Government contractor data licensing: CUI restrictions and what may remain in scope

Can a government contractor license its data to AI developers?

Partly. A contractor's records fall into two buckets. Records that are controlled by the government or by export rules are out of scope. Commercial operating records that the contractor created, owns and is free to license may be in scope, once counsel has reviewed the contracts.

For a CPA firm with GovCon clients, the practical job is not to decide which bucket a file belongs in. It is to avoid introducing a company whose main records are all in the first bucket, and to know which questions to put to the sponsor. This is general information, not legal, tax or financial advice. Confirm with the contractor's own counsel and contracts officer before acting.

What records do government contractors typically hold?

Many contractors will find the usable scope is the last two or three rows. That is still enough for some companies, especially those with large commercial back offices and long histories.

What are the main restrictions to know about?

Three families of restriction come up repeatedly. Describe them to a client in general terms and send the details to counsel.

• Controlled unclassified information (CUI). The federal government designates certain unclassified information that contractors handle as CUI, and the contract or its clauses set safeguarding and dissemination rules. CUI is not the contractor's to license. Your client's contract and its security clauses identify what is covered, and the contractor's counsel or security officer should confirm.
• Export-controlled technical data. Technical data controlled under export regimes such as ITAR or the EAR may carry limits on release to foreign persons and on transfer abroad. Data licensing involves sharing with third parties, so this category is excluded unless the contractor's export-compliance counsel confirms otherwise.
• Government data rights. The data rights clauses in a federal contract, including those in the defense acquisition regulation supplement, allocate who holds which rights in technical data and software. A contractor may own commercially developed material that the government has only limited rights in, but it may also have delivered material in which the government holds broad rights. Contract by contract, this requires legal review.

Beyond these, classified information is entirely out of scope, and proprietary information of teaming partners and subcontractors needs their consent.

Which contractors are worth a conversation?

Think about the mix of the company's records rather than its labels. The strongest candidates have a significant commercial footprint.

• Professional services and IT firms with commercial and federal lines of business, where the commercial side runs on separate systems.
• Contractors with large shared-service back offices: finance, HR, procurement, facilities and IT service desks.
• Companies with long, well-organized proposal libraries and win and loss notes.
• Firms whose sponsors can state who owns each data set and where CUI is stored.

Weak candidates are small, single-contract firms whose whole record set lives inside a controlled environment, and any company where all email and files are handled under a CUI enclave. The baseline, including 50+ full-time employees at peak (contractors excluded), is on the who qualifies page.

What does a contractor-specific screen look like?

Use the three-bucket sort before you mention SourceX: Restricted, Review, Free.

• Restricted: does the company know where its CUI, export-controlled and classified data lives, and can it be walled off from any scope?
• Review: which commercial records mention contract numbers, customer names or teaming partners, and would need redaction or consent?
• Free: is there a body of commercial records, such as internal support, finance operations and SOPs, that touches no controlled material?
• Authority: can the CEO, CFO or contracts lead act as sponsor and engage counsel?
• Not already committed: has any of the commercial data been licensed already for AI training?

If you cannot answer the first item with confidence, pause. A contractor that cannot map its controlled data should not be offering any scope to buyers.

What should come before an introduction?

1. Ask the sponsor whether the contracts contain data-rights or dissemination clauses that touch the records you are discussing.
2. Ask whether the company has a security officer or counsel who can confirm what is controlled.
3. Confirm the company will keep controlled data out of every conversation, including the inventory stage.
4. Check the cyber and D&O insurance question with the company's broker, since a new data flow can change a risk disclosure.
5. Only then make the introduction. SourceX qualifies size, history, data breadth and rights with the company, and any redaction rules are agreed before work begins.

Contractors that are also thinking about building rather than licensing can compare options in build a data product or license data to AI developers. Anything under a legal hold needs its own review; see litigation hold: can records under a legal hold be licensed?. For the general idea, what is data licensing for AI is a good primer for the sponsor.

What can a CPA firm say to a GovCon sponsor?

Keep the message free of contract numbers, agency names and any description of restricted material.

How are partner rewards handled, and what about professional rules?

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 cumulative per referred company. The reward is payable only after the buyer pays and SourceX receives its fee; a lead, meeting or signed agreement alone does not trigger payment, and no reward is guaranteed. The reward is a share of SourceX's fee and never reduces what the company receives. CPAs should check the AICPA Code of Professional Conduct provisions on commissions and referral fees, their state board and their firm's policy before accepting any reward, especially for attest clients. This is general information, not legal, tax or financial advice.

When should you not make the introduction?

• Nearly all records sit inside a CUI or export-controlled environment.
• The contract forbids third-party disclosure and the agency will not consent.
• The company cannot separate commercial records from program records.
• The sponsor will not involve counsel.
• A trustee, receiver or agency controls the assets.

Next step

If a contractor client passes the Restricted, Review, Free screen, register as a partner and make the introduction, or let the sponsor apply at sourcex.si/apply with your referral link. You can also try the company fit checker first.