# Who can license nonconformance records? | SourceX

Canonical: https://refer.sourcex.si/questions/who-can-license-nonconformance-disposition-records
Last updated: 2026-10-19

Start with the quality director, who owns the nonconformance procedure and knows where the records and their gaps are, then bring in the CEO, who can open a licensing discussion. General counsel joins when records cite customer drawings or quality agreements, and suppliers' own reports may need separate treatment. Administrator access to the QMS is not authority. Whatever the tree suggests, the final answer on what can be licensed stays open until SourceX's rights review.

This page is part of the [nonconformance disposition guide](/guides/workflow-nonconformance-disposition). It answers one question with a tree: who can say yes, and where the yes stops being theirs to give.

## The tree, from record to signature

Walk it top to bottom. Each node is a question the partner can answer from a conversation, without seeing a single NCR.

1. **Who runs the nonconformance procedure?** Usually the quality director or quality manager. They are the sponsor and the first conversation.
   - If nobody owns the procedure end to end (common after a merger), find who signs off defective lots today and start there.
2. **Do the records sit only in the company's own systems?** QMS, MES, inspection software and the quality mailbox are typical. The [system map for these records](/guides/nonconformance-disposition-records-across-systems) shows the usual set.
   - If some history sits with a former parent company or an outsourced quality provider, note it as an open ownership question.
3. **Do the records cite customer drawings, specifications or concessions?** For a contract manufacturer, almost always yes.
   - Yes: general counsel or outside counsel reviews the customer quality agreements before any proposal. The page on [who owns customer drawings](/questions/who-owns-customer-drawings-contract-manufacturer) frames the usual position.
   - No (a proprietary product line): the path is shorter, but counsel still checks confidentiality terms.
4. **Who can authorize a discussion about licensing company data?** The CEO. Plant managers confirm production history but do not decide.
   - If the company has a board or investor consent rule for new revenue lines, see [whether licensing data requires board approval](/questions/does-licensing-data-require-board-approval).
5. **End of the tree: SourceX rights review.** The partner's path stops at an authorized introduction. What can be licensed, excluded or de-identified is decided after it.

## Records by origin and who decides

Not every record in a disposition file belongs to the company in the same way. Sorting by origin tells you which branch of the tree a record class follows.

| Record origin | Typical examples | Who usually holds authority | Extra sign-off to expect |
|---|---|---|---|
| Company-generated, proprietary product | Defect reports and review minutes for the company's own designs | CEO, with quality director as sponsor | Counsel checks confidentiality obligations |
| Company-generated, citing customer material | NCRs and inspection reports against a customer drawing | CEO, subject to customer agreements | General counsel reviews quality agreements |
| Customer-originated | Concession approvals, customer deviation forms, portal records | Shared; depends on the customer contract | Counsel; possibly customer consent |
| Supplier-originated | Supplier NCRs, corrective action responses, certificates | Depends on supply agreements | Counsel; may be excluded |
| Third-party audit | Registrar audit reports and findings | Check the registrar contract first | Counsel; may be excluded |

The customer-originated row deserves care. ISO's vocabulary defines a concession as permission to release product that does not meet specified requirements, and ISO 9001 auditing guidance has auditors check that such a release was approved by a relevant authority and, where applicable, by the customer. That makes concession records valuable evidence and also the records most likely to carry the customer's terms.

## Role by role: what each person can say yes to

| Role | Can confirm | Can authorize a licensing discussion? | What to ask them |
|---|---|---|---|
| Quality director or manager | Record classes, years, gaps, where concessions live | Rarely; sponsors it | "Which years and systems hold dispositions?" |
| Quality engineer or QMS administrator | Field names, which keys are captured | No | Facts only, through the director |
| Plant manager or operations director | MES history, rework volumes | Rarely | "Would production records join the quality ones?" |
| CEO | Strategic fit and whether to explore | Yes | "Would you take a first call about licensing?" |
| General counsel or outside counsel | Customer and supplier agreement limits | Advises; may need to clear it | "Do quality agreements restrict reuse?" |

The [guide to finding the right decision-maker](/guides/how-to-find-the-right-decision-maker-for-a-data-partnership) covers the general approach for other kinds of companies.

## Where the answer stays unknown

Some branches cannot be resolved by the partner or the company in a first meeting, and saying so honestly makes the introduction stronger:

- **Customer consent.** Whether a customer's quality agreement allows reuse of records citing its drawings is a legal reading, not a guess.
- **Inherited records.** NCRs from before an acquisition may belong to a seller or be covered by the purchase agreement.
- **Personal data.** Operator and inspector names appear on shop paperwork and signatures; how they are handled is part of data preparation.
- **Buyer interest and offer.** Whether there is demand for disposition histories, and on what terms, is unknown until SourceX reviews the opportunity.

The [why data rights matter page](/proof/why-data-rights-matter) explains why SourceX checks rights before anything is proposed. SourceX licenses approved business data directly from companies for AI training and evaluation, and manages the agreement, rights review, data preparation, delivery and payout.

## Before you introduce: the authority check

Run three checks before submitting, so the introduction names the right person:

- **Sponsor confirmed.** The quality director agrees the records exist and is willing to raise the idea internally.
- **Signer named.** The CEO has agreed to a first call, or the sponsor has committed to ask.
- **Company fit.** The introduced company needs 50+ full-time employees at peak (contractors excluded), a documented operating history, rights to license and an authorized contact. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of the data is in English.

Partners sign the Channel Partner Agreement before submitting introductions, and the first valid introduction within the 90-day window is credited when the company submits a verified application. For the note itself, use the [nonconformance referral brief template](/resources/nonconformance-disposition-referral-brief-template).

## Next step

> **Refer a company. Earn up to $100,000.** Default reward: 25% of Actual Supplier Payout, capped at $100,000 cumulatively per referred company. Eligibility and payment conditions apply, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.

Once the tree ends at a CEO willing to take a call, [register as a partner](/register), confirm the company against [who qualifies](/who-qualifies), and read the [program terms](/terms) before you introduce them.

## Sources

- https://committee.iso.org/files/live/sites/tc176/files/PDF%20APG%20New%20Disclaimer%2012-2023/ISO-TC%20176-TF_APG-CustomerCommunication.pdf
- https://committee.iso.org/files/live/sites/tc176sc1/files/Terms%20in%20TC%20176%20Standards%20Alphabetical%20Listing%20V1%202022%2009%2029.pdf
- https://refer.sourcex.si/terms