Data Created Under Government Contracts: Federal Data-Rights Clauses to Check Before Licensing

This page is general information, not legal advice. Confirm requirements with counsel for your jurisdiction and use case.

Why government-funded records need a separate rights check

Federal contract records need their own check because the rights basis is set by a clause in the prime contract or subcontract, not by the supplier's ordinary ownership of its files. A supplier's internal engineering tickets, test logs, CAD revisions and program reports can look like any other operational records covered by copyright, but if they were "first produced in the performance of" a federal contract, the clause text decides who may do what with them. Contractors often run commercial and federal work through the same Jira projects, Git repositories and SharePoint sites, so the federal portion is rarely labeled in a way an export script will catch.

The practical goal for a buyer is narrow. You are not auditing the supplier's compliance with its government customer; you are confirming that the specific records in the license are not subject to a clause, marking or control that the supplier cannot override by signing with you. That fits inside the broader chain-of-title review for AI training data and the general provenance guide for buyers.

Civilian agency contracts: what FAR 52.227-14 changes

Under FAR 52.227-14, Rights in Data-General, the government generally receives unlimited rights in data first produced under the contract, while the contractor's own right to use and release that data is preserved unless the contract or federal export-control and national-security rules say otherwise. The clause (dated May 2014) is prescribed at FAR 27.409(b)(1) for contracts where data will be produced, furnished or acquired, and a contract should generally carry only one data-rights clause; confirm the current clause text and alternates on acquisition.gov, as of October 2026. Unlimited rights for the government do not, by themselves, stop the contractor from licensing the same records to you.

The trap is copyright. In the base clause, a contractor may assert copyright without approval only in limited cases, such as scientific and technical articles published in journals; asserting copyright in other first-produced data typically needs the contracting officer's written permission, and Alternate IV broadens that permission. If the supplier never had permission to assert copyright, its ability to grant you exclusive or enforceable rights in that material is weaker, and the license should be priced and drafted accordingly.

Agency supplements alter the base clause. NASA, for example, modifies it through NFS 1852.227-14, and other agencies add their own alternates or paragraph changes. Ask which supplement applied, because an agency variant may restrict release or publication in ways the FAR text does not.

Two further FAR situations usually end the analysis:

• Special works (FAR 52.227-17). Contracts for manuals, histories, studies or other works the government wants to control can require the contractor to assign copyright to the government and to refrain from using the data for other purposes. Treat these records as excluded unless the contracting officer has released them in writing.
• Government-furnished or third-party data. Data the agency or another contractor handed the supplier is not "first produced" by the supplier at all. It carries its own restrictions and belongs outside the license.

Defense contracts: DFARS rights categories and markings

For Department of Defense work, DFARS 252.227-7013 (noncommercial technical data) and 252.227-7014 (noncommercial computer software) leave ownership with the contractor and give the government a license, most often unlimited, government purpose, or limited rights (restricted rights for software), unless specifically negotiated license rights apply. The level usually follows funding: exclusive government funding generally yields unlimited rights, mixed funding yields government purpose rights, and development exclusively at private expense yields limited (or, for software, restricted) rights. Technical data for commercial products and services generally falls under DFARS 252.227-7015 instead, and commercial computer software is acquired under the vendor's commercial license.

Government purpose rights matter most to buyers. They let the government release data outside the government for United States government purposes only and expressly exclude commercial purposes. That restriction binds the government and its authorized recipients; it does not take away the contractor's own commercial rights, which is why a contractor can often license its government-purpose-rights data to an AI lab while the government cannot.

Markings drive everything downstream. A contractor must apply the prescribed legends to restricted deliverables, and unmarked deliverables can be treated as carrying unlimited rights. A pre-award assertions list under DFARS 252.227-7017 and the government's challenge procedures under 252.227-7037 (technical data) and 252.227-7019 (computer software) are the documents that show which rights the contractor claimed and whether any were contested. SBIR and STTR work uses its own clause, DFARS 252.227-7018, with a protection period that should be checked against the current text.

Classify each record set before you negotiate

The fastest route through a mixed commercial and federal corpus is a per-source classification that sorts each record set into license, license with conditions, or exclude. Build it from the supplier's contract list, not from the data export, because file metadata seldom carries the contract number.

Illustrative example: invented to show structure; it does not describe an available dataset.

Encode the outcome per record so it survives into training pipelines; the rights metadata schema for permitted uses shows one way to carry clause, marking and decision fields alongside each file.

CUI and export controls sit on top of data rights

Even when the data-rights clause allows licensing, Controlled Unclassified Information rules and export controls can independently prohibit sharing the records. 32 CFR Part 2002 sets government-wide rules for safeguarding and disseminating CUI [1], and defense contracts commonly add DFARS 252.204-7012 with NIST SP 800-171 safeguarding. A "CUI" banner, a dissemination control such as NOFORN or FEDCON, or a distribution statement other than "A" on a DoD technical document is a stop sign, not a negotiating point.

Export controls are a second, separate gate. ITAR defines technical data as information required for the design, development, production, manufacture, operation, repair or modification of defense articles [2], and the EAR treats release of controlled technology or source code to a foreign person, including inside the United States, as a deemed export [3]. If your training team, annotators or cloud region include foreign persons, controlled engineering records can create an export even without a shipment. See ITAR and EAR checks for engineering records before accepting any defense-adjacent record set.

Documents to request from the supplier

Ask for the evidence that ties each record set to a clause and a decision, because a supplier attestation alone does not show which contract produced which file. A complete package usually includes:

• Contract inventory. Prime and subcontract numbers, agency, period of performance and the data-rights clause and alternates for each, with flow-down clauses from primes.
• Assertions and markings. DFARS 252.227-7017 assertion lists, sample deliverables showing legends, and any challenge correspondence under 252.227-7037 or 252.227-7019.
• Copyright permissions. Contracting-officer letters granting permission to assert copyright under FAR 52.227-14, or the Alternate IV text.
• CUI and export status. The supplier's CUI marking guide, export classification (USML category or ECCN, or EAR99), and its technology control plan.
• Segregation evidence. How the export was filtered: project keys, repository names, contract charge codes, and a reviewed sample.
• Counsel memo or contracting-officer correspondence wherever the clause, funding source or marking is unclear.

Fold these into a data rights attestation from the supplier so each representation points to a document. The SourceX training data due diligence checklist covers the non-federal items, and the supplier-side view is in licensing data as a government contractor.

Exclude rather than negotiate when obligations survive

Some record sets should leave the license entirely instead of being carved up by contract language. Exclude records where copyright was assigned to the government, where the supplier received the data from the government or another contractor under restrictions, where CUI or distribution-statement controls apply, and where the government holds unlimited rights but a separate confidentiality, nondisclosure or security obligation still binds the supplier. Contract wording between you and the supplier cannot release obligations the supplier owes the government, which is why buyers who describe their data needs to SourceX should state up front that federally restricted records are out of scope.

Remaining risk usually sits in derived material. Summaries, transcripts or embeddings built from excluded records inherit the same problem, so apply the same exclusion to derived records traced back to their source. Contractor staff who produced the records may also raise contractor IP assignment questions that the federal clause does not answer.

Sourcing contractor records for AI training

SourceX sources operational datasets from US companies on request, including engineering records and documents, and manages licensing and ongoing purchases; nothing is held in stock and a request does not guarantee a match. Every dataset is rights-reviewed for ownership and consents, released only with the supplying company's approval, and delivered under a license that defines records, uses, term and delivery. Describe the records you need at the SourceX buyer intake.