Licensing company records for AI training: the rights questions buyers ask, and what public sources show

Abstract

Developers of AI models now license the working records of ordinary companies: support tickets, email, chat, CRM activity, documents and code. Whether a company may license such records is not one question but several, and buyers' counsel ask them in a recognisable order. This article compiles what public sources show on those questions for the United States, the United Kingdom and Canada, as of 18 October 2026. It draws on four open datasets (the terms of 18 business software systems, a 27-item rights checklist, 15 licence terms with their public evidence, and an 83-entry register of lawsuits and rulings), each row tied to a dated source and its own words, and on the statutes, regulator guidance and court filings those rows cite. Five findings stand out. Software vendors generally confirm that customers own their content, but 6 of the 18 systems read bar training AI on data pulled through their APIs. Privacy law in all three countries turns on notice, consent and de-identification, with markedly different standards. Under US copyright law employee communications are generally owned by the employer, yet they carry other people's rights. A court-supervised bankruptcy sale of an airline's records shows how de-identification, carve-outs and objections are handled in practice. And published licence terms diverge widely on purpose, model survival, exclusivity, deletion and indemnity. We close with the questions the sources leave open.

Keywords: AI training data, data licensing, privacy law, de-identification, CCPA, UK GDPR, PIPEDA, employee communications, bankruptcy section 363, terms of service