Manufacturing
Can manufacturers license NCR records for AI training?
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
Yes, manufacturers can usually license NCR records for AI training if three checks pass: customer references can be removed or are permitted, the parts are not customer-owned designs or export-controlled, and personal data about inspectors, operators and contacts is removed. The most useful NCRs link the defect description to disposition, root cause and corrective action.
Key takeaways
- NCRs pass the first check when customer names, part numbers and drawings can be removed or the customer's contract permits use.
- NCRs on customer-owned designs or export-controlled parts fail the ownership check and stay out.
- Inspector, operator and customer contact details are removed or coded during preparation.
- Dispositions, root causes and linked corrective actions carry most of the value.
- Attachments such as photos and marked-up drawings need their own review.
The three-check box#
The three-check box tests customer references, part ownership and personal data, and a set of NCRs needs to pass all three before it is scoped. Each check has a usual fix when the first answer is not clean.
Run the checks on groups of NCRs, such as by customer, product line or period, rather than on the whole archive at once. A single restrictive customer should remove that customer's records, not stop the review.
| Check | Passes when | Needs work when | Usual fix |
|---|---|---|---|
| Customer references | Customer names, part numbers and specs can be removed, or contracts permit use | Quality agreements bar outside use of anything referencing the customer | Code identities, or exclude that customer's NCRs |
| Part ownership | Parts are the company's own designs, or the customer allows use | Parts are customer-owned designs or export-controlled | Exclude those NCRs in full |
| Personal data | Names and IDs sit in known fields | Names appear in free text, signatures and photos | Replace with role codes and review free text and images |
What makes an NCR record license-ready#
An NCR record is license-ready when it shows the full decision: what was wrong, how it was found, what the review board decided, why it happened and what changed afterward. A defect code with no disposition or cause tells an AI developer very little.
Material review board notes deserve special attention. They often record the argument for a use-as-is or repair decision, including the engineering judgment and the risk accepted, which is the reasoning structured fields leave out.
- Defect description in plain language, not just a code.
- Detection point: receiving, in-process, final inspection, customer or field.
- Disposition: use as is, rework, repair, scrap or return to supplier, with the reason.
- Root cause analysis and the method used, such as five whys or a fishbone review.
- Link to the corrective action and evidence that it worked.
- References to the job, lot, part revision and work center involved.
Where NCRs live and how they export#
NCRs live in a quality management system, an ERP quality module, spreadsheets or paper tags, and many manufacturers have used more than one of these over the years. The export route and the attachment question differ for each.
Structured quality systems usually export NCR fields to a spreadsheet or database extract, but attachments may need a separate pull. Spreadsheet logs often hold the richest free text yet lack links to jobs. Paper tags and review board minutes need scanning, so a practical start is the digital years, adding paper only if a buyer asks.
Whatever the source, document the defect and disposition codes used in each period. Codes change when systems change, and a buyer needs a mapping to read a long history as one set.
Supplier NCRs and customer complaints carry extra checks#
Supplier NCRs and customer complaints carry extra checks because they name other companies and, often, individual people. A supplier NCR identifies the vendor and may sit under a supply agreement with confidentiality terms; a customer complaint usually includes a contact name, an email thread and the customer's own account of the problem.
Both can still be useful. Supplier names can be coded consistently so patterns across lots remain visible, and complaint records can be reduced to the problem, the investigation and the response. Where a complaint is part of an open dispute, warranty claim or legal hold, leave it out until it is resolved.
Illustrative: a pump components maker runs the three checks#
Illustrative: a fictional maker of pump housings, impellers and shafts sells its own catalog components and also machines parts to customer drawings. NCRs moved from a spreadsheet log into a quality module during an ERP upgrade, and corrective actions are tracked in the same module.
The customer reference check passes for catalog parts and most build-to-print customers, but one customer's quality agreement bars outside use. The ownership check removes every NCR for that customer's parts and a small group of parts made for a defense program. The personal data check finds inspector names in free text and signatures in scanned photos.
The company scopes catalog and permitted build-to-print NCRs with linked corrective actions, codes customer and supplier names, replaces inspector names with role codes and holds back photo attachments for now. The older spreadsheet log is included as a separate, documented period with fewer links.
Mistakes that slow an NCR license down#
The mistakes that slow an NCR license down are mostly preparation shortcuts that create rights or privacy problems later. Each is easy to avoid once it has a name.
Most of these come from rushing preparation. Agreeing the scope in writing first, then running a sample export through the three checks before the full extract, catches them while they are still cheap to fix.
- Exporting attachments in bulk without checking for drawings, labels and customer marks.
- Removing names from fields but leaving them in free-text descriptions and approvals.
- Editing old dispositions or root causes to look tidier before export.
- Mixing customer complaint emails into NCR exports without review.
- Forgetting NCRs on export-controlled parts that sit in the same quality system.
Which license terms matter most for NCR records?#
The license terms that matter most for NCR records are the ones that protect customers, suppliers and the company's reputation after delivery: permitted use, a ban on re-identification, confidentiality and what happens at the end of the term. They are negotiated deal by deal, with counsel reviewing the final wording.
The right terms depend on the records, the buyer and the contracts already in place, so the table is general information, not legal advice.
| Term | What it does | Why it matters for NCRs |
|---|---|---|
| Permitted use | Limits use to model training and evaluation | Stops records being republished or used to profile suppliers |
| No re-identification | Bars attempts to recover coded names or parts | Protects the customers, suppliers and staff behind the codes |
| Confidentiality | Treats the package as confidential information | Keeps quality history out of public view |
| Term and deletion | Sets how long the buyer may hold the records | Gives a clear end point for retained copies |
| Exclusivity | Decides whether others may license the same records | Affects future options for the same archive |
How SourceX approaches NCR records#
SourceX maps the three checks onto its process. The fit check asks only for metadata: which quality systems hold NCRs, how many years they cover, whether they link to corrective actions and which customers have restrictive quality agreements. Within the SourceX five-step transaction of Supply, Rights, Preparation, Approval and Delivery, the customer reference and ownership checks run during Rights and the personal data check runs during Preparation.
Nothing is delivered until the manufacturer signs off on the final scope. The privacy record in the SourceX Evidence Packet documents how names, contacts and images were handled, alongside provenance, licensing rights, permitted use and release authorization, which helps quality leaders answer later questions from customers or certification auditors about what left the company.
Frequently asked questions
Will licensing NCRs expose our quality problems?
NCRs do record problems, which is why they are useful. Coding customer, supplier and part identities, and limiting permitted use in the license, keeps records from being traced to specific customers. The value lies in the reasoning, not in who had the defect.
Are NCR photos useful to AI developers?
They can be, especially for visual inspection models. Photos often show drawings, labels, serial numbers or people, so they need a separate review and may be cropped, blurred or held back from a first package.
Does ISO 9001 record control prevent sharing NCRs?
ISO 9001 requires control of documented information; it does not prohibit licensing. Update your record control procedure to cover approved outside use, so the release runs through your quality system rather than around it.
How many years of NCRs are worth including?
There is no fixed minimum. Several years in a consistent format usually tell a richer story than a longer history with changing fields, and periods before a system change can be included as separately documented sets.
Should CAPA records go in the same package?
Usually, yes. A corrective action shows whether the root cause in the NCR was right and whether the fix held, which completes the decision. CAPAs pass through the same three checks, since they often reference customers and name the people involved.
Can we license NCRs from a plant we have closed?
Yes, if the company still controls the records and someone has authority to approve the release. Closed plants can hold long, complete NCR histories in a retired quality system, so preserve the database and its attachments before servers are wiped.
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.