Questions AI data buyers ask companies in due diligence

What do AI data buyers ask a company before they license its records?

Buyers ask five things: where the records came from, who has the right to license them, what personal information remains, how the data was extracted and whether the story holds together across systems. Having written answers ready shortens the review and keeps the conversation about the data instead of the gaps.

You do not share the records themselves to answer these questions. Diligence at this stage is about documents, system descriptions and your own statements. Data is delivered only after an executed agreement and the company's authorization.

The PROVE checklist for buyer diligence

Use PROVE as a working name for the five areas: Provenance, Rights, Occupants (the people in the data), Verification and Extraction. Tick each box only when someone can show the answer.

Provenance: where did each system's records come from?

• A list of every system in scope, with the date it went live and the date it was retired, if it was
• Which records were created by your employees and which arrived from outside, such as client email or vendor feeds
• Any acquisition or migration that merged someone else's records into yours, with dates
• A note on whether any content was generated by AI tools, since buyers look for records of real human work and a company can lose credibility if AI-generated material is mixed in

Rights: can you license this?

• Customer, vendor and partner contracts reviewed for confidentiality, data-use and audit clauses
• Employee agreements and handbooks checked for ownership language; the Copyright Office explains in Circular 30 on works made for hire that employer ownership generally covers work prepared within the scope of employment, while contractor output may need a written assignment
• Third-party content (licensed software, bought research, stock material) identified and excluded
• Confirmation that nothing in scope was already licensed to another AI buyer
• Sign-off from an authorized sponsor: owner, CEO, CFO or authorized representative

Occupants: who appears in the records?

• An estimate of where employee, customer and third-party personal information sits in each system
• The privacy notices and terms of service in force when records were collected; FTC staff warn in a post on keeping privacy and confidentiality commitments that promises about not using customer data for undisclosed purposes can be enforceable
• Call recordings and chat transcripts identified, with the notice and consent practice used; recording rules differ by state, and California requires all-party consent for confidential communications under Penal Code section 632
• Health, financial or children's information flagged for exclusion or special treatment
• The redaction and de-identification approach agreed in writing before any processing

Verification: can the claims be tested?

• Date ranges that can be shown from system metadata rather than memory
• Volume estimates by system (record counts or storage size), labeled as estimates
• Outcome fields that exist: ticket resolution, deal won or lost, approval granted or refused
• A named person at the company who can answer technical questions

Extraction: how will the data leave your systems?

• Export methods for each system and who has admin rights to run them
• Archived or legacy systems that still have recoverable data
• Format notes: structured tables, documents, message threads, audio
• Where large deliveries will be staged; very large sets stay in your own storage or ship on encrypted drives rather than being hosted by SourceX

The data inventory builder turns most of the first and last groups into a system list you can reuse across buyers.

How to read your own answers

This is general information, not legal, tax or financial advice. Have your own counsel confirm which privacy, recording and contract rules apply to your records.

Questions buyers sometimes raise that surprise owners

• Whether the company would accept an exclusive license for AI training for an agreed term
• Whether any records came from a predecessor company or an outsourcer's client base
• Whether employees were told their work product could be licensed
• How long records are retained and whether deletion schedules have already removed years of history

Red flags that stop a review

A review usually stops if the data belongs to someone else without consent, is mainly consumer personal data with no licensing basis, is mainly protected health information without authorization or de-identification, or was already licensed for AI training. The same applies if archives were deleted, a court or trustee controls the assets, or nobody can export the data. The broker comparison shows why a people list is a different product from process records.

Two pages go deeper on the follow-on questions: what to expect if no buyer selects your data and indemnification terms, where the answers you gave in diligence become contract promises. For the wider decision, see the pros and cons of licensing company data and the ethics question. The page on what a data buyer is explains who is on the other side, and how it works shows where diligence sits in the process.

Next step

If you advise or know a US company with 50+ full-time employees at peak (contractors excluded) and years of records, register as a partner and introduce them. The company can also start at sourcex.si/apply.