AI Training Data Supplier Checklist

An AI service’s output is influenced by the information used to train, fine-tune and operate it. Use this checklist to assess whether a supplier can explain where its data came from, what rights apply, whether customer information is reused and what happens if copyrighted or unlawful material is challenged.

Step 1 — Identify the service

• □ Supplier
• □ Product
• □ Model and model version
• □ Business purpose
• □ Business owner
• □ Technical owner
• □ Users
• □ Data involved
• □ Renewal date

Step 2 — Understand the model

• □ Public foundation model
• □ Supplier-specific model
• □ Fine-tuned model
• □ Custom model
• □ Retrieval system
• □ AI agent
• □ Unknown

Record whether different components come from different suppliers.

Step 3 — Ask about training data

• □ Data categories disclosed
• □ Books or publications disclosed
• □ Web data disclosed
• □ Licensed data disclosed
• □ Public-domain data identified
• □ Synthetic data identified and labelled
• □ Third-party datasets identified
• □ Dataset documentation available
• □ Provenance process explained
• □ Model card available

Step 4 — Review rights and licensing

• □ Acquisition method explained
• □ Copyright position explained
• □ Relevant jurisdictions identified
• □ Licences documented
• □ Commercial use permitted
• □ Rights-holder objections handled
• □ Unlawful sources excluded
• □ Supplier warranty provided
• □ Intellectual-property indemnity reviewed
• □ Liability limits understood

Note: For UK organisations, a US court ruling does not automatically determine the legal position. US fair use and UK fair dealing are different doctrines.

Step 5 — Review customer data

• □ Whether prompts are retained
• □ Whether uploaded files are retained
• □ Whether customer data is used for training
• □ Whether training use can be disabled
• □ Whether enterprise controls are available
• □ Retention period defined
• □ Deletion process defined
• □ Subprocessors identified
• □ Data location understood
• □ Confidentiality terms acceptable

Uploading a document to an AI service does not always mean it trains the base model — but the contract must confirm what actually happens.

Step 6 — Review output risk

• □ Memorisation controls described
• □ Verbatim reproduction tested or controlled
• □ Source citation supported where appropriate
• □ Output-ownership terms reviewed
• □ Human review required before publication
• □ Infringement complaints process confirmed
• □ Model limitations understood

Step 7 — Review transparency

• □ Current model version visible
• □ Material changes notified
• □ Dataset changes documented
• □ Supplier incidents disclosed
• □ Legal challenges monitored
• □ Audit evidence available
• □ Named supplier contact confirmed
• □ Review frequency agreed

Step 8 — Review your own content

• □ Valuable business content identified
• □ Ownership recorded
• □ Staff upload rules defined
• □ Contractor rights confirmed
• □ Customer rights confirmed
• □ Website terms reviewed
• □ AI crawler controls considered
• □ Licensing opportunities assessed
• □ Original publication evidence retained

Step 9 — Make a decision

• □ Approved
• □ Approved with restrictions
• □ Further evidence required
• □ Legal review required
• □ Alternative supplier required
• □ Not approved

Record: decision maker · date · restrictions · corrective actions · action owner · next review date.