AI training data regulation in 2026: a one-page summary advisors can adapt

AI training data regulation in 2026 is a patchwork, not one law. For a US company licensing its records, the deciding rules are copyright ownership, privacy promises, California privacy law, health and financial data limits, recording consent and, for EU-facing buyers, the EU AI Act. Partners who only introduce mainly face endorsement-disclosure and professional rules.

What this summary covers and how to use it

AI training data regulation in 2026 is a set of separate rules, each touching a different part of a licensing deal. This page lists the ones that most often decide whether a US company can license its business records for AI training, checked against primary sources as of October 2026, with what each means for the supplier company and for a partner who only makes the introduction.

Use it to prepare a client conversation, then hand the specifics to the company's counsel. For a primer on the asset itself, see what AI training data is.

This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

Which rules carry 2026 dates or bear directly on AI training?

Five items belong on the 2026 page. Dates and status are as checked in October 2026.

Rule and source	Status as of October 2026	What it means for a US supplier company	What it means for a partner who only introduces
California privacy regulations (CPPA regulations index)	Updated CCPA regulations took effect January 1, 2026, including rules on risk assessments, cybersecurity audits and automated decisionmaking technology; some compliance deadlines phase in from 2027 to 2028	If records include California consumers' personal information, counsel checks notices, purposes and contracts before anything is licensed	No direct duty; never collect, forward or describe personal data
California Consumer Privacy Act (Civil Code 1798.100 et seq.)	In force; requires notice at collection, and a business that sells or shares personal information needs a written agreement limiting its use; one coverage test is gross annual revenue of $26,625,000 or more, as adjusted January 1, 2025 (CPPA FAQ)	Whether a license counts as selling or sharing turns on the definitions in section 1798.140 and on what the records contain	None beyond staying out of the data
EU AI Act (Regulation 2024/1689)	A consolidated text dated 27 July 2026 reflects amendments; the EUR-Lex summary lists high-risk requirements from 2 December 2027 (Annex III) and 2 August 2028 (Annex I)	Regulates AI systems and models on the EU market and those who provide or deploy them; ask counsel whether any duty reaches a data supplier	None
Copyright and AI report (US Copyright Office)	Part 3, on generative AI training, was released as a pre-publication version in May 2025; it is a report, not law	It examines where training may implicate copyright, how fair use may apply and how practical licensing is, and notes that model performance depends heavily on data quality	Point clients to the report; do not paraphrase its conclusions
FTC staff guidance on AI and privacy promises (January 2024, February 2024)	Staff blog posts from the prior FTC leadership, not rules	Promises not to use customer data for model training are enforceable, and quietly changing terms retroactively may be unfair or deceptive	Never suggest a company rewrite its terms to make data licensable

Which standing rules still decide most rights reviews?

Older rules still do most of the work when counsel reviews a license.

Rule and source	What it says	Supplier meaning	Partner meaning
Copyright ownership (17 U.S.C. 201; Circular 30)	Work prepared by an employee within the scope of employment is a work made for hire owned by the employer; commissioned work qualifies only in listed categories with a signed written agreement	Employee-created records are generally the company's; contractor or agency material may need a written assignment	Ask who created the records during the fit conversation
HIPAA de-identification (HHS guidance)	Data de-identified by Safe Harbor (removing 18 specified identifiers) or by Expert Determination is no longer protected health information	Companies whose value is mainly medical records or claims need authorization or de-identification and are rarely a fit	Do not pitch PHI-heavy companies as data suppliers
Gramm-Leach-Bliley Act (FTC guidance)	Financial institutions under FTC jurisdiction give privacy notices and opt-out rights before sharing customer information with certain nonaffiliated third parties	Financial firms need counsel to scope customer information out of any license	None
Recording consent (18 U.S.C. 2511; Cal. Penal Code 632)	Federal law permits recording with one party's prior consent; California requires all parties' consent for confidential communications	Call recordings and transcripts need their consent and notice history checked	None
GDPR (Regulation 2016/679)	Can apply to organizations outside the EU that offer goods or services to, or monitor, people in the EU	Records holding EU residents' personal data raise GDPR questions even for a US company	None
Bankruptcy sales of personal data (11 U.S.C. 363)	If a debtor's privacy policy barred transferring personally identifiable information, a trustee may sell it only consistently with that policy or with court approval after a consumer privacy ombudsman is appointed, notice and a hearing	Wind-down and bankruptcy cases need the trustee or court involved before any license	Restructuring professionals involve the estate from the start
Endorsement disclosure (16 CFR Part 255; FTC FAQ)	Revised in 2023; a material connection between an endorser and a marketer should be disclosed clearly and conspicuously	None	A partner who publicly recommends SourceX while earning a referral share should say so, close to the recommendation

CRM and ERP histories show why the privacy rows matter: they are valuable to agent builders and often carry customer contact details, as explained in why AI agent builders want CRM and ERP history.

What do these rules mean for a partner who only introduces?

Very little lands on you directly, because you never touch the data. Partners introduce companies and share basic fit information; the company, its counsel and SourceX handle the rights review, redaction and contracts, and nothing is delivered before an executed agreement and the company's authorization.

Three points do apply to you:

Disclosure: if you recommend SourceX in a newsletter, post or webinar while earning a referral share, disclose it next to the recommendation. The FTC's FAQ favors plain wording that says you are paid over a bare label such as affiliate link.
Professional rules: CPAs, lawyers and registered representatives have their own rules on referral fees and disclosure. Check them before you register.
No legal conclusions: telling a client its data is cleared, or that training on it is fair use, is for counsel to say, not you.

Sell-side advisors meet the same rights questions in diligence; AI in M&A 2026 covers what to tell clients.

The client briefing note template

Use this after a first fit conversation, when an owner asks what legal questions come up. It turns the summary into a short note the owner can forward to counsel.

Subject: AI data licensing: questions for your counsel Hi {first_name}, Thanks for the conversation on {date}. Below are the rules your counsel will likely want to review before {company_name} considers licensing records for AI training. It is a checklist for your advisers, not legal advice from me. Ownership: records employees create in their jobs are generally the company's; material from {contractors_or_agencies} may need a written assignment. Privacy promises: what your privacy policy and customer terms say about using data for other purposes, including model training. Personal data: whether {systems_with_personal_data} hold information about California consumers, EU residents, patients or financial customers. Recordings: how {call_recording_system} captured consent, especially for calls with people in all-party-consent states such as California. Process: nothing is shared until you sign an agreement and authorize delivery, and redaction rules are agreed before any work starts. If you want to explore it, SourceX runs the inventory, rights review and contracting. You can apply at {referral_link}, or I can make the introduction. {your_name}

How to personalize the note

Placeholder	Where it comes from	Tip
{first_name}, {company_name}	Your own contact record	Address the sponsor: owner, CEO, CFO or authorized representative
{date}	The fit conversation	Note this page's check date too
{contractors_or_agencies}	Ask who produced documents, code or content	Name the category, such as an outsourced support vendor
{systems_with_personal_data}	The company's own system list	Name systems, never their contents
{call_recording_system}	Sales or support call tools	Delete the line if the company does not record calls
{referral_link}	Your partner account	Keeps your credit when the company applies itself

Follow-up timing

Send the note within two business days of the conversation, while the details are fresh.
Follow up once after about a week if there is no reply.
Once the company's counsel is involved, step back; the rights review runs between the company and SourceX.
If more than a quarter has passed since this page's check date, re-check each row's source before you send.

What never to include

Samples, screenshots or exports of the company's records.
Legal conclusions, such as saying the data is cleared or that training on it is fair use.
Promises about price, timing, buyer interest or payment.
Reward figures, or any suggestion that a referral reward is certain.
Any claim that a fit-checker result means approval.

What this summary leaves out on purpose

These topics matter but were not verified against primary text for this page, so ask counsel for the current position:

Court decisions and settlements about AI training and fair use.
State AI-specific statutes and any duties they place on AI developers.
EU AI Act details for general-purpose AI model providers.
Final Copyright Office conclusions beyond the pre-publication Part 3 report.
Copyright and AI policy outside the US and EU.
Tax treatment of referral payments.

Next step

To see whether a company is worth the conversation, check the who qualifies baseline or run the company fit checker. When it looks right, register as a partner and make the introduction. For the commercial picture behind these rules, read data monetization trends in 2026.

Step 1Share your linkSend your personal link to a company you know.
Step 2Company appliesThe company applies itself at /apply.
Step 3Buyer selects and paysThe buyer selects and pays for the data and SourceX receives its fee.
Step 4You get your rewardYour share of SourceX fees becomes payable.

Common questions

Is licensing business records for AI training a sale of personal information under the CCPA?

It depends on what the records contain and how the license is structured. The CCPA's definitions of selling and sharing sit in Civil Code section 1798.140, and many operational records, such as engineering tickets or internal procedures, hold little consumer personal information. Where California consumer data is present, the company's counsel decides whether redaction, de-identification or notice changes are needed, and those requirements are agreed before any work begins.

Does the EU AI Act apply to a US company that only supplies records?

The Act sets rules for AI systems and models placed on the EU market and for the organizations that provide or deploy them. Whether any duty reaches a company supplying records depends on its role, which counsel should confirm. Application dates have changed since adoption, so rely on the consolidated text on EUR-Lex rather than older summaries, and expect buyers serving the EU to ask about data origin and rights.

Who owns the documents employees create, for licensing purposes?

Under US copyright law, a work prepared by an employee within the scope of employment is a work made for hire, and the employer is treated as its author and owner. Material from contractors or agencies is different and may stay with its creator unless a written assignment or a qualifying signed agreement says otherwise. Copyright is only one question; privacy, confidentiality and contract terms still apply.

How current is this summary, and when should it be re-checked?

It was checked against primary sources in October 2026. Several items move on known dates: some California compliance deadlines phase in from 2027 to 2028, and EU AI Act high-risk requirements are listed for December 2027 and August 2028. Re-check each row's source before reusing the summary after a quarter, and let the company's counsel have the final word on anything specific.

Can an advisor give this summary to a client?

Yes, as dated general information with its sources, not as legal advice. Keep the check date visible, avoid adding your own conclusions about whether the client's data is cleared, and suggest that the client's counsel review it. If you also recommend SourceX publicly while earning a referral share, disclose that connection clearly and close to the recommendation, as the FTC's endorsement guidance describes.

Free resources

Cash flow calculator — A 12-month cash forecast with shortfalls highlighted.
Referral earnings calculator — Hypothetical partner earnings with the per-company cap.
Cash conversion cycle calculator — DIO, DSO, DPO and the cash conversion cycle.
All free tools · MCP resource center

By SourceX Partnerships Team · Published 2026-10-09 · Updated 2026-10-09

Know a US company with valuable proprietary data?

Become a referral partner from anywhere we support, get your link and introduce an owner or authorized decision-maker.

Refer a company →

I own a business

Explore licensing your company's data to AI developers worldwide. Start a short assessment; no uploads needed.

Start an assessment