Derivative works clauses in insurance software contracts: what they allow

What does a derivative works clause actually grant?#

A derivative works clause grants the vendor a license to create new works based on customer data, such as reports, models, benchmarks or enriched data, and often says who owns them. The phrase borrows from copyright law, where a derivative work is a new work based on an earlier one, but in a software contract its reach is set by the agreement's own definitions.

In agency management systems, rating tools and claims platforms, the source data is unusually sensitive: policy details, coverage limits, loss runs, claim notes, renewal correspondence and insured contact details. Because agencies often sign the vendor's standard agreement, the clause can sit unnoticed until the vendor announces an AI feature or receives an inquiry about licensing records.

Anatomy of a derivative works clause#

A derivative works clause has several parts, and each one narrows or widens what the vendor may do. Read them together; a broad grant paired with a tight purpose limit is narrower than it first looks.

Definitions sit behind every element. Terms such as Aggregated Data, De-identified Data and Services are usually defined elsewhere in the agreement, and a narrow definition of Services, for example one limited to the agency management platform, can keep a separate model training program outside the purpose limit.

What the clause usually allows#

The clause usually allows the vendor to use customer data inside its own product work: building reports, tuning features, detecting errors or fraud, and publishing aggregated benchmarks if the wording permits. Where the purpose includes improving the services, training a model that powers a feature for all customers may be argued to fit, depending on the definitions and the data processing terms.

Even then, the grant is usually limited to the vendor. Most clauses do not include a right to sublicense or disclose customer data to third parties beyond subprocessors that help deliver the service, and the confidentiality clause typically restricts disclosure on its own terms.

Watch the definition of Customer Data as well. Some agreements define it to include only what the customer submits, leaving system-generated logs and usage data under separate and often broader vendor rights. Usage metadata about how agencies use the software is more often the vendor's to use than policy and claim content, but it can still contain personal information.

What the clause usually does not authorize#

The clause usually does not authorize handing agency or policyholder records to an outside AI developer, even in modified form. Several separate obstacles tend to stand in the way, and any one of them can be decisive.

A clause written before generative AI was common may also be read narrowly. If AI training was not a use either party had in mind when signing, relying on a general derivative works grant invites dispute with customers who feel surprised.

• 1Licensing raw or lightly edited customer records to a third party, which confidentiality terms usually restrict.
• 2Training third-party models, when the purpose limit is tied to the vendor's own services.
• 3Using personal information beyond the instructions in the data processing terms, where the vendor acts as a service provider.
• 4Treating aggregated data as anonymous when claim notes or emails still contain names, addresses or policy numbers.
• 5Setting aside the Gramm-Leach-Bliley Act privacy rules, state insurance privacy and data security rules, or the agency's own privacy notice to insureds, which may apply regardless of contract wording.

How common AI uses compare#

AI uses fall along a spectrum, and the derivative works clause carries less weight the further a use moves from the vendor's own service. The table reflects a general reading only; contracts differ, so each use should be checked against the actual agreement with counsel.

Illustrative: an agency management vendor reviews its clause#

Illustrative: a fictional vendor of agency management software for independent agencies receives an inquiry about licensing records for AI training. Its standard agreement grants a license to create derivative works of customer data to provide and improve the services, with vendor ownership of aggregated data.

Counsel concludes the clause supports an internal renewal reminder feature but not licensing agency records outside the company. The vendor decides to include no customer data. Instead it scopes its own records: Jira issues, code reviews, release notes and internal support escalations about carrier download failures, after removing agency names and policy numbers quoted in tickets.

The result is a package grounded in records the vendor clearly controls, plus a separate plan to update its customer agreement prospectively, with clear notice, for any future use of agency data.

How SourceX reviews derivative works rights#

SourceX reviews a derivative works clause as one input in the Rights step of the SourceX five-step transaction, alongside confidentiality, data processing terms and the privacy rules that may apply. In insurance software, customer records are excluded by default unless customers have given explicit consent for the specific licensed use.

The SourceX Evidence Packet records the rights basis for every included record type, so a buyer can see whether it rests on company ownership or on documented customer consent rather than on an expansive reading of a general clause.