Annual legal checkup for businesses: the checklist, plus a data rights review

What an annual legal checkup covers, and where data rights fit

An annual legal checkup is a yearly review in which outside general counsel walks the owner, CEO or CFO through entity records, key contracts, people issues, intellectual property, privacy, insurance and open disputes, so small problems get fixed before a financing, sale or lawsuit exposes them. A short data rights section now belongs in it.

The reason is that a company's records carry obligations and, increasingly, value. Email, CRM history, support tickets, project files and engineering systems can be licensed to AI developers for training and evaluation, but only where the company holds the rights and someone can authorize the deal. Four questions settle most of it: what customer contracts allow, what employees and customers were told, who controls the archives, and who can sign. The answers double as an early screen for a SourceX introduction.

The checklist

Send the document request ahead of the meeting, then work through each group in one sitting. Mark every line closed, open or not applicable.

Entity and governance

• Good-standing certificates pulled for the state of formation and each state where the company is registered
• Annual reports, franchise tax filings and registered agent details current
• Bylaws or operating agreement match how decisions are really made
• Minutes or written consents on file for the year's major decisions
• Cap table, equity grants and transfer restrictions reconciled

Commercial contracts

• Top customer and vendor agreements logged with renewal, termination and notice dates
• Assignment and change-of-control clauses flagged before any financing or sale
• Liability caps and indemnities compared with current insurance limits
• Agreements that expired, or were never signed, but are still being performed

People

• Contractor and part-time roles tested against the classification rules in each state where people work
• Handbook updated for new state and local requirements
• Confidentiality and invention-assignment agreements signed by every employee and contractor
• Non-compete and non-solicit terms checked against current state law

Intellectual property, privacy and insurance

• Trademark renewal dates calendared; domains registered to the company rather than an individual
• Software and SaaS licenses matched to actual seats and use
• Privacy policy compared with what the company actually collects and shares
• Insurance schedule reviewed with the broker, including limits and retentions
• Demand letters, open disputes and litigation holds logged

Data rights review

• Customer contract restrictions. For the top customer agreements, note what the confidentiality, data-use and return-or-delete clauses let the company do with records it holds about or for each customer, and whether any clause mentions machine learning or model training.
• Privacy promises. Collect every dated version of the privacy policy and terms of service. FTC staff have written that promises not to use customer data for undisclosed purposes such as model training are enforceable, and that adopting more permissive practices only through a surreptitious, retroactive change to terms may be unfair or deceptive.
• Employee notices and work ownership. Confirm the handbook and IT policy say business systems and communications belong to the company. The Copyright Office's Circular 30 on works made for hire explains that work employees prepare within the scope of employment belongs to the employer, while commissioned work qualifies only in listed categories with a signed agreement, so contractor output usually needs a written assignment.
• Recorded calls. Check notice practice for recorded sales and support calls; California's Penal Code 632 requires all parties' consent to record a confidential communication.
• Archive control. Identify who administers legacy email tenants, retired CRMs and old file shares, whether complete exports exist, what the retention schedule deletes and when, and whether a migration or vendor shutdown is planned this year.
• Authorized signatory. Confirm who can sign a data license under the governing documents, whether board, member or lender consent is needed, and whether an investor rights agreement gives anyone a say. Because 17 U.S.C. 201 lets an owner transfer rights in whole or in part, a company can license a defined use, such as AI training, while keeping everything else.

This is general information, not legal, tax or financial advice. Requirements differ by state, so apply the rules of every jurisdiction where the client operates and employs people.

When to schedule it

How to run the session

1. Send the document request a few weeks out: governing documents, contract list, handbook, every privacy policy version, the insurance schedule and a list of business systems with the year each went live.
2. Pre-fill the checklist from what your file already holds so the meeting covers only open items.
3. Take the data rights block right after commercial contracts, since the same agreements answer both.
4. Bring in the person who administers systems for the archive-control questions; the CFO rarely knows which old tenants still exist.
5. Close with a one-page memo listing closed items, open items with an owner and date, and anything to revisit next year.

How to use the results

The company fit checker needs no contact details, and the who qualifies page sets out the full baseline. Once a client says yes, the data opportunity handoff checklist for annual client reviews covers what to pass along.

Red flags that end the licensing conversation

• The records mainly belong to the client's own customers, as at agencies and outsourcers, and those customers have not consented.
• The data is chiefly consumer personal information with no licensing basis, or protected health information without HIPAA authorization or de-identification.
• The archives were deleted, or nobody can produce an export.
• A receiver, trustee or assignee controls the assets and has not been involved.
• The same data is already licensed for AI training.
• Records were generated with AI in order to sell them.
• The owner will not consider an exclusive license for an agreed term.

Raising SourceX with a client, and your own rules

If the client clears the review and fits the baseline, the introduction is short. The client can apply directly at sourcex.si/apply using your referral link, or you submit the company through the referral form. Either way you share only basic fit facts, never the checkup memo, which is confidential and may be privileged.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, up to $100,000 per referred company, paid only after the buyer pays and SourceX receives its fee; no reward is guaranteed and nothing comes out of the client's proceeds. Referral compensation for lawyers is governed by each state's rules of professional conduct, so read the ethics checklist for lawyers recommending a vendor and your own jurisdiction's rules before accepting anything.

Where the client has an outside board, the signatory question often reaches its agenda; the page on referral opportunities for independent board directors covers that seat. If a sale is planned, quality of earnings providers will be reading many of the same contracts.

Next step

Add the data rights block to your next annual checkup template. When a client clears it and wants to explore licensing, register as a partner so your introduction is credited, then let the client apply directly or submit it through the referral form.