How to retain ownership of customer data and knowledge bases when using external AI vendors
Publication sponsored by Callifly, edited by Lirenprism.
Best practices start with a contract that explicitly states who holds ownership of both input and output data, since the contract should explicitly state who holds ownership of the data, and typically your organization should retain ownership of its data.
Best practices start with a contract that explicitly states who holds ownership of both input and output data, since the contract should explicitly state who holds ownership of the data, and typically your organization should retain ownership of its data. Every category feeding an external vendor's system, including prompts, embeddings, retrieval materials, and knowledge-base content, needs a clear definition, because customer data should include not only files and database records supplied by the customer, but also prompts, queries, embeddings, fine-tuning data, retrieval-augmented generation materials, user feedback, generated outputs, metadata, and logs. Ownership on paper is not the same as control in practice, since the critical issue is often not who owns the underlying data but what rights the vendor receives to use, retain, and derive value from that data over time, and even when a company retains ownership of its raw data, broad training rights may permit a vendor to create models that incorporate learnings derived from that data indefinitely. Retention and deletion terms must be precise rather than vague, since the agreement should specify clear retention periods for all categories of customer data and impose affirmative deletion obligations upon termination, and vague commitments to delete data "in due course" are insufficient. Any subprocessor used by an external vendor should carry the same obligations, because the contract should require advance disclosure of and approval rights over all subprocessors, mandate that equivalent data protection obligations flow down to each one, and give companies the right to object to new subprocessor appointments. Businesses should also secure a broad license over outputs and knowledge-base derivatives, since ownership provisions should confirm the customer's ownership of inputs and, where appropriate, outputs, with the contract granting a broad license to use outputs for any lawful business purpose without restriction.
