Training data rights: the question with litigation attached

Most technical risks in a deal cost engineering time to fix. Training data rights are the exception: this is the due diligence question with litigation attached, and the numbers involved stopped being hypothetical a while ago. The question itself is plain. Where did the data that trained or fine-tuned this product come from, and what do the contracts around that data actually allow.

For most targets the scope is narrower than the headline lawsuits suggest. Few startups pretrain foundation models. Most fine-tune, build retrieval corpora, or train small task-specific models on data they collected. The rights question applies to all of it, and in our experience the riskiest dataset is rarely the famous one.

Why training data rights moved up the diligence list

The case law made provenance expensive. In September 2025, Anthropic agreed to pay 1.5 billion dollars to settle a class action by book authors, roughly 3,000 dollars per work: a court had found that training on lawfully acquired books was fair use, and the settlement priced the books downloaded from pirate libraries instead. Earlier in 2025, Thomson Reuters won against Ross Intelligence, whose training on Westlaw headnotes was found not to be fair use. The New York Times case against OpenAI is in discovery with a dozen consolidated cases around it, Getty’s UK claim against Stability AI largely failed in late 2025 because the training happened outside the UK while its US case continues, and trackers such as Troveo’s AI training data lawsuit tracker list dozens more.

The part that matters for diligence: courts have been kinder to training itself than to how the data was acquired. The liability concentrated in provenance, and provenance is exactly the part a diligence team can check.

The provenance questions we ask

We ask for a data inventory: every model and corpus in the product, and for each one, what data went in and where it came from. Scraped, purchased, licensed, customer-provided, synthetic, or inherited from an open dataset with its own terms. For purchased and licensed sets, the license on file. For scraped sources, which sites, when, and under what terms at the time. Dates matter, because a dataset assembled in 2021 under one reading of fair use reads differently now.

The meta-finding is speed. A team with clean provenance produces this inventory in a day or two, because it already exists. A team that needs three weeks is reconstructing it, and reconstruction is where the surprises live.

Customer data and what the contracts allow

The most common finding is not pirated books. It is customer data used for training under contracts that never contemplated it. Read the actual clause: "we may use your data to improve our services" was written for analytics, and stretching it to cover training models that serve other customers is a bet, not a right.

So we check three things. Whether enterprise contracts contain explicit no-training clauses, and whether the pipeline actually honors them. Whether the opt-outs promised in the privacy policy are implemented in code or only in the policy. And whether terms were changed retroactively to permit training, and how customers were told. Cross-tenant training without clear rights is a finding that reaches the revenue base as much as the legal budget: enterprise customers who discover it churn, loudly.

GDPR exposure

Personal data in training sets raises questions with no comfortable answers. What is the legal basis for the training. How is a deletion request honored once the data has shaped model weights or sits inside embeddings. Was an impact assessment done at all. These overlap with the wider gaps we cover in GDPR problems that surface after the deal closes, and for general-purpose models the EU AI Act adds transparency obligations about training data, one reason the AI Act is now a diligence line item.

What clean looks like

Clean is achievable, and it is mostly organizational. An inventory that took a day to produce. Licenses and purchase records on file. Customer training rights explicit in the contracts, with opt-outs enforced in the pipeline rather than in the FAQ. Model provider indemnities understood, including their conditions, because they all have conditions. And no dataset anyone in the room hesitates to name.

When it is not clean, the response depends on where the problem sits. A questionable corpus feeding a replaceable fine-tune is a remediation task: retrain on licensed data, budget the work. Questionable data that the product’s core quality depends on is a valuation conversation. It is one of the areas where the AI due diligence checklist we use goes deeper than a classic tech DD. Inside a technical and AI audit, the provenance questions above take a day or two to ask, which is cheap against what the settlements now cost.