Ten questions a CFO should answer before licensing company data

The short answer: ten questions in four groups

Before anyone introduces the company to a licensing platform, the CFO should be able to answer ten questions covering its records, rights, reach and readiness. Each one is go or no-go. A clear no on any of them pauses the idea until it is fixed or ruled out, which spares the owner weeks spent on a license the company could never deliver.

The questions follow the 4R screen (Records, Rights, Reach, Readiness) and draw on SourceX's own qualification baseline and red flags. They come before contract review: once a company is qualified and terms are on the table, the CFO checklist for evaluating a data licensing agreement takes over.

The ten go or no-go questions

Records: is there enough to license?

• 1. Is the company big and old enough? Go: a US company with 50+ full-time employees at peak (contractors excluded) and several years of documented operations. No-go: a smaller team or a short history, whatever the systems look like.
• 2. Are the records spread across many systems, and do they show outcomes? Go: email, chat, shared drives, CRM, finance, support, engineering and operations tools, ideally ten or more, several with five to ten years of history, where you can see what happened next: tickets resolved or escalated, deals won or lost, invoices approved or disputed. No-go: one or two systems holding fragments.
• 3. Can someone still export them, archives included? Go: a named administrator can run complete exports, and retired systems were exported or kept read-only. No-go: archives deleted, tools cancelled without an export, or nobody who knows how.

Rights: may the company license what it holds?

• 4. Did the company create this material itself? Go: records produced by employees doing their jobs. Work an employee prepares within the scope of employment is generally owned by the employer as a work made for hire, as the Copyright Office's Circular 30 explains; contractor material may need a written assignment. No-go: records that mainly belong to the company's clients, common at agencies and outsourcers, without those clients' consent.
• 5. What did contracts, privacy notices and employee policies promise? Go: nothing in them bars the intended use, or the affected material can be excluded. In a February 2024 post, FTC staff cautioned that adopting more permissive data practices, such as using data for AI training, and disclosing them only through a quiet, retroactive change to terms or a privacy policy could be unfair or deceptive. No-go: promises that cannot be honored with redaction or exclusion.
• 6. Is the data mainly consumer personal data or patient health information? Go: business records where personal details are incidental and can be redacted. HHS describes the two HIPAA de-identification methods, Expert Determination and Safe Harbor, in its de-identification guidance. No-go: mainly protected health information without authorization or de-identification, or mainly consumer data with no licensing basis.
• 7. Is the data free of earlier commitments and outside control? Go: never licensed for AI training, and no lender, receiver, assignee or court controls the assets without being involved. No-go: an existing AI-training license on the same data, or records generated with AI in order to sell them.

Reach: who can say yes?

• 8. Is there an authorized sponsor who can sign? Go: the owner, CEO, CFO or another authorized representative will sponsor it, and you know which board, investor or lender consents apply. No-go: no one with authority will own the decision.

Readiness: would the company actually do it?

• 9. Will the owner accept the deal structure? Go: the owner is open to licensing, not selling, the data under a license that is typically exclusive for AI training for an agreed term, in return for one all-in price paid once. No-go: the owner will not consider exclusivity in any form.
• 10. Who will do the internal work, and when? Go: a named person owns the data inventory and later exports, and the calendar has room outside year-end close and audit fieldwork. No-go: nobody has the time this year.

How to use the results

If the company has a board or an outside investor, the answers make a ready-made appendix for presenting a data licensing opportunity to a board.

Questions to take to counsel

The rights group is where outside advice earns its fee. Bring these to the company's lawyer before any introduction:

1. Do any customer, supplier or partner contracts restrict how records that mention them may be used?
2. Do our privacy notices, terms or employee policies limit secondary uses of the data, and when did each version apply?
3. Which board, investor or lender consents does a new license need?
4. Which categories of records need de-identification or redaction, and to what standard?
5. Would an exclusive license complicate a future sale or financing? The explainer on exclusive licenses and a future sale is a useful starting point.

This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.

What happens to sensitive records if the answers are yes

A yes on the rights questions does not mean everything ships as it sits in the systems. De-identification and redaction requirements are agreed with the company before any work begins, and data is delivered only after an executed agreement and the company's authorization. The explainer on how company data is anonymized before AI licensing walks through the usual approach.

Next step

Work through the ten questions with the controller and IT lead, and compare the answers with the published who qualifies criteria. Advisors who want to introduce qualifying clients can register as a partner; owners can apply directly at sourcex.si/apply. The fractional CFOs page covers the advisor side in full.