Summary. Ask for documents, not assurances — and ask about all three layers.

Phase 1 — Scope the transaction

  • Identify which layers are involved: data, model, outputs, hosted service.
  • State the intended acts specifically:
    • Train from scratch
    • Fine-tune
    • Evaluate and benchmark
    • Retrieval at inference (distinct from training)
    • Internal use of resulting models
    • Embed a model in a distributed product
    • Distribute the model itself
    • Sublicense to affiliates, contractors, or customers
  • Identify what data will flow to the counterparty: none / internal / customer / personal / regulated / third-party confidential.
  • Identify who sees outputs and whether they enter a record of legal or regulatory significance.
  • Estimate the cost and time to replace the asset if the relationship ends.

Phase 2 — Data provenance (request documents)

  • Source manifest: every source, collection method, date range.
  • Archived copies of governing terms as they existed at collection. (The single most revealing request.)
  • Contracts under which contributed or purchased data was obtained.
  • Documentation of machine-readable restrictions encountered and how handled.
  • Statement of what personal information is present and the lawful basis.
  • Filtering, deduplication, and exclusion processes applied.
  • Whether copyright management information was preserved — bears on 17 U.S.C. § 1202.
  • Any claims, demands, or takedown requests received relating to the corpus.
  • Whether the corpus is segregated by license so components can be separated.

Failure mode: accepting "we have all necessary rights" in place of a manifest.

Phase 3 — Chain of title

For each corpus component:

  • Who created it? If not the licensor, under what agreement?
  • If scraped: what did the source terms permit? Contract restrictions bind independently of copyright.
  • If contributed by users: do the contributor terms permit sublicensing for training?
  • If purchased: does the upstream license permit onward licensing? Many prohibit redistribution.
  • If generated internally: was third-party material used in generation?
  • Any component the licensor cannot license at all? Segregate or exclude it.

Phase 4 — Personal, regulated, and sensitive data

  • Is personal information present? Categories and volume.
  • Lawful basis for the original collection, and for training as a separate purpose.
  • Has de-identification been applied? By what method? Is re-identification prohibited contractually?
  • Are deletion and correction rights implicated, and what is the mechanism?
  • Financial data under 15 U.S.C. § 6801 and 15 U.S.C. § 6802?
  • Health information subject to a business associate arrangement?
  • Biometric identifiers subject to state statutes with private rights of action?
  • Data concerning minors?
  • Identifiable voices or likenesses implicating publicity and digital replica statutes?
  • Third-party confidential information implicating 18 U.S.C. § 1836?

Phase 5 — Model license review

  • Obtain the actual license text, not the marketing description.
  • Is it genuinely open source, or an open-weight release with restrictions?
  • Acceptable use policy — any field restriction covering your use?
  • Scale threshold — user, revenue, or compute trigger requiring a separate license?
  • Restriction on using outputs to train competing models?
  • Attribution, notice, and naming requirements?
  • Flow-down obligations to your customers and distributors?
  • Is fine-tuning permitted? Who owns the tuned weights or adapter?
  • Does the base license's acceptable use policy flow to the fine-tuned model?
  • What happens to fine-tuned artifacts if the base license terminates?
  • Does the provider claim rights over your inputs, prompts, or fine-tuning data?
  • Version deprecation policy and notice period.

Failure mode: an engineering team told a model is "open source" and deploying it in a prohibited field.

Phase 6 — Output provisions

  • Does the agreement assign whatever rights exist in outputs?
  • Does it avoid representing that outputs are copyrightable? (Human authorship is required.)
  • Is commercial use permitted without field restriction?
  • Does the provider retain any residual license over customer outputs?
  • Is it acknowledged that other customers may receive similar outputs?
  • Is output infringement risk allocated expressly?
  • Are outputs required to be labeled or attributed where the use case demands it?

Phase 7 — Indemnity, tested against the deployment

For each condition, confirm your actual deployment satisfies it:

  • Current model version required — can you upgrade on the provider's schedule?
  • Safety and filtering features enabled — are you disabling any?
  • No fine-tuning — are you fine-tuning? (Most common voiding condition.)
  • No infringing input — what counts? Does customer-uploaded content qualify?
  • Prompt attack exclusion — how defined, and who decides?
  • Notice period and named recipient — can you meet it operationally?
  • Control of defense — can the provider settle in a way that binds you?
  • Cap — fees over what period, against what realistic exposure?
  • Survival — does it cover claims filed after termination for term-period use?
  • Does the indemnity cover the base model, the outputs, or both?
  • Is base-model IP risk (which the vendor created) treated differently from output risk?

Phase 8 — Termination and model survival

  • Do models trained during the term survive termination?
  • Must the corpus be deleted? Within what period? With certification?
  • Do derived artifacts — embeddings, indices, adapters — survive or die with the corpus?
  • Is there a wind-down period long enough to retrain?
  • Does termination for cause differ from termination for convenience?
  • Does the indemnity survive for term-period claims?
  • Is there a segregation obligation creating a model-to-corpus mapping? (Without it, nothing above is enforceable.)
  • What records must be retained to demonstrate compliance?

Phase 9 — Exit deliverables

  • Fine-tuned weights or adapters delivered.
  • Your training and evaluation data returned.
  • Embeddings and indices derived from your data.
  • Configuration and prompt assets.
  • Logs sufficient for audit and regulatory retention obligations.
  • Certification of deletion of your data.
  • Transition period with continued service.
  • Realistic assessment: are the delivered artifacts usable without the vendor's base model?
  • Architecture reviewed: does retrieval rather than fine-tuning preserve portability?

Phase 10 — Transaction diligence (M&A or financing)

  • Complete corpus inventory for every model in production or development.
  • Archived source terms for scraped or collected components.
  • Complete model inventory: base model, license, field and scale restrictions, flow-downs, corpora used.
  • Does the target train on customer data? Under what contractual right?
  • Consent and lawful basis for personal information; deletion mechanics.
  • Open-weight compliance: field restrictions and scale thresholds against actual deployment.
  • Indemnities in both directions — received upstream versus granted downstream. The gap is retained risk.
  • Pending claims, demand letters, takedown and deletion requests.
  • Remediation cost: what does retraining cost if a corpus must be excluded? What is the migration effort if a model license must be replaced?
  • Structuring: specific indemnity carve-outs, escrow, price adjustment, or exclusion with retraining as a closing condition.

Phase 11 — Ongoing inventory

Maintain, per model and corpus:

  • License and its restrictions

  • Field of use limitations

  • Scale thresholds and current position against them

  • Attribution and flow-down obligations

  • Indemnity conditions and whether the current deployment satisfies them

  • Corpora used, by version

  • Deployed model versions

  • Retained risk where no indemnity exists

  • Next review date

  • Reconcile the inventory against actual deployments annually. Deployments drift.

  • Reconcile upstream indemnities against downstream grants.

  • Calendar renewals ninety days ahead.

Related documents