The AI data supply chain explained: from company records to a trained model

What is the AI data supply chain?

The AI data supply chain is the path a record travels from the company that created it to the model that learns from it, along with every business that handles it on the way. It includes data holders, the people who introduce them, licensing intermediaries that review rights and run the transaction, specialists who prepare, label or grade data, and the AI developers who train and evaluate models.

One support ticket shows how it works. A ticket written in 2019 at a mid-sized software company may pass through a data inventory, a rights check, redaction of customer names, packaging with tens of thousands of similar tickets, review by a buyer, and finally use in training or testing a support agent. Every handoff is a point where value is added or lost.

What are the links in the chain?

Each link has a distinct job and a distinct way to fail.

SourceX works at the licensing link: it manages data licensing for companies, from sourcing and rights review to delivery and payment, and it does not train AI models. Grading and testing are explained in what AI model evaluation is.

Which supply routes run side by side?

AI developers source data through several routes at once, and each route carries a different rights profile.

The growth of the vendor route is the subject of what the human-data boom signals for company data. Licensed records are the route where a company's existing history becomes the product, and where an introduction from someone who knows the company matters most.

Following one dataset through the chain

Illustrative: a fictional freight brokerage with 140 full-time employees at peak keeps ten years of shipment exception emails and TMS notes.

1. A fractional CFO who works with the owner mentions data licensing and, with the owner's permission, makes an introduction.
2. SourceX confirms the basics with the owner: peak headcount, years of operation, systems in use and who owns the records.
3. The company lists its sources in a data inventory: the TMS, a shared exceptions inbox, carrier portal exports and the accounting system.
4. Rights review checks customer and carrier contracts, employee notices and privacy commitments, and flags anything to leave out.
5. Price and terms are agreed with the company before the opportunity goes to buyers.
6. AI labs and data buyers review it, and one selects the exception records for an agent that handles shipment delays.
7. After signing, the company exports the agreed scope, de-identified and redacted under the agreed rules, and is paid.
8. The fractional CFO's reward is paid after the buyer pays and SourceX receives its fee.

Where does rights review happen, and why does it come first?

Rights review sits before preparation and before any buyer contact, because everything downstream inherits its answer. Three questions carry most of the weight:

• Who owns the material? US copyright law lets an owner transfer or license specific exclusive rights separately while keeping others, under 17 U.S.C. 201, which is why a company can license records for AI training without giving up ownership.
• What did the company promise? FTC staff wrote in January 2024 that promises not to use customer data for undisclosed purposes, such as training models, are enforceable wherever they appear, whether in privacy policies, terms of service or marketing (FTC staff post).
• Where does policy stand? The US Copyright Office's report on generative AI training, released as a pre-publication version in May 2025, discusses the practicality of licensing approaches and notes how heavily model performance depends on data quality. It is a report, not law.

Records kept in cloud software raise their own questions about control and export, covered in who owns company data stored in SaaS tools. This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

Where does a referral partner fit?

The partner works at the very first link. The job is to recognize a likely data holder, ask its permission, and connect it with SourceX, sharing only basic facts about fit. Partners never export, upload or describe confidential records.

At that first link, a strong candidate is a US company with 50+ full-time employees at peak (contractors excluded), several years of documented operations, the right to license what it holds, and an owner, CEO, CFO or authorized representative willing to sponsor the process. The company fit checker is a quick, non-binding first pass, and how it works shows the full sequence from introduction to payment.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, and the reward becomes payable only after the buyer pays and SourceX receives its fee. The reward is drawn from SourceX's fee, never from the company's proceeds, and no reward is guaranteed.

Which questions are still open along the chain?

A few issues remain unsettled, and partners should be ready to hear them from owners.

• Once a model has trained on data, taking that data back out is difficult; see what happens if a company later wants licensed data out of a model. Scope decisions belong at the start.
• Some owners worry the resulting models will compete with them; will AI trained on our records replace our business takes that question head on.
• Legal analysis of training on unlicensed material is still developing, which is one reason buyers value records with documented rights.
• Value can leak at any handoff. Over-redaction strips context, and under-redaction stops a deal.

Next step

Think of one company in your network that has kept its records for years and owns them outright. Register as a partner and make the introduction, or pass the owner your referral link so the company can apply itself at sourcex.si/apply.