# AI Copyright Assessment and Vendor IP Audit Checklist Who owns AI outputs, what infringement exposure the training data creates, and whether client agreements keep up. A vendor IP audit checklist, a training data IP assessment, client disclosure language, and an IP clause library. **Who this is for:** The commercial or IP counsel setting the organization's position on AI-generated work and training data risk. Source playbook: https://aigovernance.com/playbook/ai-intellectual-property-and-copyright --- ## AI vendor IP audit checklist _Run against each AI vendor contract for the IP terms that matter._ ### Template | Question | Answer | Acceptable? | Note | |---|---|---|---| | Do we own the outputs generated from our inputs? | Y / N | | | | Does the vendor claim any license over our inputs or outputs? | Y / N | | | | Is there copyright indemnification for outputs, and what are its conditions and caps? | Y / N | | | | Does indemnification require us to use vendor-provided filters or stay within usage guidelines? | Y / N | | | | Are training-data infringement claims carved out of the general liability cap? | Y / N | | | | Does the vendor disclose anything about training data sources or licensing? | Y / N | | | ### Worked example | Question | Answer | Acceptable? | Note | |---|---|---|---| | We own the outputs | Y | Y | MSA 7.1 | | Vendor license over inputs/outputs | Y | Partial | service-improvement license on de-identified data; opt-out negotiated | | Copyright indemnification | Y | Y | uncapped for third-party IP claims if we use the enterprise tier and filters | | Indemnity conditions | Y | Y | must keep output filters enabled; documented for engineering | | Training-claim carve-out from cap | N | N | redline sent to add it | | Training data disclosure | N | acceptable | no vendor discloses this; noted as residual risk | ### Acceptance criteria - Every material AI vendor contract has a completed checklist. - Indemnification conditions (filters, usage guidelines) are extracted and passed to the teams who must comply with them. - Unacceptable answers have a redline in progress or a recorded risk acceptance. --- ## Training data IP assessment _For internally trained or fine-tuned models: the copyright risk of each dataset._ ### Template | Dataset | Source | License / rights basis | Contains third-party copyrighted content? | Copyright risk rating | Mitigation | |---|---|---|---|---|---| | | | owned / licensed / public-domain / open-license / scraped / unclear | Y / N / Unknown | Low / Medium / High | | ### Worked example | Dataset | Source | License basis | Third-party copyrighted content? | Risk rating | Mitigation | |---|---|---|---|---|---| | hiring-outcomes | internal HRIS | owned | N | Low | none | | product-docs-corpus | our published docs | owned | N | Low | none | | support-transcripts | our systems | owned (customer content, licensed via ToS) | N | Low | ToS grant confirmed by Legal | | web-style-samples | scraped marketing sites | scraped | Y | High | dataset withdrawn; replaced with licensed stock copy | ### Acceptance criteria - Every internal training and fine-tuning dataset has a rights basis recorded. - Datasets rated Medium or High have a mitigation or a documented decision to accept the risk. - Scraped or unclear-license datasets are not used in production models without Legal sign-off. --- ## Client engagement AI disclosure language _Standard clauses for client agreements: that AI is used, and how IP in the work product is allocated._ ### Template > Add to master services agreements and statements of work. Adjust to the engagement. - **Use disclosure:** a plain statement that AI tools may be used in performing the services, and the categories of use - **Human oversight:** that a qualified person reviews AI-assisted work before delivery - **IP allocation:** who owns the deliverables; confirmation that AI assistance does not change the ownership the client bargained for - **Copyrightability note:** where relevant, that purely AI-generated portions may not be independently copyright-protectable under current guidance, and how that is handled - **Data handling:** that client confidential information is only put into tools that meet the confidentiality terms of the agreement - **Opt-out:** how a client can require that AI tools not be used, and any effect on price or timeline ### Worked example "The Provider may use artificial intelligence tools to assist in performing the Services, including for drafting, research, summarization, and code generation. All AI-assisted work is reviewed by qualified Provider personnel before delivery. The Client owns all deliverables as set out in Section [X]; the Provider's use of AI tools does not alter that ownership. The Provider will not input Client Confidential Information into any AI tool that does not meet the confidentiality obligations of this Agreement. The Client may, on written notice, require that AI tools not be used in its engagement; the Provider will confirm any resulting change to fees or schedule." ### Acceptance criteria - Disclosure language is in the standard MSA and SOW templates, not added ad hoc. - It states that AI-assisted work is human-reviewed before delivery. - It gives the client a route to opt out and addresses the commercial effect. --- ## IP clause library for AI contracts _The reusable AI IP clauses, with the position to hold._ ### Template | Clause | Purpose | Preferred position | Fallback | |---|---|---|---| | Output ownership | We own generated outputs from our inputs | Full ownership, no vendor license-back | Vendor gets a license only over de-identified data for service improvement, with opt-out | | Copyright indemnification | Vendor covers third-party IP claims on outputs | Uncapped for IP infringement, minimal conditions | Capped but carved out of the general liability cap; conditions limited to using standard filters | | Training data warranty | Vendor warrants rights to its training data | Express warranty | Best-efforts statement plus the indemnity | | Input license scope | Limits what the vendor may do with our prompts | Process only to provide the service | Add explicit no-training language | | AI-use disclosure (downstream) | Lets us disclose AI use to our own clients without breach | Permitted | Permitted with notice | ### Worked example | Clause | Status with the current vendor | Note | |---|---|---| | Output ownership | Secured | full ownership | | Copyright indemnification | Open | uncapped offered only on enterprise tier; upgrading | | Training data warranty | Open | vendor offers best-efforts; relying on the indemnity | | Input license scope | Secured | no-training language in the DPA | | Downstream AI-use disclosure | Secured | permitted | ### Acceptance criteria - Preferred and fallback positions are agreed with IP counsel before negotiation. - The library is applied to every new and renewed AI contract. - Where a fallback is accepted, the residual exposure is recorded. --- ## Governance controls this kit produces evidence for - **DGC-006**: The training data IP assessment covers license compliance for datasets and AI-generated code. - **PRC-002**: The clause library and vendor IP audit are the AI contractual requirements for IP terms. - **MGV-008**: The client disclosure language implements AI-generated deliverable disclosure standards. - **PRC-001**: The vendor IP audit checklist is part of the due diligence record for each AI vendor. - **DGC-001**: The training data IP assessment complements provenance records with a rights basis per dataset.