IP indemnities for licensed training data: scope, caps and carve-outs

How the data licensor's indemnity fits your liability stack

The indemnity in a data license is the upstream layer of your exposure: it reimburses you for third-party claims about the data, while your own customers may expect you to absorb claims about the models built from it.

If you are that vendor, your data licenses are the contracts through which you pass claims about the data back upstream. NIST's Generative AI Profile lists intellectual property and value chain and component integration among generative AI risks [1]; a licensed dataset is one such component.

Map three things before redlining: what you indemnify customers for, what each licensor indemnifies you for, and the gap you carry yourself.

A warranty works differently: its breach gives you a claim for your own provable loss, usually inside the cap, while an indemnity responds to a third party's claim and funds the defense from the start. The licensor's promise that it may license the data for training belongs in data warranties for AI training licenses; the indemnity pays when that promise proves wrong. SourceX's glossary defines indemnification and warranty of title.

Third-party claims the indemnity should name

Name each claim type, because a clause limited to "infringement of intellectual property rights" leaves out privacy statutes, deceptive-practice claims and breaches of the supplier's own contracts, which are often likelier against operational business records. Cover claims arising from the Licensed Data as delivered and from your licensed use of it, so the licensor cannot recast a training claim as a claim about your conduct.

These rulings turn on their own records, and ROSS concerned a non-generative tool [3], so allocate the risk in writing rather than predict outcomes. Whether you need a license at all is covered in licensing versus relying on fair use.

Exclusions to accept, narrow or refuse

Accept exclusions for losses you cause, narrow the combination and output exclusions that licensors import from software indemnities, and refuse any exclusion for training itself, because training is the licensed use.

Expect to give a reciprocal indemnity for use beyond the license, re-identification attempts and products you build; keep it parallel in structure and cap. Under California's CCPA, information counts as deidentified only if, among other conditions, the business contractually obligates recipients to comply with the definition, including its bar on re-identification [11]. Expect a no-re-identification covenant backed by your indemnity; see de-identified versus anonymized legal definitions.

Caps, super-caps and uncapped IP indemnities

A general cap set at fees paid over the prior twelve months rarely reflects IP exposure on training data, so negotiate the IP indemnity outside it: uncapped, under a separate super-cap, or capped at insurance the licensor actually holds. One class settlement over books allegedly downloaded from pirate libraries and used for training received final approval in July 2026 [4]; a cap equal to a modest license fee measures the licensor's appetite, not your risk.

Three drafting points change what any cap is worth:

• Consequential-damages carve-out. Exclude indemnified third-party amounts from the waiver of indirect and consequential damages, or a judgment against you can be recast as your consequential loss.
• Losses that include retraining. Define Losses to include purging the data from pipelines and retraining or replacing a model when a judgment, injunction or settlement you approved requires it. What happens to trained models when a license ends covers the model side.
• Survival. The indemnity should survive expiry and termination for at least the limitation period of the covered claims; claims about training surface long after delivery.

The wider limitation-of-liability structure is covered in liability caps and super-caps in data licensing.

Defense control, notice and settlement consent

The licensor normally controls the defense of a claim it indemnifies; you need a notice rule that forgives harmless delay, a right to join with your own counsel, a step-in right if it stalls, and a veto over settlements that touch your models.

• Notice. Notify promptly in writing; late notice reduces the licensor's obligation only to the extent the delay materially prejudiced the defense. The GPAI Code of Practice's copyright chapter has signatories set up a point of contact and complaint mechanism for rightsholders [12], so route complaints that name licensed data from that channel to the licensor.
• Assumption. The licensor confirms within a fixed period that it assumes the defense without reservation; if it reserves or declines, you control the defense and it reimburses costs once coverage is established.
• Conflicts. If the licensor's defense is that your use exceeded the license, you need separate counsel at its expense.
• Settlement consent. No settlement without your written consent if it admits fault for you, requires you to stop using, delete, retrain or modify a model, imposes ongoing payments or conduct obligations on you, or does not release you fully. A settlement that releases the licensor but not the models you trained leaves you exposed.
• Remedy ladder. Indemnities borrowed from software contracts let the indemnitor procure a license, replace the item, or terminate and refund. Replacement data does nothing for a trained model, so any license the licensor procures must cover models already trained, and a refund must not end the indemnity for past use.
• Cooperation. Keep manifests and training-run logs; the licensor will ask for them, and they prove in-scope use.

Duties an indemnity cannot transfer

An indemnity moves money, not obligations, so regulatory duties and non-monetary remedies stay with you whatever the licensor promises. Three examples, as of October 2026:

• EU AI Act Article 53. Providers of general-purpose AI models must keep a copyright policy that identifies and complies with text-and-data-mining rights reservations under Article 4(3) of Directive (EU) 2019/790, and publish a training-content summary using the AI Office template [13]. An indemnity can fund a rightsholder's suit but cannot discharge them.
• Model deletion. FTC staff note that the agency has required companies that unlawfully obtained consumer data to delete models and algorithms developed in whole or in part with it [14]. Money does not restore a deleted model.
• Purchaser records. The Washington My Health My Data Act places the six-year authorization record duty on the purchaser as well as the seller [8].

When the licensor cannot fund the promise

An indemnity is worth what the indemnitor can pay when the claim arrives, often years after signing, so test the licensor's capacity and, when it is thin, combine some of these:

• Insurance. Require IP or media liability coverage of a stated amount through the survival period and confirm the policy does not exclude licensing data for AI training.
• Holdback or escrow. Retain part of the fees through the survival period, released on schedule if no claim arrives.
• Guarantee. Ask for a parent guarantee when the licensing entity is a thinly capitalized subsidiary.
• Set-off. In multi-delivery deals, set indemnified amounts off against future fees.
• Smaller exposure. Exclude third-party content categories from the delivery, require a data rights attestation, test the supplier's provenance claims on a sample, and price the residual risk.

Diligence lowers the chance of a claim but does not replace indemnity terms. When SourceX sources a dataset from a US company, rights review checks that the business owns or may share the records and that required consents are in place, and diligence materials covering source, rights, preparation and allowed use are prepared per dataset for the buyer's review. You can describe the data you need and the rights evidence you expect.

A clause skeleton to mark up against the licensor's draft

The skeleton below combines the positions above so counsel can compare a licensor's first draft against it; bracketed values are deal-specific.

Illustrative example: invented to show structure; it does not describe an available dataset. Not legal advice; adapt with counsel.

12.1 Licensor indemnity. Licensor will defend Licensee and its affiliates
     and pay all Losses arising from any third-party claim that the Licensed
     Data, or Licensee's use of it in accordance with this Agreement
     (including to train, fine-tune, evaluate and deploy Trained Models),
     (a) infringes or misappropriates any copyright, trade secret or other
     intellectual property right; (b) violates any privacy, biometric,
     consumer-health or consumer-protection law; or (c) breaches any
     contract, license or terms of service binding Licensor.

12.2 Exclusions. 12.1 does not apply to the extent a claim results from
     (a) use outside the Permitted Field; (b) modification by Licensee other
     than Permitted Processing; (c) combination with materials not supplied
     by Licensor, where the claim would not have arisen but for the
     combination and is not based on the Licensed Data; or (d) outputs
     generated after Licensee disabled the Output Controls in Schedule [X].

12.3 Losses. Losses include damages, settlement amounts, reasonable
     attorneys' fees, and costs to remove Licensed Data from pipelines and
     to retrain or replace a Trained Model where a final judgment,
     injunction or settlement approved under 12.5 requires it.

12.4 Procedure. Licensee will notify Licensor promptly; delay reduces
     Licensor's obligations only to the extent of material prejudice.
     Licensor will confirm within [14] days that it assumes the defense
     without reservation; otherwise Licensee may control the defense at
     Licensor's cost. Licensee may participate with its own counsel.

12.5 Settlement. Licensor will not settle any claim without Licensee's
     prior written consent if the settlement admits fault by Licensee,
     requires Licensee to cease using, delete, retrain or modify any
     Trained Model, imposes on Licensee any payment Licensor does not fund
     or any conduct obligation, or does not fully release Licensee.

12.6 Limits and survival. Obligations under 12.1 are [uncapped] [subject to
     a separate cap of USD [X]], sit outside Section [Limitation of
     Liability], including its exclusion of indirect damages, and survive
     for [the applicable limitation period].

For the rest of the agreement, use the AI data license negotiation checklist, the data license term sheet and the AI training data licensing hub. Counsel triaging a whole deal can start with reviewing an AI data license as in-house counsel; SourceX's guide to AI data licensing agreements explains each clause in plain words.

This page is general information, not legal advice. Confirm requirements with counsel for your jurisdiction and use case.

Need licensed training data with its rights reviewed?

Describe the data you need and the uses your license must cover. SourceX looks for US companies that hold that data, checks the data and each supplier's licensing permissions, and manages the license in which pricing and allowed uses are agreed; nothing is contracted until a supplier agrees. Submit your licensing requirements.