WhatsApp and Telegram +44 7563 115980
[email protected]
The terms that decide what an AI company may do with licensed data, what happens when the licence ends, and who carries the risk if something goes wrong, explained for both the data owner and the buyer.
Since 2013 we have helped firms with due diligence and data services, in more than 60 countries.
The short answer
An AI data licensing agreement is a contract in which the owner of a dataset allows a buyer to use it to train, fine-tune or test AI models, without transferring ownership. The key terms are the scope of the data, the permitted uses, exclusivity, the term and territory, fees, delivery, attribution, what happens to the data and to trained models at the end, re-identification, warranties, indemnities, audit and confidentiality. The owner wants control and payment; the buyer wants certainty that the rights are clear and that models trained on the data can keep running.
On this page
A licence is a permission. The owner keeps the data and the rights in it, and grants the buyer the right to do specific things with it. An assignment is different: it transfers ownership. Under UK copyright law an assignment is not effective unless it is in writing and signed by the person assigning, and an exclusive licence must also be in writing and signed by or on behalf of the owner. Written terms are therefore the foundation of any data deal.
Whether a licence is exclusive matters in practice. In the November 2025 judgment in Getty Images v Stability AI, the High Court examined the claimants' licences one by one to decide which were exclusive licences under section 92 of the Copyright, Designs and Patents Act 1988, because that affects who can bring a claim. Clear drafting avoids that argument.
Data licences sit alongside other agreements: a confidentiality agreement before samples are shared, a data processing agreement if any personal data is involved, and sometimes a services agreement for preparation and delivery.
| Term | What it settles | What to watch |
|---|---|---|
| Parties and authority | Who grants the licence and on what authority | The signatory must be able to bind the owner, and the owner must hold the rights |
| Dataset definition | Exactly which records, fields, dates and volumes are licensed | Attach a data sheet so there is no dispute about what was delivered |
| Permitted use | Training, fine-tuning, evaluation, retrieval and commercial deployment, each named | Anything not named should be excluded, including resale and competing products |
| Exclusivity | Whether others may license the same data | Define the field of use and the period of exclusivity precisely |
| Term and territory | How long the licence runs and where the data may be used | Align with where the buyer stores data and trains models |
| Fees | Fixed, annual, per unit, minimum plus usage, or a mix | Link payments to accepted deliveries |
| Delivery and refresh | Format, method, schedule and acceptance tests | Set quality criteria for acceptance before full delivery |
| Attribution | Whether and how the source is credited in products | State the form and placement of credit if it is part of the value |
| Models and outputs | Who owns models trained on the data and their outputs | Usually the buyer, within the use limits of the licence |
| End of term | Deletion or return of copies, and the status of trained models | Decide whether trained models may continue in use after expiry |
| Re-identification | A ban on any attempt to identify people | Must pass down to every recipient |
| Warranties | Promises about rights, lawful collection and de-identification | Tie them to records the seller can actually evidence |
| Indemnities | Who pays if a third party sues | Set caps and exclusions in proportion to the fee |
| Audit | The owner's right to check compliance | Agree notice periods, frequency and confidentiality |
| Confidentiality | Protection for the data and the deal terms | Survives the end of the licence |
Scope is where most disputes start. Training means teaching a model from examples. Fine-tuning means further training on a narrower task. Evaluation means testing a model on examples it has not seen. Retrieval means letting a model look up documents when it answers. Each has different value and risk, so each should be named separately.
Exclusivity should be defined by field and time: for example, exclusive for models that draft legal documents for three years, non-exclusive for everything else. Before granting exclusivity the owner must check earlier licences, because a new exclusive grant that conflicts with an existing licence puts the owner in breach.
Territory matters less for data than for physical goods, but it still matters. In Getty Images v Stability AI the claim about training was abandoned because there was no evidence that the training took place in the UK. Where training happens can decide which law applies, so the agreement should say where data may be stored and processed.
We prepare the rights record, exclusion record and de-identification report that the licence warranties rest on, for either side of the deal.
Speak to an expertAI training dataWhen a licence ends, copies of the data can be deleted. A model that has already learned from the data cannot simply forget it. The agreement must therefore deal with three things separately.
Retention periods should also reflect legal duties. If any personal data is involved, data protection law limits how long it may be kept.
A warranty is a contractual promise that a stated fact is true. An indemnity is a promise to cover the other side's losses if a defined event happens, such as a third-party claim.
Warranties are only as strong as the evidence behind them. A seller should give warranties that match its rights record, exclusion record and de-identification report. Our data de-identification service produces those records.
| Party | Before signing, confirm that |
|---|---|
| Data owner | Rights are cleared and recorded; personal data is removed and tested; earlier licences do not conflict; uses are named and limited; the re-identification ban and deletion terms pass to every recipient; audit rights are in place |
| Data buyer | The seller has authority and evidence of rights; the de-identification method and tests are documented; the data sheet matches the delivery; trained models survive the term; the licence allows EU AI Act disclosure; indemnities cover third-party claims |
Buyers can work through the full AI training data due diligence checklist. Owners can see how a sale is prepared in our guide on how to sell data to AI companies. Every dataset we supply through our AI training data service comes with its licence, rights record and exclusion record.
A contract in which the owner of a dataset allows another party to use it for defined purposes, for a set term and usually for a fee, while keeping ownership. For AI, the purposes are training, fine-tuning, evaluation or retrieval.
The dataset definition, permitted uses, exclusivity, term and territory, fees, delivery and acceptance, attribution, ownership of models and outputs, end-of-term deletion, a re-identification ban, warranties, indemnities, audit and confidentiality.
An exclusive licence reserves the data for one buyer within an agreed field and period, and in UK law must be in writing and signed by the owner. A non-exclusive licence lets the owner license the same data to others.
Usually the buyer, together with the model's outputs, within the use limits set by the licence. The licence governs the data itself, not the model, unless the parties agree otherwise.
Only what the agreement says. Copies of the data are usually deleted, but the parties should state expressly whether models already trained may continue to be used, sold or further trained.
Only if the licence permits it. Most licences prohibit resale and limit sharing to named affiliates or contractors bound by the same terms, including the ban on re-identification.
That it owns or controls the data, holds the rights for the stated uses, collected it lawfully, has removed personal and sensitive information to the stated standard and has not granted conflicting rights.
Yes, wherever the data was derived from personal information. California law requires recipients to be bound by contract, and in the UK re-identification without consent is a criminal offence.
Each point of law and each reported figure on this page was checked against these sources on 27 October 2026. This page is general information, not legal advice.
Tell us about the data, the buyer or seller and the uses being negotiated.