Vendor AI training vs licensing your own data: who captures the value?

What does it mean when a vendor trains AI on your data?#

A software vendor training AI on your data means the vendor uses records your company created in its product, such as help desk conversations, CRM notes or dispatch logs, to build or improve models. The permission comes from the vendor's contract, which may be spread across terms of service, a data processing addendum and separate AI terms.

The rights rarely sit in one obvious clause. They usually come from definitions that separate customer data from usage or service data, a license letting the vendor use data to provide and improve its services, and a clause letting it keep aggregated or de-identified data indefinitely.

This is general information, not legal advice. Vendor contracts vary widely, so have counsel read the agreements that actually govern your systems.

Vendor training vs licensing your own records#

Vendor training and licensing your own records differ on consent, compensation, control and deletion. In the first case the vendor writes the terms and decides how to use what it collects; in the second your company decides what leaves, on what terms and for how long.

The comparison also shows why this is a question about value, not only privacy. Records that show how your team resolves freight exceptions, diagnoses equipment faults or handles escalations are the same records AI developers look to license. If a vendor already has rights to use them for its own models, part of that value has moved to the vendor without any negotiation.

Where vendor AI rights usually hide in a contract#

Vendor AI rights usually hide in documents customers skim: online terms incorporated by reference, product-specific terms for AI features and the privacy policy. Check each of these, not only the signed order form.

Admins often switch on AI features in a help desk or CRM without legal review. Ask IT for a list of AI features enabled in each major system, because enabling a feature can bring in a separate set of terms.

Public examples show how much the governing document and your plan matter. On August 7, 2023, after criticism of earlier changes, Zoom added a sentence to Section 10.4 of its terms saying it would not use audio, video or chat Customer Content to train its AI models without consent. GitHub's Terms of Service, in Section J on AI features, grant GitHub a license to use AI-feature inputs and outputs to train models, with an opt-out in account settings, and exclude customers under a GitHub Customer Agreement or volume licensing agreement from that training license. Two companies on the same tool can sit under quite different terms.

• 1Online terms of service linked from the order form, which the vendor may update over time.
• 2The data processing addendum, which often defines what counts as customer personal data.
• 3AI feature terms or an AI addendum that applies once someone enables an assistant or copilot.
• 4Acceptable use and API terms, which can limit bulk export of your own records.
• 5Notice provisions explaining how changed terms take effect, sometimes through continued use.

The five-clause check#

The five-clause check is a short read of each vendor agreement that tells you whether the vendor can train on your records and whether you can still license them. Run it first for the systems holding your deepest history, such as the help desk, CRM, ERP or code host.

Record each answer in a simple register listing the system, the contract version and the clause text. The same register becomes evidence in any later rights review and saves counsel from reading the contracts twice.

Does vendor training limit your ability to license?#

Vendor training rarely transfers ownership, but it can still limit your ability to license in three ways. Some terms restrict exporting records in bulk or through the API, which matters when you prepare a delivery. A buyer will ask whether the same records already trained someone else's model, which affects how unique and exclusive they are. And a vendor may hold derived data you cannot recall.

Export limits deserve a close read. Slack's API Terms of Service, for example, say an application offered for use outside its own organization may not use API data to train a large language model or bulk export Slack message and file data unless an additional agreement expressly allows it. That clause governs third-party apps rather than your own admin export, but it shows why the export route should be confirmed before a delivery is promised.

None of this usually ends a licensing project, but it changes the scope. Records created before an AI training clause took effect, or in a system with no such clause, are often the cleaner part of the archive. Your rights review should note which systems carry vendor training rights and from what date.

Illustrative: a freight brokerage reads its help desk terms#

Illustrative: a fictional regional freight brokerage runs loads through a transportation management system and handles shipper and carrier questions in a cloud help desk. While scoping its records for licensing, the COO asks counsel to run the five-clause check on both vendors.

The TMS terms define load records as customer data and give the vendor no training rights. The help desk's online terms include an improvement license and an aggregated data clause, and the support team had switched on an AI reply assistant, which brought in AI feature terms with training enabled by default.

The brokerage turns the setting off, asks the vendor to confirm in writing whether the opt-out covers past data, and exports its full ticket history with attachments. In the licensing scope it discloses the help desk's training rights to buyers and leads with TMS records, which carry a cleaner rights history.

How SourceX treats vendor terms#

SourceX reviews vendor terms during the Rights step of the SourceX five-step transaction, alongside customer contracts and employee notices. The findings feed the licensing rights and permitted use sections of the SourceX Evidence Packet, so a buyer can see which system each record family came from and what that vendor's terms allow.

The fit check itself needs only metadata, such as system names and years of history, so a company can learn whether its records merit a review before asking counsel to read every vendor contract.