AI data license term sheet: a buyer's template

What a term sheet settles before anyone drafts

A term sheet settles the points that decide whether a full license is worth drafting: what data, for which uses and models, for how long, under which price structure, and who carries rights and privacy risk. Write it after sample review and before redlines; diligence can run alongside, feeding the warranty and disclosure rows.

There is no market-standard form to borrow. The US Copyright Office's Part 3 report on generative AI training, still a May 2025 pre-publication version as of October 2026, declined to recommend legislation and said the licensing market for AI training data should be allowed to develop [1].

Public deal reports show which variables carry the economics. Coverage of AP's July 2023 deal with OpenAI reported a license to part of AP's text archive, a two-year term and undisclosed financial terms [2]. HarperCollins's 2024 program covered selected nonfiction titles, was opt-in for authors and limited verbatim reproduction [3]. Retrieval is priced apart: industry coverage describes publishers moving from training payments toward usage-based grounding deals that pay when content is shown in AI answers [4], so a grant of "AI use" leaves a separately priced right undefined.

The term sheet records what both sides accepted. The AI data license negotiation checklist ranks your own positions, and SourceX's deal terms checklist serves supplying businesses preparing the same conversation.

The buyer's template: 20 fields and the AI check for each

Each field needs one plain-language entry both sides initial; the last column names the AI-specific failure to check in the licensor's wording. Rows 3, 5 and 9 decide whether a trained model stays usable, so never let them slide to "to be agreed in the definitive agreement."

Row 9 needs row 15 behind it. The FTC's 2021 Everalbum order required deletion of the models and algorithms built from users' photos and videos [6], so a survival clause protects your weights against the licensor, not against a regulator, if the data was collected unlawfully.

Delivery choices that change other rows

Name the format and transfer mechanism in row 11, because each choice changes what rows 3 and 17 must say:

• Warehouse share. With Snowflake Secure Data Sharing no data is copied between accounts and shared objects are read-only for the consumer [7]. To train outside the warehouse, row 3 must allow copying records out of the share.
• Cross-account bucket. In Amazon S3 the bucket owner grants another account permissions through a bucket policy [8]. State whose bucket it is and when access ends, so row 17's deletion duty has a defined scope.
• Physical transfer. As of October 2026, AWS Snowball Edge remains closed to new customers; AWS points them to DataSync, Data Transfer Terminal or partner solutions [9], so name the actual mechanism in row 11.
• Files and metadata. JSON Lines requires UTF-8 without a byte order mark and one JSON value per line [10]. Croissant describes dataset metadata, files and record structure in JSON-LD built on schema.org [11], so a Croissant file makes row 2 machine-checkable.

Details belong in the technical delivery specification; refresh mechanics in subscription licenses for refreshed data.

Rows that carry statutory content

Statute enters through rows 14 and 19, so write them as requirements, not bargaining positions. As of October 2026:

• California deidentified data. Under Civil Code 1798.140(m), information counts as deidentified only if the business, among other conditions, contractually obligates recipients to comply with all provisions of that subdivision, which include the commitment not to re-identify [12].
• HIPAA limited data sets. A limited data set is still protected health information, usable only for research, public health or health care operations, and requires a data use agreement [13]. If the sample is one, that agreement must exist before it ships.
• Financial records. Under Regulation P, nonpublic personal information received from a nonaffiliated financial institution under an exception may be used only for the purpose for which it was received [14].
• EU AI Act. Article 53(1)(d) requires general-purpose AI model providers to publish a sufficiently detailed training-content summary [15] on the Commission's 24 July 2025 template; the summary lists main data collections and explains other sources [16].
• California AB 2013. Generative AI developers must post documentation including dataset sources or owners and whether datasets include copyrighted or licensed material, first by 1 January 2026 and before each later release or substantial modification [17].
• Colorado SB26-189. From 1 January 2027, developers of automated decision-making technology that materially influences consequential decisions must give deployers documentation including training data categories [18].

For EU personal data, row 14 also feeds your DPIA for acquiring a training dataset; the de-identification evidence package lists what to request behind it.

Which clauses bind before signature

Only a short list should bind at the term sheet stage: confidentiality, sample-use limits, statutory privacy flow-downs for any sample, costs, expiry and governing law. State that everything else is subject to contract, because whether a signed preliminary document binds depends on its wording, the parties' conduct and the governing law, not on whether it is titled "term sheet" or "LOI."

Vendor evaluation paper is narrow by design. NVIDIA's sample data license for evaluation, for example, is limited, non-exclusive, revocable, non-transferable and non-sublicensable, and permits use solely for evaluating and testing NVIDIA technologies [19]; some data vendors combine a trial data license and a mutual NDA in one document [20]. If such paper already covers the sample, reference it; evaluation licenses and NDAs for dataset samples covers its terms. Also state whether either side owes a duty to negotiate in good faith, since jurisdictions treat such duties differently.

Worked example: a completed term sheet for support-ticket histories

The example fills the template for a fine-tuning and evaluation deal over customer-support ticket threads, the record a support-agent model learns from. Bracketed values are placeholders.

Illustrative example: invented to show structure; it does not describe an available dataset. Not legal advice; adapt with counsel.

AI DATA LICENSE TERM SHEET   Part A non-binding; subject to a signed license
Licensee: [AI company]        Licensor: [US software company]
Signed: [date]                Part A lapses: [date + 45 days]

PART A: COMMERCIAL TERMS
 1 Parties      Licensor operates the help desk that produced the records.
                Licensee and its controlled affiliates.
 2 Data         Closed ticket threads from Licensor's help-desk system,
                created [2021-01-01] to [2025-12-31], [N] threads (+/- 5%).
                Fields: ticket_id, created_at, channel, product_area,
                customer_messages, agent_replies, macro_ids,
                resolution_code, csat_score. Excluded: internal notes,
                attachments, payment records.
 3 Grant        Copy, store, de-duplicate, annotate and transform; train,
                fine-tune and evaluate Models.
 4 Retrieval    Not licensed: no retrieval index; no verbatim quotation
                of Licensed Data in outputs.
 5 Models       Any model whose parameters are updated using Licensed
                Data, and its fine-tuned, distilled or quantized versions.
 6 Derived      Licensee owns annotations, embeddings and eval splits it
                creates. Synthetic records generated from Licensed Data
                are Licensed Data.
 7 Deployment   Licensee products, APIs and internal tools; no open-weight
                release. Contractors and cloud processors under
                written confidentiality.
 8 Term         [3 years] from signature; worldwide; renewal by order form.
 9 Survival     Models trained before the end date survive perpetually;
                no training on Licensed Data after it.
10 Exclusivity  None.
11 Delivery     JSON Lines (gzip), one thread per line; data dictionary;
                Croissant metadata; SHA-256 manifest. Read access to a
                Licensor-owned bucket prefix for [30 days] per delivery.
                Quarterly refresh of newly closed threads.
12 Acceptance   [20 business days] to test schema, field completeness,
                PII scan and duplicate rate against Schedule C;
                re-delivery, then refund of the defective portion.
13 Fees         [$A] fixed for the initial delivery; [$B] per refresh.
                A "thread" = one ticket_id with all public messages.
                50% on signature, 50% on acceptance.
14 Privacy      Licensor removes or replaces names, emails, phone numbers,
                account numbers and street addresses in message text,
                records the method and checks a post-processing sample.
                Licensee: no re-identification; flowed down to contractors.
15 Warranties   Title to grant row 3; collection under customer terms and
                notices permitting this disclosure; exceptions scheduled.
16 Indemnity    Third-party IP and privacy claims from Licensed Data,
                incl. reasonable retraining costs; cap [X] x total fees.
17 Takedowns    Up to [N] threads per quarter, batched; removed from data
                copies and future runs; no retraining duty. Data copies
                deleted [60 days] after the end date, certified.
18 Audit        Annual officer's certificate; one audit per year limited
                to training-input logs, on [30 days'] notice.
19 Disclosure   Licensee may describe Licensed Data in legally required
                documentation (EU AI Act Art. 53(1)(d), Cal. AB 2013,
                Colo. SB26-189), naming Licensor only where required.
20 Assignment   To affiliates or an acquirer without consent; Licensor's
                change of control does not affect the license. Law: [State].

PART B: BINDING ON SIGNATURE
B1 Confidentiality  This term sheet, the sample, Licensee's stated uses.
B2 Sample use       [500]-thread sample: evaluation only, no training,
                    deleted when Part A lapses.
B3 Privacy          Row 14 covenants apply to the sample.
B4 Costs            Each party bears its own.
B5 Expiry           Part A lapses on the date above unless a license is signed.
B6 Governing law    [State] law governs Part B.

Three entries do most of the work. Row 4 excludes retrieval because quoting support threads to end users would expose customer messages; price grounding separately if you need it. Row 13 defines the unit, so the refresh fee cannot drift when tickets are split or merged. Row 17 batches takedowns without a retraining duty, so a withdrawal never reaches the weights row 9 protects.

From signed term sheet to definitive license

Each agreed row becomes a clause or schedule, so give counsel the term sheet as the drafting brief and treat any departure in the draft as a reopened point needing the deal owner's sign-off.

• Row 2 becomes Schedule A plus a data dictionary for the delivery.
• Rows 11 and 12 become the delivery specification and the acceptance annex.
• Row 15 becomes a disclosure schedule filled from the data provider due diligence questionnaire. The FISD Alternative Data Council's illustrative questionnaire, for example, asks providers for a data dictionary, a small sample, and the consent terms agreed with the individuals concerned [21].
• Row 13 for recurring purchases moves into a master agreement with order forms.
• Sign-off follows your internal approvals for a data purchase; counsel can triage the draft with reviewing an AI data license as in-house counsel.

When SourceX sources the dataset, rows 2, 3, 8 and 11 map onto its license, which defines which records are included, what they can be used for, how long the license runs and how delivery happens; rights review first checks that the business owns or may share the records and that required consents are in place. SourceX does not publish prices; terms are agreed per deal in writing. Bring your filled rows when you describe the dataset you need to SourceX; nothing is contracted until a supplier agrees. For the vocabulary behind each row, see AI data license terms explained and the AI training data licensing hub.

Term sheet errors that resurface in redlines

Most term sheet failures are ambiguities that each side reads in its own favor until drafting forces a choice:

• Unclear binding status. No "subject to contract" line, or deliveries starting before signature, invites argument over whether the term sheet itself is the deal.
• A price with no unit. "Per record" without saying whether a record is a thread or a message, or "per token" without naming the tokenizer, reopens price at every refresh.
• The listing as the definition. The Data Provenance Initiative found license omission above 70% and license error rates above 50% on popular dataset hosting sites [5]; hosting metadata cannot stand in for Schedule A and upstream licenses.
• "AI use" as the grant. It merges training with retrieval and display, which the market increasingly prices apart [4].
• Survival deferred. "Treatment of trained models to be agreed" hands row 9 to the drafting stage, where whichever side holds the paper sets the opening position.

This page is general information, not legal advice. Confirm requirements with counsel for your jurisdiction and use case.

Bring your term sheet positions to a data request

Describe the data you need and the rows that matter most: the training acts, the models covered and what must survive the license. SourceX looks for US companies that hold that data, checks the data and the supplier's licensing permissions, and manages the license in which pricing and allowed uses are agreed. Submit your licensing requirements.