Data licensing agreement for AI: 15 terms to check before you sign

This is a plain-English checklist, not legal advice and not a template. Take advice from your own solicitor before you sign anything.

What is a data licensing agreement, and how does it differ from a sale?

A data licensing agreement gives a buyer permission to use a defined copy of your records, for stated purposes and a stated period. Your company keeps ownership and goes on using the originals. A sale transfers ownership itself.

UK copyright law draws the same line. Selling copyright is an assignment, which "is not effective unless it is in writing signed by or on behalf of the assignor". A licence binds anyone who later acquires the copyright, except a good-faith purchaser with no notice of it¹⁶.

Buyers in this market license rather than buy. micro1 says companies "retain ownership of their underlying data"¹; Polyshares describes "a license to defined operational data" in which the company keeps the business and the data².

A licence can still come close to a sale in effect. A TechRound article about SourceX's programme describes its rights over the de-identified dataset as "perpetual, irrevocable, transferable and sublicensable", surviving termination with no duty to untrain models⁵. Read the rights granted, not the label.

Paperwork often comes in two layers: a master agreement, then a short confirmation for each dataset fixing scope, price and terms, which is how SourceX describes its own⁶. Review both: signing SourceX's master agreement creates obligations even before a dataset deal closes⁵.

The 15 terms that matter

Fifteen terms decide what you give up, what you risk and when you are paid. For each one, compare what the draft says with what to ask for.

1. Scope and field of use

The licence should list exactly what is covered (systems, date ranges, record types and agreed exclusions) and what the buyer may do with it: training, evaluation or building products. Endless Data's published terms for its own AI customers separate a general "Permitted Use" from a designated model training use¹¹.

Ask for: a data schedule, uses limited to training and evaluating AI models, and a ban on using the records to identify, profile or contact anyone, as Endless imposes on its customers¹¹.

2. Exclusivity

Exclusivity stops you licensing the same records elsewhere, so it is usually the most valuable right you grant. Labelbox Prism's partnerships are exclusive by default, with extra exclusivity priced to the buyer⁸. Polyshares licences are exclusive by default unless agreed otherwise, and its published deals are perpetual exclusive licences^3,4. Cognor Labs says 24 months is typical⁷; Endless Data licenses non-exclusively¹⁰. In the related market for AI training environments, Epoch AI reports founders putting exclusive deals at roughly 4 to 5 times the price of non-exclusive ones¹³. Under UK copyright law, an exclusive licence must be in writing signed by the copyright owner¹⁷.

Ask for: a fixed period, a defined field such as training only, no reach into records you create later, and a price that reflects all three.

3. Term and territory

How long may the buyer use the records, and where? micro1 says it licenses data only to labs and enterprises "based in the U.S. and allied countries"¹.

Ask for: a fixed term, named territories or types of recipient, and a clear list of what survives when the licence ends.

4. Sublicensing and onward transfer

Many buyers are data companies that resell to AI labs. Polyshares supplies labs and does not disclose which labs take which data^2,3. micro1 commits not to resell or distribute data until personal and identifying information has been anonymised¹. SourceX's rights are transferable and sublicensable⁵.

Ask for: onward licences only to AI developers on terms at least as protective as yours, every restriction flowed down, and a right to know who holds your records.

5. Deletion and trained models

A licence can make a buyer delete copies; it rarely makes a model forget. Labelbox Prism's kill clause forces deletion within 30 days for material breach, regulatory change or a change-of-control trigger you define, but "models already trained on the data cannot be unlearned"⁸. Endless Data's customers may keep models trained during the term¹¹. Frankfurt Kurnit Klein & Selz, a US law firm, warns that once data trains a model "it cannot practically be pulled back out"¹².

Ask for: deletion of raw and prepared copies on a set schedule, with written confirmation (micro1 deletes raw data to an agreed schedule¹), and a price that assumes models survive.

6. Bans on re-identification and linkage

In the UK it is already an offence to knowingly or recklessly re-identify de-identified personal data without the consent of the controller that de-identified it¹⁸. A contract still matters, because it binds the buyer's onward recipients and gives you a remedy. Endless Data bars its customers from re-identifying de-identified or pseudonymised data¹¹.

Ask for: express bans on re-identification, on linking your records with other data to single people out, and on contacting anyone named; the same terms flowed down; and prompt notice of any breach. Our anonymisation standard explains why linked records need this.

7. Security and data location

Where are raw and prepared copies held, and who can see them? Scale AI says it anonymises inside your environment before any data is extracted, with on-premises and private cloud options⁹. Polyshares says two named people can see a company's identity alongside its data³. If a buyer receives raw personal data to de-identify on your behalf, UK GDPR requires a binding processor contract setting out the subject matter, duration, nature and purpose of the processing¹⁹. Transfers abroad need their own route, explained in our UK law guide. Sleeping Asset prefers personal data to be removed before records leave your systems; where a buyer removes it after transfer, we tell you in writing first and your solicitor confirms the transfer route before anything moves.

Ask for: named processing locations, encryption, access limits and a deadline for telling you about any breach.

8. Audit

You cannot check promises you cannot see. Endless Data's licence gives its sellers audit rights¹⁰, and its customer terms allow yearly written certification of compliance and an audit where a breach is suspected¹¹.

Ask for: annual written confirmation of compliance, a list of onward recipients, and an audit right if you have reason to suspect misuse.

9. Acceptance and rejection

Most buyers check delivered data before they owe anything. micro1 has 30 days to review and approve¹; SourceX reviews for up to 30 days⁶; Polyshares reads a sample before it prices².

Ask for: acceptance tests agreed in advance (the approved sample is a good benchmark), deemed acceptance if the window passes in silence, written reasons and a chance to fix any rejection, and deletion of anything rejected.

10. Price, currency and payment timing

Published terms vary widely. micro1 pays within 30 days of invoice after approval¹; SourceX within 60 calendar days of a valid invoice⁶; Polyshares net 30 to 60²; Mercor by wire on delivery, typically 2 to 4 weeks after signing¹⁵; Labelbox Prism an upfront fee at signing plus a revenue share⁸. Prices are quoted in US dollars.

Ask for: a fixed price in the licence, the currency, who pays transfer charges, interest on late payment, and reports and audit for any revenue share. Confirm which company signs and which owes you the money, as SimpleClosure advises²⁰.

11. Warranties on rights

Holding data is not the same as having the right to license it. Frankfurt Kurnit lists other companies' confidential information under NDAs, licensed data, open-source and vendor code, and third-party material in attachments¹². SourceX runs a rights review before signing, including limits in customer and vendor contracts⁶.

Ask for: warranties limited to what you know after reasonable enquiry and tied to the agreed exclusions. Never warrant perfect de-identification: SourceX's own agreement records that re-identification may still be possible⁶.

12. Indemnities and liability caps

Buyers protect themselves first. In its own terms as a supplier to AI customers, Endless Data caps its liability at the fees paid in the previous 12 months and limits its infringement indemnity to US rights¹¹.

Ask for: your total liability capped at the price you receive, no liability for indirect loss, and an indemnity from the buyer for its misuse of the records, its models' outputs and any re-identification.

13. Confidentiality

Decide what stays private: your identity, the licence terms and the records. Polyshares lists records under a code rather than the company's name³. Frankfurt Kurnit notes that California and EU rules require AI developers to publish high-level information about their training data, including whether it was bought or licensed¹².

Ask for: your name kept confidential unless you agree otherwise, and confidentiality that outlasts the licence.

14. Publicity

Buyers like case studies and announcements.

Ask for: no use of your name, logo or story in marketing, press or investor material without your prior written consent.

15. Governing law and jurisdiction

Paperwork from US buyers may choose US law: Endless Data's published terms choose Delaware law and arbitration in Wilmington¹¹.

Ask for: English law and the courts of England and Wales, or arbitration seated in London. If you accept another law, have your solicitor explain what it means for warranties, caps and enforcement.

What do buyers' published terms say?

Few buyers publish full licence terms, but their pages and FAQs reveal the main points. All checked on 12 November 2026; the signed agreement always governs. SourceX's terms come from a paid press release and a TechRound article about its programme, so treat them as the company's own account.

Which buyers accept UK companies is tracked separately on the buyers page. We ask each buyer to confirm in writing that it accepts UK companies before we introduce you.

Which terms are red flags?

Walk away from, or renegotiate, any term that takes more than you are paid for or leaves you carrying risk you cannot control.

• A 48-hour deadline. Business Insider reports six-figure "exploding offers" that expire in 48 hours¹⁴. No licence worth signing needs that.
• A full export before any offer. SimpleClosure's chief executive warns against handing over everything before a meaningful offer²⁰.
• Perpetual, worldwide exclusivity for a one-off fee, especially if it covers records you have not yet created.
• Raw personal data sent abroad first, with no processor contract and no transfer route¹⁹.
• No re-identification ban, or one that does not bind onward recipients.
• Uncapped warranties and indemnities, or a promise that de-identification is perfect.
• Acceptance at the buyer's sole discretion, with no deadline.
• An unclear counterparty, where you cannot tell which company signs and which owes you the money²⁰.

How do your solicitor and Sleeping Asset split the work?

Your solicitor advises you on the law and approves the licence. Sleeping Asset compares the commercial terms with what buyers publish and with any other offers, and tracks the deal to payment. We do not give legal advice.

Frankfurt Kurnit recommends documenting the review, exclusions, de-identification protocol and business case, because a past data sale will come up in due diligence if the company is later acquired¹². We help you build that file. How it works covers the full process, how we are paid shows our fee by buyer, and choosing a licensing agent lists what to ask any intermediary.

Already have an offer? Send it to us and we will compare it with the market, free. On a 30-minute call we go through these 15 terms against the draft you hold. No offer yet? Our guide to what company data is worth sets out what buyers publish.