Does your company actually own the data it wants to license?

Updated October 25, 2026 · How we research

Why does ownership matter before you license anything?

A license is a promise. When your company licenses records to an AI buyer, the agreement will almost always ask you to confirm that you have the right to grant it. If that turns out to be wrong, your company can face claims from the people whose information it was, and from the buyer.

Having a copy of data on your servers is not the same as having the right to license it. A shared drive can hold your own work product next to a customer's confidential files, a vendor's price list and an employee's personal messages. Each of those may follow different rules.

What usually belongs to the company?

Material your employees create as part of their jobs is generally owned by the employer under U.S. copyright law, unless a signed agreement says otherwise. The U.S. Copyright Office calls this a work made for hire. Internal procedures, training guides, project plans and much internal email can fall into this group.

Work by independent contractors is different. Under the same rules, a contractor's work is only a work made for hire if it fits one of a short list of categories and a signed written agreement says so. Otherwise the contractor may still own it unless the rights were assigned. Check your contractor agreements before treating their output as yours.

When do customer contracts and NDAs get in the way?

Customer agreements, master service agreements and NDAs commonly limit how you can use information the other side gave you. A typical NDA says confidential information may be used only for the purpose of the relationship, may not be shared beyond people who need it, and must be returned or destroyed on request. Licensing that material to a third party for AI training is unlikely to fit that purpose.

Look especially for clauses about confidentiality, permitted use, data ownership, and return or destruction at the end of the relationship. Some contracts last for years after they end, and trade secret protection can last indefinitely. If a customer's information is mixed into your records, it may need to be removed or de-identified, or left out entirely.

• Customer files, drawings, pricing and specifications they sent you
• Records covered by an NDA, either side's
• Data you process on a customer's behalf as their service provider
• Partner or supplier information shared under confidentiality terms

What about employee communications?

Email and chat on company systems are often treated as company business records, and many employers have policies saying employees should not expect privacy there. But the messages still contain personal information about employees and the people they wrote to. In California, the CCPA has covered employee and job applicant data since January 1, 2023, when the earlier employment exemption expired. Other states and countries have their own rules.

This does not automatically stop a deal, but it shapes it. Expect to remove or replace names and contact details, and to keep out HR files, medical notes and similar sensitive material. See the guide on employee and customer privacy for more.

What about third-party content and software terms?

Your records may contain content you did not create and do not own: purchased reports, licensed images, stock templates, news clippings, or vendor manuals. Owning a copy for internal use rarely includes the right to relicense it.

Software vendors also set terms on data you pull out of their tools. For example, Salesforce changed the Slack API terms in 2025 to restrict bulk export through the API and use of that data in large language models, according to a law firm summary. Check the terms of each system before planning an export method, and ask the buyer how they intend to collect the data.

How do you run a basic rights check?

Start with your data inventory, then sort each source into three groups: clearly ours, clearly not ours, and unsure. Anything unsure stays out until a lawyer has looked at it. A short written record of what you checked and why is useful if questions come up later.

• List each system and the kinds of records in it
• Pull your top customer, partner and vendor contracts and note any confidentiality or data-use limits
• Check employee and contractor agreements for IP ownership terms
• Flag regulated data such as health or financial records
• Read the terms of service for each software system you plan to export from
• Review your own past privacy notices; the FTC has warned that quietly changing privacy promises to allow AI training can be unfair or deceptive
• Have a lawyer review the result before you sign anything

General information, not legal, tax or financial advice.