Indemnities a data licensor should resist

Which indemnities should a data licensor resist?#

A data licensor should resist indemnities that make it insure the buyer's business. Buyer drafts often ask the supplier to cover any claim arising from the data or its use, which in an AI deal can reach claims about model outputs, products built on the model and regulatory investigations into the buyer.

The working rule is control. Each side indemnifies for the risks it controls: the supplier for its right to provide the records and the preparation it agreed to do, the buyer for how it uses the records and what it builds. Indemnities outside that line are the ones to narrow or refuse.

Accept, narrow or refuse: the checklist#

The checklist below covers the indemnity requests that appear most often in buyer drafts. Positions are typical supplier starting points, and counsel adjusts them to the records, the price and the buyer.

Why model output indemnities are the line to hold#

Model output indemnities are the line to hold because the supplier has no say over training methods, filtering, prompts, product design or how outputs are used. Once records are combined with many other sources, the supplier cannot tell what a model learned from its data, let alone defend a claim about a particular output.

Buyers sometimes recast the request as an IP indemnity: if an output reproduces something from your records, you cover the claim. The better answer is to stand behind the records themselves, meaning your right to license them and the preparation you agreed, and leave output risk with the party that controls the model.

How to narrow IP and privacy indemnities#

IP and privacy indemnities can usually be narrowed rather than refused outright. Narrowing means limiting who can bring the claim, what conduct triggers it and which records it covers.

• 1Third-party claims only, not the buyer's own losses.
• 2Records as delivered, excluding anything the buyer modified, enriched or combined.
• 3Knowledge qualifiers where the supplier cannot verify every record, such as old email archives.
• 4Triggered by breach of the agreed preparation standard, not by any personal detail later found.
• 5Excluded where the buyer used records outside permitted use.
• 6Prompt notice, supplier control of the defense and no settlement without consent.

Why perfection is the wrong privacy standard#

Perfection is the wrong standard for a privacy indemnity, because no preparation process removes every personal detail from large volumes of free text. Presidio, a widely used open-source tool for finding and removing personal information, states in its own documentation that its automated detection cannot guarantee it finds all sensitive information and that additional protections should be used.

A fair indemnity follows a written preparation standard that both sides approved, covering which fields were removed, how free text was handled and what human review took place. If the supplier met that standard, a stray detail is handled through notice and deletion rather than through an indemnity claim.

Caps, survival and insurance#

Caps, survival periods and insurance decide how much an indemnity can actually cost, so negotiate them together with scope. A cap tied to fees received under the license is a common supplier position; buyers may ask for a higher cap for named breaches, such as the rights warranty or confidentiality.

Resist uncapped indemnities in particular. An uncapped privacy or IP indemnity in a license priced for a single delivery can expose the company far beyond what the deal earns. Survival matters too: indemnities that never expire keep a closing or sold company on the hook, so agree a defined survival period.

Insurance may or may not respond to a contractual indemnity. Cyber, technology errors and omissions, media liability and general liability policies treat liability assumed under contract differently, so ask your broker before agreeing. If coverage is not available, that is a reason to narrow the indemnity, not to assume the company can absorb it.

Illustrative: a freight brokerage reworks a buyer's indemnity#

Illustrative: a fictional freight brokerage keeps years of load records, carrier communications and exception notes in McLeod, plus shipper email threads about delays and cargo claims. An AI developer's draft asks the brokerage to indemnify against any claim arising from the data, including model outputs, regulatory fines and retraining costs, with no cap.

Counsel marks up the draft. The brokerage accepts an indemnity for its right to license the records and for breach of the agreed preparation standard, which removes driver names, phone numbers and shipper contact details. It refuses output, fine and retraining indemnities, narrows the IP indemnity to records as delivered and proposes a cap tied to fees received.

The buyer accepts most of the markup and asks for a higher cap limited to breach of the rights warranty. The brokerage agrees after its broker confirms how its policies would respond.

How SourceX approaches indemnities#

An indemnity is only as defensible as the record behind it, so SourceX focuses on documenting the Rights and Preparation steps of the SourceX five-step transaction, which runs Supply, Rights, Preparation, Approval and Delivery. Negotiating the indemnity itself stays with the supplier's counsel.

If a claim ever arises, both sides turn to the SourceX Evidence Packet. Its provenance and licensing rights sections show what the supplier was entitled to license, its privacy record shows the preparation standard that was met, and permitted use and release authorization show what the buyer agreed to and who approved the release.