Rights and contracts
Supplier quality agreements and sharing NCR and CAPA data
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
Supplier quality agreements often make NCR and CAPA records about a customer's parts that customer's confidential information, so the records rarely leave the plant as written. The reasoning inside them often can, once customer names, part numbers, drawing references and specifications are removed. The rule: any field that reveals the customer or the part becomes a neutral category.
Key takeaways
- Supplier quality agreements often define quality data about a customer's parts as confidential, so NCR and CAPA records need a rights review before any licensing.
- Replace customer names with industry categories and part numbers with consistent surrogate keys; remove drawing references and nominal values.
- Internal NCRs on your own processes carry fewer restrictions than customer-originated corrective action requests and 8D reports.
- Confidentiality terms often survive the end of a program, so records from closed programs are not automatically unrestricted.
- Photos, CMM reports and export-controlled work are excluded by default.
Can a manufacturer license NCR and CAPA records covered by a quality agreement?#
A manufacturer can rarely license NCR and CAPA records in their original form when a supplier quality agreement covers them, because those agreements typically treat quality data about the customer's parts as confidential information. What can often be licensed is the problem-solving record underneath: the defect description, the containment steps, the root cause analysis and the corrective action, with the customer and the part made unrecognizable.
Most shops sit on both sides of these agreements. Customers impose quality agreements on you, and you impose your own on the suppliers of castings, coatings or heat treatment. Records created under each relationship carry different obligations, so the first job is to sort NCRs and CAPAs by which relationship produced them.
Quality management standards such as ISO 9001 and IATF 16949 shape how records are kept and controlled, but the duty of confidentiality toward a customer usually comes from contracts: the quality agreement, the supply agreement, the NDA and the terms printed on purchase orders.
Quality agreement clauses that decide what can be licensed#
The clauses that matter most are the confidentiality definition, the use restriction and the survival terms; ownership and return-or-destroy language come next. Read the customer's executed version, not the template the sales team remembers, because large customers often pull their own supplier quality manuals into the agreement by reference.
Silence is not permission. An agreement that never mentions AI or licensing still restricts use through its general confidentiality and purpose language, so counsel should read each one against the specific scope you plan to license.
| Clause | What it often says | What to check before licensing |
|---|---|---|
| Definition of confidential information | Covers drawings, specifications, inspection results and quality data about the customer's products | Whether de-identified process records still fall inside the definition |
| Use restriction | Information may be used only to perform the agreement | Whether licensing derived records counts as a use outside the agreement |
| Ownership of records | Quality records about the customer's parts belong to the customer or must be produced on request | Whether the shop holds its internal NCR and CAPA files in its own right |
| Incorporated documents | The customer's supplier quality manual applies | Confidentiality or data terms buried in the incorporated manual |
| Survival | Confidentiality survives termination for a stated period or indefinitely | Whether obligations for finished programs are still live |
| Return or destroy | Confidential information is returned or destroyed on request or at termination | Whether a request was made and records should already be gone |
Where customer and part identity hides inside a quality record#
Customer and part identity hides in far more fields than the customer name. An NCR exported from a QMS typically carries the customer part number, the drawing number and revision, the purchase order, lot and heat numbers, the failed characteristic with its nominal value and tolerance, and attachments such as inspection reports and photos.
Free text is the hardest part. Quality engineers write the customer's program name or a line from a drawing note straight into the root cause narrative, so field-level redaction alone is not enough; the narrative needs its own pass.
- Header fields: customer name, customer part number, the internal part number cross-referenced to it, program or platform name.
- Document references: drawing number and revision, specification callouts, purchase order and release numbers.
- Measurement data: nominal dimensions, tolerances and actual readings that could reconstruct design intent.
- Customer correspondence: supplier corrective action requests, complaint numbers and 8D reports sent back to the customer.
- Traceability data: lot, heat, serial and date codes a customer could match to its own receiving records.
- Attachments: photos showing part markings or logos, CMM reports, marked-up drawings and customer scorecards.
The redaction rule for customer and part identifiers#
The redaction rule is simple to state: replace anything that identifies the customer or the part with a neutral category, and keep the reasoning. A buyer studying how manufacturers solve quality problems needs to know that a bore ran oversize on a machined aluminum housing after a fixture change, not whose housing it was or what the drawing called for.
Use the same surrogate key for a part across every record. When the NCR, the CAPA it triggered and the later audit finding all point to the same placeholder, the dataset keeps its most useful property: a traceable chain from problem to fix.
| Field | Treatment | Why |
|---|---|---|
| Customer name | Replace with an industry category such as agricultural equipment OEM | Keeps context without naming the account |
| Customer part number | Replace with a consistent surrogate key | Preserves the link from NCR to CAPA to effectiveness check |
| Drawing number and revision | Remove | Points directly to customer-owned design documents |
| Nominal values and tolerances | Remove, or state only the direction of the deviation | Exact values can reveal the design |
| Defect description and root cause | Keep after a free-text scrub | This is the expertise a buyer wants |
| Containment and corrective actions | Keep after a free-text scrub | Shows decisions and their outcomes |
| Supplier names on your own NCRs | Replace with a category such as heat treater | Your suppliers' agreements may restrict disclosure too |
| Photos and CMM reports | Exclude by default | Hard to scrub reliably and often show part geometry |
Which quality records carry the fewest restrictions?#
Internal NCRs on your own processes carry the fewest restrictions. Scrap and rework caught in-process, machine-related nonconformances, gage calibration failures and preventive maintenance findings describe your operation, even when the part on the machine was built to a customer's design.
Customer-originated records carry the most. A supplier corrective action request, a customer complaint and the 8D report you returned were created inside the customer relationship and often reference the customer's own investigation, so many shops exclude them rather than try to scrub them.
Records about your own suppliers sit in between. You are the customer in those agreements and may hold broad rights, but the supplier's identity and its proprietary process details still deserve the category treatment.
A fixed sorting order keeps the work auditable and stops a restricted record from slipping back in through a linked CAPA or audit finding.
- Tag every NCR and CAPA by origin: internal process, customer-originated, or supplier-related.
- Join each record to its customer through the job, part or purchase order number, then apply that customer's contract outcome.
- Drop every record tied to an excluded customer or export-controlled program, including linked CAPAs, 8D reports and audit findings.
- Apply the identifier rule to what remains and give each narrative its own free-text pass.
- Have the quality manager review a sample from each origin group before the COO approves the scope.
Illustrative: a contract machining shop sorts its quality history#
Illustrative: a fictional contract machining shop runs Epicor for jobs and purchasing and a cloud QMS for NCRs, CAPAs and internal audits. Most of its work is build-to-print for industrial equipment makers, plus a small aerospace program.
The COO sorted quality records by origin. The aerospace program came out entirely because its parts carried export-control markings. Counsel found that the largest equipment customer's supplier quality manual barred any use of quality data outside the agreement, so that customer's records came out too. The remaining internal NCRs and CAPAs went into scope with customer names replaced by industry categories, part numbers replaced by surrogate keys, and every photo and CMM report removed.
The package was smaller than the QMS export suggested, but every record in it had a documented basis, and no customer's drawing reference left the building.
How SourceX handles quality records#
SourceX works through quality records with the SourceX five-step transaction: Supply, Rights, Preparation, Approval and Delivery. The Rights step reviews the quality agreements, supply agreements and purchase order terms that cover each customer, and the Preparation step applies the identifier rule before anything is delivered.
The SourceX Evidence Packet ties the work together: provenance and licensing rights show which agreements were reviewed and which customers and programs were excluded, the privacy record shows how identifiers were replaced, and permitted use and the release authorization show what the supplier approved. Customer-owned designs and export-controlled work stay out.
Frequently asked questions
Does an expired quality agreement still restrict our NCR records?
Often, yes. Confidentiality clauses in quality and supply agreements commonly survive termination, sometimes without an end date. Check the survival clause and any return-or-destroy request before treating records from a finished program as unrestricted, and keep the analysis with the rights record for the package.
Can we license CAPA records about our own suppliers' failures?
Usually more easily than customer-related records, because you are the customer in those relationships and your agreements may give you broad rights. Replace supplier names with categories anyway and remove their proprietary process details, since a supplier's NDA or terms may still limit disclosure.
Is aggregated quality data safer than raw NCR records?
Aggregates by process, material or defect category reveal less about any one customer and are often easier to clear. They also carry less of the reasoning AI developers value. Many packages pair de-identified narratives for depth with aggregated tables for breadth.
Do we have to tell customers if we license de-identified quality data?
That depends on the agreements and the relationship. Some quality agreements require notice of any disclosure; others say nothing. Even where notice is not required, some manufacturers tell key customers to protect the relationship. Decide with counsel and record the decision.
What about records from customers that have gone out of business?
A customer's closure does not automatically end its rights. Its contracts and confidential information may have passed to an acquirer, a lender or a bankruptcy estate. Treat those records like any other customer's until counsel confirms who holds the rights.
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.