Opt-in or mandatory: how to roll out a program across portfolio companies

The short answer: mandate guardrails, offer upside

Mandate a program when it protects the fund or only works if every company does it the same way. Make it opt-in when its value depends on what each company owns, has promised and wants. Cybersecurity minimums, the monthly reporting pack and records preservation sit in the first group. Procurement catalogs, AI pilots, pricing work and a data licensing review sit in the second.

Most operating teams run both kinds, and the hard part is being honest about which is which. A program described as optional but scored in the management incentive plan (MIP) is a mandate. A program described as mandatory but never resourced or checked is optional in practice, and usually gets the worst of both.

For data licensing the answer is clear: the company signs, and its own contracts and privacy promises decide what can be licensed. Mandate one protective step, complete exports before any system is retired, and offer the review itself as an optional, company-led conversation.

How do opt-in and mandated rollouts compare?

Opt-in trades speed of coverage for ownership; a mandate trades ownership for speed and uniformity.

A third pattern sits between them, which this page calls assess or explain after the comply-or-explain idea in governance codes: a required assessment with optional adoption. Every company looks at the program once, by a set date, and either adopts it or writes down why not. It suits procurement catalogs and AI pilots. It suits less well anything where the honest first answer for most companies is "not us", because it turns a quick decline into a project.

The four-question mandate test

Run any proposed program through four questions before the rollout memo goes out. The first two argue for a mandate; the last two mean the company has to own the decision.

• Obligation: does the duty sit with the fund, through LP reporting, a lender covenant, a regulatory obligation or a portfolio-wide risk?
• Uniformity: does the program only work if every company does it the same way, as with shared KPI definitions?
• Signature: does the program require the company to sign its own contract with a third party?
• Downside: if management goes ahead against its own judgment, would the damage land on the company's customers, employees or contractual promises?

The decision rule: a yes only on the first two means mandate; a yes only on the last two means offer. When both sides score, mandate the outcome and let the company choose how, and with whom, to meet it. When nothing scores, offer the program and let demand show itself.

When is a mandate the right call?

Mandate when a gap at one company becomes the fund's problem. The usual candidates:

• Security baselines, such as multi-factor authentication, tested backups and a named incident contact.
• The monthly reporting pack, KPI definitions and close calendar that the deal team and fund finance rely on.
• Policies the sponsor answers for: code of conduct, anti-bribery, sanctions screening and data handling.
• Information the fund needs for LP reporting and quarterly valuation work.
• Records preservation: no system retired, workspace deleted or tool cancelled without a complete export and a named owner, applied within the company's retention schedule and any contractual or legal duty to delete.

Mandates land better when the sponsor explains the reason in one paragraph, funds the cost or a shared resource, sets a realistic deadline with an exception process, and checks deployment rather than meeting attendance. A mandate the operating team cannot verify is only a request.

When does opt-in work better?

Offer the program when its value depends on what each company has. A procurement catalog helps a company whose vendor contracts are up for renewal and does little for one locked into a multi-year agreement. An AI pilot needs a process owner who wants it.

Opt-in does not have to mean low uptake. What moves adoption:

• One lighthouse company. Start where the CEO is curious and the fit is obvious, then let that CEO tell the story to peers.
• Peer channels. CFO and CIO councils spread optional programs faster than sponsor memos; the guide to functional councils and communities of practice across a portfolio covers how to run them.
• A small first step. Ask for a 30-minute screen, not a project plan.
• A decision date. "Tell us by the March board meeting" keeps optional from becoming forgotten.
• Incentives left alone. Once an optional program appears on the MIP scorecard, it is a mandate, whatever the memo says.

Why should a data licensing review be opt-in?

Because every decision that matters in a license belongs to the company: whether to sign, what its contracts allow and when a deal fits its calendar. Data licensing fails each question in the mandate test for reasons built into how licensing works.

1. The company signs. The license is the company's own contract. Ownership of the data stays with the company, and no commitment exists until its owner, CEO, CFO or another authorized representative has accepted the price and terms and signed.
2. Rights are company-specific. Whether records can be licensed depends on that company's client contracts, employee notices and privacy policy. In a January 2024 post, FTC staff said a company's commitment to keep customer data away from undisclosed uses, model training included, is an enforceable promise. A February 2024 post warned that switching to looser data practices by surreptitiously and retroactively amending a privacy policy or terms of service may be unfair or deceptive. These are staff blog posts rather than rules, yet a sponsor cannot know from the boardroom what each company told its customers. This is general information, not legal, tax or financial advice. Confirm with the company's own counsel before acting.
3. Willingness is part of qualification. An owner who will not consider an exclusive license is one of SourceX's red flags, so a company pushed into the process by its sponsor tends to stall at exactly that point.
4. Timing belongs to the company. Licenses are usually exclusive for AI training over an agreed term, so the CEO and board need to weigh one against an exit plan, a refinancing or a product sunset on their own schedule.

The one piece worth mandating is the protective step: preserve complete exports before any system is retired, within each company's retention schedule. It applies the same way everywhere, fits into migration planning the company is already doing, and keeps the option open for a company that decides to explore a license later.

How to offer the review across a portfolio

Keep the sponsor's role to shortlisting, framing and introducing; the company does the rest with SourceX.

1. Shortlist companies that clear the who qualifies baseline: US-based, 50+ full-time employees at peak (contractors excluded), a multi-year operating history with records to match, clear rights to license those records, and an owner or executive authorized to sign.
2. Send the CEO and CFO a short note that says plainly the review is optional.
3. Present it once in a peer setting, such as the CEO summit or the CFO council, rather than company by company.
4. Set a decision date and accept a no without follow-up pressure.
5. For companies that say yes, introduce the company's sponsor to SourceX through your referral link or the referral form. SourceX qualifies the company, guides it through a data inventory and agrees price and terms with it before any buyer review.
6. Stay out of the records. Partners make introductions and share basic fit information only. Redaction and de-identification requirements are settled with the company before work starts, and no data moves until the company has signed and authorized delivery.
7. Revisit the companies that declined at the next annual budget, not before.

A note that keeps the choice with the CEO:

Illustrative: the same review, mandated and offered

Illustrative, fictional scenario. A lower-middle-market sponsor with nine portfolio companies wants to test data licensing.

Mandated version. The operating team adds "complete a data inventory" to every company's quarterly objectives. A marketing agency spends weeks listing systems before its counsel points out that most of the material belongs to its clients. Two CEOs submit thin inventories to clear the objective. The one company with a strong case, a 14-year-old IT services business, treats the exercise as sponsor homework and lets it drift.

Offered version. The operating partner presents it once at the CFO council and sets a decision date. Three CFOs ask for a screen. One discovers its old help desk was shut down without an export, so its review stops there and an export-before-retirement rule goes into every 100-day plan. The IT services company's CEO asks for the introduction and owns the conversation from that point.

Governance, disclosure and LP reporting

Describe each program by what actually happened, because LPs test operating claims. In McKinsey's Global Private Markets Report 2026, value-creation strategy made the top five selection criteria for 53 percent of the 300 LPs surveyed, and the report says sponsors' operating groups have more than doubled in size since 2021. "Offered to all nine companies; three assessed; one in inventory" holds up better in a fundraising meeting than "deployed portfolio-wide". The guide to how LPs evaluate an operating partner model lists the questions they ask about operating teams, and the guide to describing portfolio AI initiatives without AI washing covers wording for AI-related programs.

If you introduce portfolio companies as a SourceX partner, settle the economics before the first introduction. Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, paid only after the buyer pays and SourceX receives its fee. No reward is guaranteed, and because the reward is a share of SourceX's fee, it is never deducted from what the company receives.

Three governance points follow from that:

• Fund policy. Check how your LPA and firm policies treat fees connected to portfolio companies, including any management fee offset; the overview of fund CFO responsibilities for fee offsets and portfolio income explains where this usually sits.
• Disclosure to the company. Tell the CEO and board about the referral relationship before the introduction. A sponsor that both requires a program and earns from it invites a conflict question; an optional review with the relationship disclosed up front is far easier to defend.
• One introducer per company. Agree internally who makes each introduction. Credit goes to the first valid referrer whose introduction leads to a verified company application within the attribution window.

Operating partners who also hold a professional license, such as a CPA certificate or a securities registration, should check their own rules on referral fees and disclosure first.

Next step

Put the export-before-retirement rule into every 100-day plan now; it is the only part of a licensing review worth mandating. Then list the companies whose CEOs might be curious, using the network opportunity finder to work through your portfolio and wider network, and register as a partner so each introduction is tracked from the start. The operating partner hub collects the rest of the playbook.