ability to act on untrusted input.
Unauthorized file changes	Require appropriate authorization for file modifications and permission changes.
Privacy violations	Limit access to personal information and apply suitable privacy controls.
Fraudulent transactions	Require human approval and transaction limits where appropriate.
Unintended production changes	Use testing environments, approval gates, backups, and recovery procedures.
Unexpected expenses	Monitor resource consumption and configure available spending controls.
Deceptive or abusive activity	Ensure that agent operations comply with applicable policies and third-party restrictions.

Does This Mean Google Workspace AI Features Are Prohibited?

No. The notification does not state that all Google Workspace AI features are prohibited. It describes updated contractual terms and responsible-use requirements for applicable services and agents.

Organizations can continue using permitted features provided their use complies with the applicable agreements, acceptable-use policies, product restrictions, and relevant laws. According to the notification, existing use of AI features is also subject to the updated terms.

Frequently Asked Questions

When did the updated terms become effective?

The supplied notification states that the changes to the relevant terms and the new Agentic AI Responsible Use Guidelines became effective on October 12, 2026. It separately identifies an additional contractual update dated September 2, 2026.

Do organizations need to stop using Gemini or other AI features?

The notification does not require organizations to stop using all AI features. Organizations should review the terms applicable to their products and ensure that their use complies with the relevant requirements.

Who is responsible if an AI agent performs an unauthorized action?

Responsibility depends on the applicable agreement, the circumstances, and relevant law. Google's published Cloud terms state that customers are responsible for agent actions, assessing whether agents are suitable for their use cases, authorizing access to data and systems, and exercising appropriate judgment and supervision.

Does the update apply to customers with offline agreements?

The supplied partner notification states that these changes do not affect customers with offline Google Workspace agreements. Customers should confirm their governing terms with their authorized representative.

Can an AI agent automatically access and modify company files?

Capabilities depend on the service and its configuration. Organizations should authorize only necessary access and establish appropriate safeguards for file modifications and other sensitive operations. Google's responsible-use guidelines prohibit certain file changes or permission bypasses without explicit customer authorization.

What happens if an AI agent violates Google's policies?

Consequences depend on the applicable terms and circumstances. The notification identifies updated provisions concerning use restrictions, indemnification, and termination. Organizations should review the relevant agreement rather than assume a specific penalty applies to every violation.

Where can administrators read the official guidelines?

Administrators can consult the Google Cloud Agentic AI Responsible Use Guidelines, the Google Workspace Service-Specific Terms, and the Google Cloud Service-Specific Terms.

Sources

• Google Cloud Agentic AI Responsible Use Guidelines
• Google Workspace Service-Specific Terms
• Google Cloud Service-Specific Terms
• Google Cloud Acceptable Use Policy