Questions boards should ask management about AI, data assets and licensing

Why directors need data questions, not only AI risk questions

Most director question lists cover AI adoption, risk and governance. Fewer ask what the company owns that AI developers cannot get elsewhere: years of records showing how real work gets done. Those records carry two exposures a board should see, value the company may be overlooking and value its vendors may be taking.

The supply picture explains why. Researchers at Epoch AI project that, if current trends continue, language models will fully use the stock of public human-generated text sometime between 2026 and 2032; it is a forecast with wide uncertainty. As AI shifts from answering questions to performing multi-step tasks, the material needed to train and test those agents is increasingly the permissioned, non-public record of real work inside companies.

The question set

Use the groups below across one or two meetings. Each question should produce a short written answer and a named owner.

Strategy and value

• Where are we using AI today, and which uses have a measured result in cost, revenue or quality?
• Which AI decisions are we postponing, and what does waiting cost us?
• How are customers and competitors changing what they expect of us because of AI?

Governance and accountability

• Which executive owns AI decisions, and which board committee oversees them?
• Do we keep an inventory of AI tools in use, including tools employees adopted on their own?
• How do we approve new AI uses that touch customers, employees or regulated data?

Vendor terms and data use

• Which vendors' terms let them use our data, or our customers' data, to train or improve their models, and where have we opted out?
• Have we changed our own privacy policy or terms of service to allow new data uses, and how did we tell people? FTC staff have warned that adopting more permissive data practices, such as using data for AI training, through a surreptitious, retroactive amendment to terms or a privacy policy may be unfair or deceptive.
• What have we promised customers about how their data will be used? FTC staff have also stated that promises not to use customer data for undisclosed purposes, such as training or updating models, are enforceable whether they appear in privacy policies, terms of service or marketing materials.

Both FTC posts are staff guidance, not rules. This is general information, not legal, tax or financial advice. Confirm with company counsel before acting.

Proprietary data assets

• Which records do we hold that are not on the public web: email, chat, documents, CRM, finance, support, engineering and operations history?
• How many years does each system cover, and which retired systems still hold history?
• Which records did we create ourselves, and which belong to clients or contain personal information?
• Which system changes planned in the next twelve months could delete or strand historical records?

Licensing posture

• Have we been approached to license data, and how did we respond?
• What is our stated position (not now, case by case, or actively exploring), and who decides?
• If we licensed records, what would we insist on keeping: ownership, exclusions, redaction rules, approval rights?
• Has anyone checked whether our records would qualify, and how much management time would it take?

How to read management's answers

For the approval step, the board memo template sets out a request to explore licensing, and the quarterly board meeting agenda shows where a recurring ten-minute data item fits. Directors new to the buyer side can read what an AI data buyer is before the discussion.

Red flags in the answers

• Nobody owns the data inventory, or each department keeps its own and none agree.
• Vendor data-use terms were reviewed once, at signing, and never again.
• One executive is discussing a data license informally without board visibility.
• Management has sent samples of records to an outside party before any agreement exists.
• The plan involves generating records with AI to sell them.
• Archives were deleted to save storage costs without anyone asking what they held.

Where the answers lead

If an exit is one to three years away, data decisions affect sequencing; the exit planning timeline shows when to raise licensing. If the company buys add-ons, put the acquired company's records into the post-merger integration checklist before its systems are retired.

Where the answers point to a candidate, the baseline for an introduction is a US company with 50+ full-time employees at peak (contractors excluded), several years of documented operations, rights to license its records and an authorized sponsor such as the owner, CEO or CFO. The who qualifies page lists the full criteria.

When a director is also a referral partner

A director who registers as a SourceX referral partner and introduces a company on whose board they sit has a personal interest in the outcome. Disclose it to the board in writing before the topic is discussed, follow the company's conflict-of-interest policy, and step out of any vote on a license if the policy or company counsel says so. Let management, not the director, present the facts.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. The reward is paid only after the buyer pays and SourceX receives its fee; an introduction, meeting or signed agreement alone does not trigger payment, and no reward is guaranteed. The reward comes out of SourceX's fee rather than the company's proceeds, but that does not remove the conflict, which is why disclosure comes first. With management's agreement, the introduction email builder drafts the note.

Next step

Send the vendor-terms and data-asset groups to management ahead of the next meeting. If the answers point to a strong candidate, register as a partner, disclose your interest, and let the CEO decide whether to proceed.