Before you license company data to AI: a rights checklist

A buyer licenses your records only after you promise in writing that you have the right to. Seven checks cover most of what that promise rests on. Do them before the first call with a buyer, and take the answers to a lawyer before you sign. This page is a list of questions, not legal advice.

1. Someone with authority signs for the company

The license is with the company, so the person signing needs the authority to bind it: a director or officer while it operates, or the administrator, trustee or liquidator in a formal process. If the company is closed or in an insolvency process, read whether its data can be sold.

2. Customer contracts allow it

Support tickets, shared channels and email threads hold your customers’ words and files. Many business contracts limit what you can do with a customer’s data or confidential information, and some name AI training directly. Pull your standard terms, any data processing agreements, and the contracts of your largest customers, and look for confidentiality, data use and data deletion clauses. If a clause rules a customer out, leave that customer’s records out of the license.

3. Personal data is removed or anonymized

Work records are full of names, emails and phone numbers, of staff and of customers. Under the EU and UK GDPR, data that has only been pseudonymized, for example with names swapped for codes that someone could reverse, still counts as personal data. Only anonymous data falls outside the law. The buyers we list remove or replace personal details before training, but you still decide what leaves your systems. Ask each buyer how it de-identifies, where that happens, and what you get to check first.

4. Health records meet the HIPAA standard

If any records hold patient information and your company is covered by HIPAA, the Privacy Rule allows two ways to de-identify it. One removes 18 named kinds of identifiers and requires that you have no actual knowledge the rest could identify someone. The other needs a qualified expert to determine that the risk of identifying someone is very small. Agree with the buyer which method applies before anything leaves your systems.

5. Your own privacy policy and staff notices cover it

Read what your privacy policy and employee handbook say about sharing data with third parties. The US Federal Trade Commission warned in February 2024 that a company adopting more permissive data practices, such as using data for AI training, and telling people only through a quiet, retroactive change to its terms could be acting unfairly or deceptively. If your policy never mentioned licensing data, the safer route is to license only records that are anonymous, and to ask a lawyer about the rest.

6. The tools you export from allow the method

How the records leave a tool matters as much as what is in them. Slack’s API terms, effective October 10, 2025, say apps may not use data pulled through its API “to train a large language model”, and may not bulk export message and file data unless another agreement allows it. Ask each buyer how it collects Slack, email or ticket data: an export you run yourself, an app it installs, or a signed-in session. Then read that tool’s terms for the method it names.

7. Files from third parties are flagged

Folders and repos collect material the company doesn’t own: licensed images and fonts, research reports, partner documents, and open-source code under its own license. A license usually lets the buyer use what you hand over, so list what came from someone else, and either leave it out or tell the buyer what it is.

Take the answers to a lawyer before you sign

Write down the answer to each check, with the contract or policy it comes from. That gives a lawyer something concrete to review, and it answers most of what a buyer asks during its own review. Then run the fit check to see which buyers’ published terms match your company.