Rights Audit: Do You Own the Data You Want to License to AI Companies?

A rights audit establishes, dataset by dataset, whether the company owns the data and may license it for AI training, before any buyer sees a sample or names a price. It checks four layers: copyright in the works, database right and trade secrets, platform and API terms, and the people named in the records.

Buyers make the seller give warranties about its rights in the data, as micro1's Data License Master Terms (updated November 8, 2026) show with a no-prior-grant warranty in s.5.1. The seller licenses and keeps the data under a perpetual, irrevocable grant, so the audit is the first legal gate in AI training data licensing. Not licensing is a valid result of the audit.

The DataPacts Editorial Team explains how we source, date and check every figure. Vendor and program terms below are checked November 9, 2026.

What a Rights Audit Checks Before Data Is Licensed for AI Training

A rights audit checks four things for each dataset: who created it, who owns it, which terms limit its use, and which people appear in it. The answer decides whether the dataset is included, excluded or fixed first.

The check matters because the usual grant is wide. micro1's terms (updated November 8, 2026) give a worldwide, royalty-free, nonexclusive, irrevocable, perpetual, sublicensable license in s.1.2, and the licensee owns derivatives, models, weights, outputs and synthetic data under s.2.2. A later rights problem cannot be undone by ending the license. No public figure exists for how often company datasets fail such an audit.

Four Layers of Rights in Company Data

Rights in company data sit in four layers, and a dataset can be licensed only when every layer allows it. The table compares what each layer asks, as of 2026-11-10.

Copyright in Documents, Code and Recordings Made by Staff

Copyright in documents, code and other works made by employees in the course of their job usually belongs to the employer, while works by contractors and founders need a written transfer. Three statutes set the starting point.

• United States: 17 U.S.C. 201(b) treats the employer or the person for whom a work was prepared as author and owner unless both parties sign a written instrument saying otherwise. Under 17 U.S.C. 101 a work made for hire is either prepared by an employee within the scope of employment or specially commissioned in one of nine listed categories under a signed written agreement.
• United Kingdom: CDPA 1988 s.11(2) makes the employer first owner of a literary, dramatic, musical or artistic work or film made by an employee in the course of employment, subject to any agreement to the contrary.
• Germany: UrhG § 69b gives the employer alone the economic rights in computer programs written by employees in performance of their duties, and § 69b(2) extends this to public-service relationships. The section covers computer programs only, so other works need a separate check.

The rules do not settle every case, since an agreement can reverse them, and no court decision applying them to an AI data license is on record. Code ownership has its own page, who owns the code you want to sell.

Database Right and Trade Secrets in the Records

Two further rights can sit in a dataset apart from copyright: the EU database right of the maker who invested in it, and trade secrets the company holds for itself or for others. Each can limit what the company may hand over.

Under Directive 96/9/EC, Art. 7(1) lets a maker who shows substantial investment prevent extraction or re-utilisation of the whole or a substantial part of a database. Art. 7(3) allows the right to be transferred, assigned or licensed, and Art. 10(1) runs it for 15 years from 1 January after completion, restarting under Art. 10(3) on substantial new investment.

Trade secrets work through duties. Under the Defend Trade Secrets Act, 18 U.S.C. 1839(5), misappropriation includes disclosure by one who acquired the secret under a duty to maintain secrecy, in force since 2016-05-11. A company holding a customer's confidential records cannot license them as its own.

Platform and API Terms That Sit Over the Data

The software a company runs on can restrict what it may do with data held there, and the restriction often depends on the route used to extract it. The table lists each vendor's own term, as of 2026-11-09, in alphabetical order.

Two readings follow. The same data can be free to use through one route and barred through another, so the audit records the export route with each terms version. Export rights and mechanics for each source system sit on export rights and mechanics by source system.

Product data follows a separate rule. Under the EU Data Act, Regulation (EU) 2023/2854 Art. 4(13)-(14), a data holder may use non-personal product data only under a contract with the user and may not make it available to third parties outside that contract. The regulation applies from 2025-09-12 (Art. 50).

Customers, Staff and Other People Named in the Records

Owning the records does not settle the rights of the people in them: customers, employees and contributors keep claims through contracts, privacy law and employment law. Buyers ask for proof. PIXTA AI's provider terms (Art. 6.6) require consent of the individuals and written consent records where personal information is included, and micro1's terms make the licensor keep consent and release records for at least 7 years after the agreement ends.

GDPR applies from 2018-05-25 (Regulation (EU) 2016/679, Art. 99). Staff rules are covered in employee notice and consent when licensing internal communications.

What Buyers and Intermediaries Make You Warrant About Ownership

Buyers and intermediaries publish ownership conditions, and in micro1's terms the seller confirms them in warranties backed by an indemnity. The table sets out each program's condition as of 2026-11-09, in alphabetical order, with a role column that keeps intermediaries apart from buyers.

Only micro1 states the full chain in its public terms: a warranty, an indemnity and a refund right that outlives acceptance. Marketplaces and brokers state a condition and leave the consequences to the contract signed with the seller, which is where each warranty sits in an AI data licensing agreement.

How to Run a Rights Audit, Step by Step

A rights audit runs dataset by dataset and ends in a written record that the data manifest and the warranties can rely on. The record matters later, because micro1 can claw back payment with a refund if the Data Manifest is materially inaccurate, even after acceptance (s.4.3).

1. List each dataset and its source system.
2. Name the creator group: employees, contractors, founders, customers, users or vendors.
3. Collect the ownership evidence: employment terms, assignments and licenses in.
4. Read the platform and API terms for the export route.
5. Read customer, partner and vendor contracts for use and confidentiality limits.
6. Mark personal data, trade secrets of others and regulated records.
7. Record a result per dataset: include, exclude, or fix first.

The record is kept with the consent files, since micro1's terms require the seller to keep consent records for at least 7 years and make them available at the buyer's request.

Gaps the Audit Finds and How Sellers Close Them

Most gaps close in one of four ways, and a gap that cannot be closed removes that dataset from the license rather than lowering its price.

• Obtain a written assignment or confirmation: under 17 U.S.C. 101 commissioned-work status depends on a signed written agreement, and under 201(b) only a signed written instrument changes the employer's ownership.
• Ask the platform, customer or partner for permission to use the data.
• Carve out the dataset or fields that the terms do not allow.
• De-identify or remove the data of people who have not agreed.

Buyers carve out as well. micro1 excludes categories such as protected health information, biometric identifiers, payment card or financial account data, data of children under 18 and export-controlled information unless the Order Form allows them (s.5.7, among other categories), and Pangea.ai excludes client-owned, public and forked code. Categories that stay out are listed under company data that cannot be licensed for AI training.

Licensing After the Audit: Benefits, Risks, Downsides and Alternatives

A clean audit makes licensing possible, not necessary, and the warranties it supports keep the seller exposed after payment.

Benefits of a documented audit:

• The seller can make the no-prior-grant and ownership warranties from evidence.
• The data manifest describes only datasets whose rights are known.

Risks after signing:

• An indemnity for IP, privacy, publicity and data protection claims (micro1 s.8.1) applies to the seller.
• A materially inaccurate manifest can trigger a clawback that survives acceptance.
• Pangea.ai's ownership warranty is uncapped.

Downsides of the audit:

• It takes staff and legal time before any buyer is approached.
• It can remove datasets, leaving less to license.

Alternatives, including not licensing at all:

• Keep the data and use it internally.
• License a narrower dataset whose rights are clear.
• Delete or archive data with no rights basis.

The page on should you sell or license your data sets out the full decision.

Where the Rights Audit Sits in the Process to Sell or License Company Data

The rights audit is step 3 of the seller process: it follows readiness and the data inventory and comes before consent, de-identification and valuation. The whole sequence is set out in the guide to sell or license company data to AI companies.

1. Data sale readiness
2. Data inventory for an AI data sale
3. Rights audit (this page)
4. Customer consent and confidentiality clauses
5. PII removal and de-identification
6. How much company data is worth
7. Choosing a buyer
8. The data manifest
9. Due diligence in an AI data deal

The Law Behind Each Layer, and What This Page Is Not

Each layer has its own law, and the jurisdiction of the company, the data subjects and the buyer can all apply. The overview is AI training data law by jurisdiction, fair use and text-and-data-mining questions belong to copyright and AI training, and EU personal data in the records falls under GDPR and AI training data. The EU database right and the Defend Trade Secrets Act have their own pages. This page is general information, not legal advice.

Rights in Data From a Closed or Dissolved Company

When a company closes, the question becomes who may sign for the data, because the directors' authority can end with the company. In the UK, Companies Act 2006 s.1012 vests the property and rights of a dissolved company in the Crown as bona vacantia, and restoration is possible within 6 years (ss.1024, 1030). Ooak Data states that wind-down deals are signed by a director, liquidator or administrator (checked November 9, 2026). Who signs is covered under selling data from a shut-down or defunct company, and who owns a dissolved company's data has its own page.

Pages Cited on This Page

The terms above come from these programs' own pages, each checked November 9, 2026.

• AI data partnership payouts and program terms compared
• aitrainer.work
• Chain of rights for training data
• Company data partnership programs
• HUMXN
• Indemnities and warranties in AI data licenses
• micro1 data buyer profile
• Ooak Data
• Pangea.ai
• PIXTA AI
• Troveo
• Turing Project Lazarus
• Who buys AI training data

Frequently Asked Questions

Who owns company data once it is licensed to an AI company?

Under a license the company keeps ownership of its data, while the buyer gets a right to use a copy and, under some terms, owns what it builds from it. micro1's terms give the licensee derivatives, models, weights and outputs (s.2.2, updated November 8, 2026), Troveo states that the owner retains full ownership, and Turing states "Ownership does not change hands" (both checked November 9, 2026).

Is data considered intellectual property?

Some of it is: documents and code can carry copyright, an EU database can carry the maker's database right, and confidential records can be trade secrets. Each right has its own rule, set out in the four layers above, and plain facts in a record may carry none of them.

Does a company own the documents and code its employees write?

In the US and UK the employer owns works employees make in the course of their job unless an agreement says otherwise. The sources are 17 U.S.C. 201(b) and CDPA s.11(2); Germany's UrhG § 69b gives the employer the economic rights in employees' computer programs.