Skip to content

Manufacturing

Do OEM supplier terms and conditions restrict how you use production data?

By SourceX Editorial · Reviewed by Noah Loul ·

Short answer

OEM supplier terms and conditions often restrict how you use production data tied to a customer's parts, through confidentiality, intellectual property, data rights, record retention and disclosure or AI clauses. Decision rule: exclude, or get written consent for, any record containing customer information or defined as customer property; send internal decisions stripped of customer identity to counsel for review.

Key takeaways

  • Purchase orders often incorporate the customer's standard terms by reference, so the binding text may sit on a portal rather than in a signed contract.
  • Confidentiality clauses can define customer information broadly enough to cover specifications, part data and quality submissions.
  • Some intellectual property clauses assign work product, tooling data or data generated in performance to the customer.
  • Records of your own decisions, with customer identity removed, are the usual starting point for a licensable scope.
  • Each customer's terms are assessed separately, deal by deal, with counsel.

Where do OEM terms that bind a supplier actually live?#

OEM terms that bind a supplier usually live in several documents at once, and the one that matters most may never have been signed. Many purchase orders incorporate the customer's general terms of purchase by reference to a website or supplier portal, which means accepting the order accepted the terms.

Order of precedence clauses decide which document wins when two conflict, and where your quotation terms and the customer's purchase order terms clash, contract law rules on conflicting forms may decide which terms apply. Terms are also revised over time, so collect the versions that governed each period of records in scope, not just today's text.

  • The customer's general terms and conditions of purchase.
  • Individual purchase orders and any documents they incorporate.
  • Long-term supply agreements and pricing agreements.
  • Supplier quality manuals, quality agreements and, for automotive work, the customer-specific requirements that IATF 16949 suppliers work to.
  • NDAs signed during quoting or development work.
  • Portal terms accepted when submitting PPAP files, 8D responses or shipping notices.
  • Your own quotation terms and terms of sale, which may reserve rights in your know-how and process data.

Which five clause types should you search for?#

Five clause types decide most of the answer, and each can be found with a short keyword search across the collected documents. Read the definitions behind each one, because the reach of a word such as information or data is usually set in a definitions section, not in the clause itself.

Watch for flow-down language too. A tier-one customer may pass its own OEM's terms down to you, so a supplier two steps removed from the vehicle or machine maker can inherit restrictions written for a different relationship. Flow-down clauses often point to documents you have never seen, so ask for copies.

A clause that restricts disclosure does not always restrict internal use, and a clause that assigns ownership of drawings does not necessarily reach your labor tickets. The exact wording and definitions decide the reach, which is why this review belongs with counsel.

Which five clause types should you search for?
Clause typeSearch termsWhat it can restrict
Confidentialityconfidential information, proprietary, non-disclosureSharing specifications, drawings, part data, pricing and anything the customer marks or defines as confidential
Intellectual property and work productwork product, deliverables, inventions, tooling, assignmentUse of designs, tooling data, process developments or data created for the customer
Data and information rightsdata, information, records generated, production dataUse of data produced while performing orders, sometimes including quality and test data
Records, audit and retentionrecords, retention, audit, access, destructionDeleting, moving or copying records the customer may need to inspect later
Disclosure, publicity and AIthird parties, publicity, artificial intelligence, machine learningDisclosure to third parties, naming the customer, or putting customer information into AI tools

How do you apply the decision rule to each record family?#

The decision rule sorts each record family into exclude, consent or review, applied customer by customer. A shop with many customers usually finds that a few strict sets of terms shape most of the carve-outs, while the rest raise fewer issues.

A review status means counsel reads the relevant terms and the preparation step removes customer names, part numbers and any quoted requirements. Records that cannot be separated from customer information stay out of scope.

Record each decision in a simple rights file: the customer, the documents reviewed, the clause relied on, the status of each record family and the reviewer. That file becomes the basis for the licensing rights section of any evidence a buyer later asks to see.

How do you apply the decision rule to each record family?
Record familyTypical statusWhy
Customer drawings, models and specificationsExcludeUsually customer property or confidential information
PPAP, first article and inspection data against customer characteristicsExclude or seek consentBuilt directly from the customer's specifications
Customer-required 8D and corrective action responsesSeek consent or reviewOften submitted under the customer's quality terms
Internal NCRs, scrap reasons and rework decisionsReviewYour decisions, but notes may quote customer requirements
Scheduling, expedite and capacity decisionsReview, often licensableInternal operations once customer identity is removed
Maintenance and equipment historyUsually licensable after reviewRarely touches customer information

What if the customer's terms say nothing about data?#

Terms that say nothing about data do not automatically leave you free to license it. A broad definition of confidential information can still capture production information about the customer's parts, and trade secret law or implied obligations may apply depending on the facts.

Trade secret law is the main reason for caution. Under the federal Defend Trade Secrets Act, information qualifies as a trade secret only if its owner took reasonable measures to keep it secret and it has independent economic value from not being generally known. A customer's confidentiality terms are often one of those measures, so disclosing its protected specifications could raise a misappropriation claim as well as a contract claim.

Where terms are silent, a cautious approach removes customer identity, excludes anything derived from customer drawings or specifications, and records the reasoning in the rights file. Some suppliers also ask strategic customers for written consent even when counsel considers it unnecessary, because the relationship is worth more than the extra scope.

Illustrative: a tier-two supplier sorts its customer terms#

Illustrative: a fictional tier-two supplier of machined brackets and housings sells to several industrial equipment makers and one automotive customer. Its general counsel collects the purchase terms, quality manuals and NDAs for every customer with meaningful volume during the years in scope.

The automotive customer's terms define confidential information to include all data the supplier generates in performing orders, so every record tied to that customer is excluded. Most equipment makers' terms cover drawings and specifications but say nothing about internal operating records. For those customers, the supplier keeps scheduling, scrap and maintenance decisions after replacing customer names and part numbers with codes, and excludes inspection data built from their prints. The CEO approves the narrower scope rather than seeking consent.

Can you negotiate better terms for future orders?#

Suppliers can sometimes negotiate narrower clauses, though large OEMs rarely rewrite standard terms for smaller suppliers. Definitions and carve-outs are more realistic targets than whole clauses, and a supply agreement renewal or a new program award is the natural moment to ask.

  • Limit confidential information to material the customer provides or marks as confidential.
  • Carve out the supplier's general know-how, process improvements and internal operating records.
  • Confirm that aggregated or de-identified operational data, with no customer identity or specifications, remains the supplier's to use.
  • Clarify that AI tool restrictions apply to customer information, not to the supplier's own records.
  • Keep a dated copy of every version of portal terms you accept.

How SourceX handles customer terms#

SourceX handles customer terms in the Rights step of the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. The supplier and its counsel identify the governing documents, and the licensable scope is agreed before any record is prepared.

The SourceX Evidence Packet then records the licensing rights and permitted use for each record family, including which customers and record types were carved out and who authorized release. Customer-owned designs and export-controlled work are excluded from manufacturing packages as a matter of course.

Frequently asked questions

Do OEM terms still apply to records created years ago?

They can. Confidentiality obligations often survive the end of an order or agreement, and protection for trade secrets may last as long as the information stays secret. Check which version of the terms governed the period in question and whether survival clauses keep obligations alive after the relationship ended.

If we remove the customer's name, can we use the records?

Not always. Removing identity helps with confidentiality, but it does not cure an ownership or assignment clause, and dimensions or product descriptions can identify a customer's part even without a name. Counsel should decide whether de-identification is enough under each customer's terms.

Should we tell customers we are considering data licensing?

That is a business and legal judgment. Some suppliers inform or seek consent from strategic customers to protect the relationship; others rely on a scope that excludes all customer information. Either way, record the decision and the reasoning in the rights file so it can be explained later.

Do these terms affect internal AI tools too?

Potentially, yes. Uploading customer drawings or specifications to a public chatbot can breach confidentiality or AI-use clauses even if nothing is ever licensed. A written AI use policy that keeps customer material out of external tools reduces that risk and shows customers you take their terms seriously.

What about records for export-controlled parts?

Records connected to export-controlled work are excluded from manufacturing data licensing packages. Rules such as ITAR and EAR may apply to technical data about those parts, and their handling should be assessed with export control counsel rather than through a general licensing review.

Sources

  • Under 18 U.S.C. 1839(3), information is a trade secret only if the owner has taken reasonable measures to keep it secret and it derives independent economic value from not being generally known or readily ascertainable. Source

Related resources

See if your company qualifies

A short company assessment. No data uploads are needed.

See if you qualify