Data Rights and Licensing Risk in AI Startup Due Diligence

An AI company is only as sound as its right to use the data behind it. Training data, customer data, third-party content and model licences all carry legal obligations, and getting them wrong can lead to lawsuits, regulatory action, lost customers or a failed acquisition.

The risk is no longer theoretical. High-profile copyright lawsuits, including The New York Times' 2023 case against OpenAI and Microsoft, have put data provenance at the centre of AI investing, and new rules such as the EU AI Act, which entered into force in 2024, add transparency and governance obligations. This guide explains the main data and licensing risks and how investors can diligence them.

1. The Main Categories of Risk

Training data

Where did the data used to train or fine-tune models come from? Scraped web content, licensed datasets, public-domain material and synthetic data all carry different rights and risks.

Customer data

Many AI products learn from the data customers put into them. Whether the company can use that data to improve its models, and for which customers, depends on contracts and privacy law.

Personal data

Privacy laws such as the EU's GDPR and California's CCPA set rules on collecting, processing and retaining personal information, including in AI systems.

Model licences

Commercial model providers and open-source models come with terms of use that can restrict commercial use, certain applications or competition with the provider.

Outputs

Who owns what the AI generates, and what happens if an output infringes someone else's rights or causes harm?

2. Diligence Checklist for Investors

1. Data inventory. Ask for a list of all data sources used for training, fine-tuning and retrieval, with the rights basis for each.
2. Licences and terms. Review licences for datasets and models, including open-source licences and commercial provider terms.
3. Customer contracts. Check what rights customers grant over their data, and whether the company's actual practices match.
4. Privacy compliance. Review privacy policies, data processing agreements, consent mechanisms and cross-border data transfers.
5. Scraping practices. Understand whether data was collected in breach of website terms or technical restrictions.
6. Indemnities. Check whether model providers offer indemnities, and what the company promises its own customers.
7. Regulatory exposure. Map products against rules such as the EU AI Act, especially for uses classed as high-risk.
8. Insurance. Review cover for intellectual property, privacy and technology errors. See startup insurance and D&O.

3. Red Flags

• The team cannot explain where training data came from.
• Customer data is used for model training without clear contractual rights.
• Heavy reliance on scraped content from sources that prohibit it.
• Open-source components used in ways their licences forbid.
• No data retention, deletion or access controls.
• Customer contracts that promise broad indemnities the company cannot back.

4. Why It Matters at Exit

Acquirers diligence data rights closely, because they inherit the risk. Unclear data provenance can reduce valuation, add escrow or special indemnities, or stop a deal entirely. See our guide to selling your startup: escrow and reps and warranties.

5. Advice for Founders

• Document data sources from day one, with the rights basis for each.
• Write clear customer data terms covering whether and how data is used to improve products.
• Offer enterprise customers opt-outs from training, which many now expect.
• Track open-source licences as carefully as any other code dependency.
• Put data rights in your data room before investors ask. See building a data room that impresses investors.

Frequently Asked Questions

Can AI startups use publicly available web data?

Publicly accessible does not always mean free to use. Copyright, website terms and privacy law may still apply, and the law is still developing through litigation.

Who owns AI-generated outputs?

It depends on the jurisdiction, the model provider's terms and the company's customer contracts. Copyright protection for purely AI-generated content is limited in several jurisdictions.

Does the EU AI Act apply to startups outside Europe?

It can, if their AI systems are placed on the EU market or their outputs are used in the EU.

Do model providers protect customers from copyright claims?

Some offer indemnities under certain conditions. Read the terms carefully, as coverage and exclusions vary.

The Bottom Line

Data rights have become a core part of AI due diligence. Investors who map data sources, licences, customer terms and regulatory exposure can avoid inheriting hidden legal risk; founders who document their rights from the start make fundraising and exit far smoother. For related AI topics, see evaluating an AI startup's moat.

Global Capital Network connects AI founders with investors through our events and investor network. Get in touch to learn more.

This article is general information, not legal advice. Data, copyright and AI laws are evolving quickly; take specialist legal advice.