You can use licensed company data to train a machine learning model when your licence grants that use in writing, and as far as it grants it. This guide sets out what a licence has to say for four uses: training a model, evaluating one, retrieval at answer time by an assistant or an agent, and keeping a trained model after the term ends. It gives the clause and the question for each, an illustrative example, and what official bodies and licence stewards have published, with dates and status. It reports what those bodies say and is not legal advice.
When you can use licensed company data to train a machine learning model
You can train on licensed company data when the agreement names training among the permitted uses, or covers it in terms, and when the model and its outputs stay within the use you licensed. Where the text is silent, ask before you build. Silence is read differently by each party, and a trained model cannot be handed back like a file.
Three layers decide. The law of the places where you copy and use the data sets the background: copyright, database rights, trade secrets and data protection. Upstream licence terms travel with the data. The agreement with your vendor records what the two of you agreed, and where the law on training is still moving, it is the layer both sides control. The post on what a data licence covers separates internal use, embedding and redistribution. A model touches all three, and the clauses below are the ones it adds.
Data licence agreement terms that grant machine learning training rights
The terms that grant machine learning training rights name the use, the data it covers, who may run it, where the model and its outputs may go, and what survives the term. A clause that says only internal use leaves each of those points to interpretation, so ask for each one in words.
Ask every vendor the same questions and keep the answers with the signed data licence.
| Use | Clause that governs it | Ask, then put in writing |
|---|---|---|
| Training a model you own | Grant of use; derived data | Does the use include training and fine-tuning? Name it, with the datasets covered |
| Training by a contractor or on a hosted model | Licensee; service providers | May they process the rows for you? Name them, and that they keep nothing for their own models |
| Evaluation | Grant of use; publication | May rows form a test set, and may results be published? Say in what form |
| Retrieval at answer time | Embedding; display | May an assistant show values, and to whom? Name retrieval, the users and the credit shown |
| An agent acting for your customer | Redistribution | Is the agent a user of your product or a recipient of the data? Write down which |
| Model outputs and weights | Derived data | Are scores and generated text yours, and may weights be shared or sold? State both |
| End of term | Deletion; survival | What is deleted and what survives? List each artefact |
| Provenance | Warranties; upstream terms | Which upstream terms and credits travel with the rows? List them |
The AI training clause: data provenance and restrictions upstream
An AI training clause is only as sound as the vendor's own rights in the data. Ask where each dataset comes from, which upstream terms travel with it, and what attribution they require. A vendor that sets out its data provenance in writing lets you trace a row behind a model back to its kind of source.
We publish ours as the sourcing statement: Fokals data is collected from first-party company sources and public records, processed in-house, and company-level throughout. A bulk export can come as a package of files with a manifest naming its period, its versions and its licence. Keep the manifest of every export a training run read, and the terms the rows arrived under sit beside the run. Daily and weekly datasets are written once and never revised, so a clause on deletion or audit can name a period and a version set and mean the same rows a year later. The use case on training models on dated company signals covers the modelling method.
Copyright and contract terms when licensed data trains a machine learning model
Whether training on licensed data needs copyright permission depends on the jurisdiction, and policy is still moving in several, so the contract terms carry the weight. The EU has a text and data mining exception that rightholders can reserve, the UK government has reported that it will gather more evidence first, and the US Copyright Office has issued a pre-publication report.
Each line reports a document; none says that a given use is lawful.
| Body | Document | Date and status | What it says |
|---|---|---|---|
| European Parliament and Council | Directive (EU) 2019/790, Article 4 | 17 April 2019; in force; transposition was due by 7 June 2021 | Member states must provide an exception or limitation for text and data mining of lawfully accessible works, reaching the database right, which applies only where the rightholder has not expressly reserved the use in an appropriate manner, such as machine-readable means for content online |
| European Parliament and Council | AI Act, Regulation (EU) 2024/1689, Article 53 | In force; applies since 2 August 2025; not amended in the consolidated text of 27 July 2026 | Providers of general-purpose AI models need a policy to comply with EU copyright law, including such reservations, and must publish a summary of their training content on the AI Office template |
| UK Department for Science, Innovation and Technology, Department for Culture, Media and Sport, Intellectual Property Office | Report on Copyright and Artificial Intelligence | 18 March 2026; a report to Parliament, with no change in the law | Copying works to train infringes unless licensed or within an exception; a broad exception with an opt-out is no longer the preferred route; more evidence first, and no intervention in the licensing market for now |
| US Copyright Office | Copyright and Artificial Intelligence, Part 3: Generative AI Training | 9 May 2025; pre-publication version, with a final version to follow and no substantive change expected | The Office's report on training generative models, released early in response to inquiries from Congress |
An exception decides what a party may do without a licence. A signed licence adds terms of its own, so read the two together. Recital 105 of the AI Act states the EU starting point: content protected by copyright needs the rightsholder's authorisation unless an exception applies, and where the opt-out has been expressly reserved, providers of general-purpose models need authorisation to mine it.
Attribution, database rights and generative AI training in data licence terms
In the EU a database can carry a right of its own beside copyright, and the text and data mining exception in Directive (EU) 2019/790 reaches it. Attribution is set by the licence: every Creative Commons licence requires it, and a commercial licence can too. Ask whether generative AI outputs built on the data must carry a credit.
Directive 96/9/EC of 11 March 1996, in force and amended in 2019, has member states give the maker of a database that rests on a substantial investment in obtaining, verifying or presenting its contents a right to prevent extraction or re-utilisation of all or a substantial part of them, for fifteen years from the first of January after completion, or after first publication within that period, and a substantial change amounting to a new investment gets its own term. It defines extraction as the permanent or temporary transfer of all or a substantial part of the contents to another medium, by any means. A training pipeline copies rows into a store of its own, so name that copy and its retention in the licence.
For credit on generative output, decide whether a model card, and an answer that repeats a value, must cite the data and the date it was observed. For training, the Creative Commons primer suggests a credit can be a link to the source of the dataset.
Trade secrets, privacy and contract terms in machine learning training
Two other bodies of law meet a training licence: trade secrets, where a licence treats the data as confidential, and data protection, where the rows hold personal data. Ask whether a model that can repeat rows, or an answer that quotes them, counts as disclosure under the confidentiality clause, and whether any field holds personal data.
Directive (EU) 2016/943 of 8 June 2016, in force, treats information as a trade secret when it is secret, has commercial value because it is secret, and its lawful holder has taken reasonable steps to keep it so. For a model, agree what counts as disclosure: weights shared with a partner, an evaluation report with sample rows, an answer that repeats a value.
On personal data, the European Data Protection Board adopted Opinion 28/2024 on 18 December 2024, under Article 64(2) of the GDPR, at the request of the Irish supervisory authority. Its announcement says the authorities assess case by case whether a model is anonymous, and that development on unlawfully processed personal data could affect the lawfulness of deployment unless the model is duly anonymised. Fokals data is company-level throughout; check the fields you train on against the data dictionary.
Data licence terms for use with AI assistants and agents
Retrieval at answer time is a separate use from training. An assistant or agent reads rows when a question arrives and can show values to whoever asked, so where those are your customers the use usually falls under embedding. Name retrieval in the licence, say who sees the answers, and say what may be stored.
- Storage. A retrieval index, a cache and conversation logs each hold licensed values. Name each, with its retention and its deletion.
- Display. Say which fields an answer may show, to which users, with what credit and observation date.
- Agents. An agent acting for your customer and calling an API of yours that serves the rows may be a recipient of the data, which is redistribution under a redistribution licence.
The IETF's AI Preferences working group offers useful words for such a clause. Its draft, A Vocabulary For Expressing AI Usage Preferences, version 08 of 14 September 2026, is an active Internet-Draft, which the IETF treats as a working document. It separates AI Training, where an asset changes the learned parameters of a generative AI model, from AI Use, where an asset becomes input to such a model without the user supplying it, and from Search. A licence that grants the first and is silent on the second has left retrieval open. The builds are covered in retrieval over structured company signals and company data as context for AI agents.
What Creative Commons policy says on AI training and generative AI
Creative Commons says its licences do not restrict particular uses, so AI training is permitted on the same terms as any other use, with the licence conditions attached: credit under BY, no commercial use under NC. Its 2025 primer adds that the licences apply only where copyright permission is needed, and takes a conservative line on ShareAlike and NoDerivatives.
The Creative Commons FAQ, last updated on 13 May 2025, adds that the licences do not override privacy or data protection law. The primer, Using CC-licensed Works for AI Training, is guidance dated May 2025. It notes that in many cases neither a model nor its outputs would count as a derivative work of the training data, and on a conservative approach would share models built on ShareAlike material under the same licence and leave NoDerivatives material out of training. CC signals, its framework for stating expectations about AI use, is being tested in pilots. Its update of 23 April 2026 says the project is no longer limited to signalling preferences, and on 6 July 2026 Creative Commons said it plans to develop legally enforceable tooling from it with a small group of data stewards as pilot testers.
The Linux Foundation's Community Data License Agreement, Permissive 2.0, released on 22 June 2021, counts machine learning models among the Results of analysing the data and places no restriction on Results; whoever shares the data must make the agreement's text available with it. A commercial licence answers the training question for one buyer, so ask for the clauses above.
What happens to a trained model when the licence ends
An agreement can require deletion of the data and everything built from it, let models and scores survive, or keep rows for audit only. List what a training programme leaves behind before the first run: raw rows, training snapshots and feature tables, test sets, weights and checkpoints, stored scores, and retrieval indexes and logs. Mark each delete, keep, or keep for audit until a named date.
An illustrative example: Acme Robotics checks its licence
This example is illustrative: the company, terms and dates are invented to show the method.
Assumptions:
- Acme Robotics sells revenue software and licenses company signals from a data vendor for internal use, for 24 months from 1 November 2026.
- The draft permits training models whose outputs stay inside Acme Robotics and requires deletion of the data within 90 days of the end of the term. It says nothing on retrieval, published evaluation or models after the term.
- Acme Robotics plans to retrain an account-scoring model on the first day of each month, keeping one snapshot a run, to publish a benchmark, and to let its product's assistant quote values to customers.
Working:
- The term's last day is 31 October 2028, 24 months after 1 November 2026.
- Ninety days after 31 October 2028: 30 days reach 30 November, 61 reach 31 December, 90 reach 29 January 2029. Deletion is due by 29 January 2029.
- Runs from November 2026 to October 2028: 2 in 2026, 12 in 2027 and 10 in 2028, so 24 snapshots.
- If an audit clause keeps the last three snapshots, 24 less 3 leaves 21 to delete by 29 January 2029. Without it, all 24 fall under the deletion term.
- Internal training and internal evaluation are granted. The published benchmark is not covered. Quoting values to customers is embedding and is not granted. The model after the term is not addressed.
Result: Acme Robotics asks for four additions before signing: retrieval and display to named customer accounts with the observation date beside each value; benchmark results published as aggregates without rows; survival of the model and its scores, with rows and snapshots deleted; and three snapshots kept for audit until a named date.
Licensing Fokals data for a model
We license by written agreement, for internal use, for embedding in a product or for redistribution, so place each model use from the first table under one of the three and name it. Sample data for the companies you track is sent on request with the data dictionary and the methodology, so the fields a model will use can be tested before the scope is written. Labels and scores carry a named version on every row, and a breaking change ships as a new version with at least 90 days' notice, which a retraining clause can cite.
Frequently asked questions
Does an internal use licence cover training a machine learning model?
Only if its wording reaches training. An internal use grant that says who may use the data without naming models leaves training, fine-tuning by a contractor and the fate of the model open to interpretation. Ask for training to be named as a permitted use, with the datasets it covers, and for the model's outputs to be confirmed as yours to use inside your organisation.
Who owns a machine learning model trained on licensed data?
The agreement decides. A model is derived data, and a licence can leave it with you outright, let you use it only during the term, or limit its transfer. Settle three points in writing: whether the weights are yours, whether they may be shared or sold, and whether they survive the end of the term.
Do I have to delete a model when the data licence ends?
That depends on the agreement. Read the clauses on term, deletion and survival together, because deletion of the data may or may not reach models, features, test sets and retrieval indexes built from it. List each artefact before the first training run and mark it delete, keep, or keep for audit until a named date.
Can an AI assistant show licensed company data to users?
Where the licence covers it. An assistant that reads rows at answer time and shows values to people outside your organisation is usually an embedding use, not internal use. Ask for retrieval to be named, for the users who may see answers, for the credit and date to show beside a value, and for what the assistant may store in its index and logs.
Does the EU text and data mining exception cover training on licensed data?
Article 4 of Directive (EU) 2019/790 requires member states to provide an exception for text and data mining of lawfully accessible works, reaching the database maker's right, unless the rightholder has expressly reserved the use. It describes what the law allows without a licence. A signed licence adds terms of its own, so read the agreement beside the exception and take advice on how the two fit together.
Do Creative Commons licences allow AI training?
Creative Commons says in its FAQ that its licences permit use in AI training to the same extent as any other use, provided the licence conditions are met, such as attribution under BY, and that they do not override privacy or data protection law. Its primer adds that the licences apply only where copyright permission is needed, and takes a conservative line on ShareAlike and NoDerivatives material.
What this page says about the products it names was checked against their public documentation on 7 October 2026. Product and company names are trademarks of their owners. Fokals is not affiliated with them or endorsed by them.