AI Copyright Assessment and Vendor IP Audit Checklist

Who owns AI outputs, what infringement exposure the training data creates, and whether client agreements keep up. A vendor IP audit checklist, a training data IP assessment, client disclosure language, and an IP clause library.

Who this is for: The commercial or IP counsel setting the organization's position on AI-generated work and training data risk.

Download the kit (Markdown) ↓4 artifacts. Every table also copies as CSV.

1. AI vendor IP audit checklist

Spreadsheet

Run against each AI vendor contract for the IP terms that matter.

Template

Question	Answer	Acceptable?	Note
Do we own the outputs generated from our inputs?	Y / N
Does the vendor claim any license over our inputs or outputs?	Y / N
Is there copyright indemnification for outputs, and what are its conditions and caps?	Y / N
Does indemnification require us to use vendor-provided filters or stay within usage guidelines?	Y / N
Are training-data infringement claims carved out of the general liability cap?	Y / N
Does the vendor disclose anything about training data sources or licensing?	Y / N

Worked example

Question	Answer	Acceptable?	Note
We own the outputs	Y	Y	MSA 7.1
Vendor license over inputs/outputs	Y	Partial	service-improvement license on de-identified data; opt-out negotiated
Copyright indemnification	Y	Y	uncapped for third-party IP claims if we use the enterprise tier and filters
Indemnity conditions	Y	Y	must keep output filters enabled; documented for engineering
Training-claim carve-out from cap	N	N	redline sent to add it
Training data disclosure	N	acceptable	no vendor discloses this; noted as residual risk

Acceptance criteria

✓Every material AI vendor contract has a completed checklist.
✓Indemnification conditions (filters, usage guidelines) are extracted and passed to the teams who must comply with them.
✓Unacceptable answers have a redline in progress or a recorded risk acceptance.

2. Training data IP assessment

Spreadsheet

For internally trained or fine-tuned models: the copyright risk of each dataset.

Template

Dataset	Source	License / rights basis	Contains third-party copyrighted content?	Copyright risk rating	Mitigation
<dataset>		owned / licensed / public-domain / open-license / scraped / unclear	Y / N / Unknown	Low / Medium / High

Worked example

Dataset	Source	License basis	Third-party copyrighted content?	Risk rating	Mitigation
hiring-outcomes	internal HRIS	owned	N	Low	none
product-docs-corpus	our published docs	owned	N	Low	none
support-transcripts	our systems	owned (customer content, licensed via ToS)	N	Low	ToS grant confirmed by Legal
web-style-samples	scraped marketing sites	scraped	Y	High	dataset withdrawn; replaced with licensed stock copy

Acceptance criteria

✓Every internal training and fine-tuning dataset has a rights basis recorded.
✓Datasets rated Medium or High have a mitigation or a documented decision to accept the risk.
✓Scraped or unclear-license datasets are not used in production models without Legal sign-off.

3. Client engagement AI disclosure language

Document

Standard clauses for client agreements: that AI is used, and how IP in the work product is allocated.

Template

Add to master services agreements and statements of work. Adjust to the engagement.

Use disclosure: a plain statement that AI tools may be used in performing the services, and the categories of use
Human oversight: that a qualified person reviews AI-assisted work before delivery
IP allocation: who owns the deliverables; confirmation that AI assistance does not change the ownership the client bargained for
Copyrightability note: where relevant, that purely AI-generated portions may not be independently copyright-protectable under current guidance, and how that is handled
Data handling: that client confidential information is only put into tools that meet the confidentiality terms of the agreement
Opt-out: how a client can require that AI tools not be used, and any effect on price or timeline

Worked example

"The Provider may use artificial intelligence tools to assist in performing the Services, including for drafting, research, summarization, and code generation. All AI-assisted work is reviewed by qualified Provider personnel before delivery. The Client owns all deliverables as set out in Section [X]; the Provider's use of AI tools does not alter that ownership. The Provider will not input Client Confidential Information into any AI tool that does not meet the confidentiality obligations of this Agreement. The Client may, on written notice, require that AI tools not be used in its engagement; the Provider will confirm any resulting change to fees or schedule."

Acceptance criteria

✓Disclosure language is in the standard MSA and SOW templates, not added ad hoc.
✓It states that AI-assisted work is human-reviewed before delivery.
✓It gives the client a route to opt out and addresses the commercial effect.

4. IP clause library for AI contracts

Spreadsheet

The reusable AI IP clauses, with the position to hold.

Template

Clause	Purpose	Preferred position	Fallback
Output ownership	We own generated outputs from our inputs	Full ownership, no vendor license-back	Vendor gets a license only over de-identified data for service improvement, with opt-out
Copyright indemnification	Vendor covers third-party IP claims on outputs	Uncapped for IP infringement, minimal conditions	Capped but carved out of the general liability cap; conditions limited to using standard filters
Training data warranty	Vendor warrants rights to its training data	Express warranty	Best-efforts statement plus the indemnity
Input license scope	Limits what the vendor may do with our prompts	Process only to provide the service	Add explicit no-training language
AI-use disclosure (downstream)	Lets us disclose AI use to our own clients without breach	Permitted	Permitted with notice

Worked example

Clause	Status with the current vendor	Note
Output ownership	Secured	full ownership
Copyright indemnification	Open	uncapped offered only on enterprise tier; upgrading
Training data warranty	Open	vendor offers best-efforts; relying on the indemnity
Input license scope	Secured	no-training language in the DPA
Downstream AI-use disclosure	Secured	permitted

Acceptance criteria

✓Preferred and fallback positions are agreed with IP counsel before negotiation.
✓The library is applied to every new and renewed AI contract.
✓Where a fallback is accepted, the residual exposure is recorded.

Governance controls this kit produces evidence for

Completing the artifacts above gives you a head start on the evidence requirements for these controls.

DGC-006

The training data IP assessment covers license compliance for datasets and AI-generated code.

PRC-002

The clause library and vendor IP audit are the AI contractual requirements for IP terms.

MGV-008

The client disclosure language implements AI-generated deliverable disclosure standards.

PRC-001

The vendor IP audit checklist is part of the due diligence record for each AI vendor.

DGC-001

The training data IP assessment complements provenance records with a rights basis per dataset.

This kit backs one playbook. Read the full guidance for the reasoning behind each artifact.

Decide what to implement next

Assess your governance gaps, then create an action plan with owners and target dates. Build and export without an account; sign in when you want to save your plan.

Start the AI governance assessment →