AI training and data licensing agreements

The agreement identifies the sources, version, fields, metadata, labels and documentation. A link to a continuously changing bucket is not sufficiently precise subject matter without versioning rules.

Use for training, fine-tuning, testing, evaluation, RAG and subsequent improvement is distinguished. The right to access data does not automatically imply the right to reproduce, extract and use the content for all these purposes.

The dataset may contain protected works and may benefit from protection of its structure or the sui generis database right. Law No. 8/1996 and the European framework must be analysed for each source.

Directive (EU) 2019/790 permits certain reproductions and extractions for text and data mining from lawfully accessed content, but for general uses rights holders may appropriately reserve their rights, including through machine-readable means. The agreement must not assume that all public content is freely available for training.

If the dataset contains personal data, the parties must establish their roles, legal basis, information, minimisation, retention, individuals’ rights and transfers. Pseudonymisation does not automatically take data outside GDPR.

• The origin of the data and data subjects’ expectations.
• Sensitive data, children’s data and information about convictions.
• The possibility of reidentification and model extraction tests.
• Requests for access, rectification, erasure and objection.
• The supplier’s or third parties’ trade secrets.
• Technical measures for access, storage and training environments.

The agreement defines quality standards, representativeness, labelling accuracy and documentation of limitations. An absolute warranty that data contains no errors is rarely realistic; a reporting and correction mechanism is more useful.

Rights over the trained model, checkpoints, embeddings, evaluations and outputs are established. Termination provisions clarify deletion of the dataset, retention of the model and situations where data or a third party’s rights are withdrawn.