Can You Use Licensed Data To Train AI?

Priya runs a Melbourne AI startup that helps retailers forecast stock demand. A data provider offers her years of product, pricing and sales data, and the deal looks perfect - until she asks one simple question: can we use this dataset to train and fine-tune our model?

The supplier says, "You can use it for analytics." Priya hears, "Great, we can build our product with it." But those two things may not mean the same thing at all.

If your business is licensing data for AI, machine learning or analytics, the wording in your data licence agreement matters. A vague licence can leave you unsure about whether you can train a model, generate outputs, share results with customers or build a commercial product from what you've learned.

This doesn't have to be overwhelming. The key is to turn assumptions into clear contract terms before you plug the data into your systems.

Can You Use Licensed Data To Train AI?

It depends on what the licence says, because a right to access data isn't automatically a right to use it for AI training.

A lot of older data licensing agreements were written before generative AI and large-scale model training became common. They may say you can use the data for "internal business purposes", "research", "analytics" or "evaluation". Those words can be helpful, but they don't always answer the AI question.

For example, your business may want to use licensed data for:

• training a new machine learning model from scratch
• fine-tuning an existing model
• creating embeddings for search or retrieval tools
• benchmarking or testing model performance
• generating synthetic data
• improving an AI product over time using customer prompts or feedback
• creating outputs that will be shown or sold to customers

Each of these uses can carry different legal and commercial risks. If the contract only says "analytics", a supplier may later argue that model training went beyond what they agreed to.

On the other hand, if the agreement clearly permits training, fine-tuning, testing, product development and commercial use, you'll be in a much stronger position. The goal is to define the permitted uses in plain terms that match how your product actually works.

What Should A Data Licence Agreement Cover For AI Training?

A data licence agreement for AI training should clearly cover what data you get, what you can do with it, who owns what, privacy responsibilities, security standards and whether you can share it with others.

Think of the agreement as the rulebook for your dataset. If your product depends on that data, you don't want the most important rules sitting in email threads or assumptions from a sales call.

The Dataset And Access Rights

Your agreement should describe the dataset with enough detail that both sides know exactly what's being licensed. This may include:

• the type of data, such as text, images, transaction data, location data, audio, video or metadata
• the source of the data
• the format and delivery method
• how often the data will be updated
• any exclusions, missing fields or known limitations
• whether the data includes personal information, confidential information or copyright material

If the dataset will be refreshed monthly, accessed through an API or delivered as a one-off file, say so. If there are usage caps or rate limits, include those too.

Permitted AI Uses

This is where many AI data use contracts need extra care. You should spell out whether you can use the data for:

• internal evaluation and prototyping
• training, testing and validating AI or machine learning models
• fine-tuning models supplied by third-party providers
• creating embeddings, vectors or feature sets
• developing commercial software, SaaS products or analytics tools
• generating outputs for customers
• improving products after launch
• combining the dataset with other datasets

If you only need a limited use, such as a 60-day proof of concept, the licence can say that. If you're building a long-term commercial product, the licence should be broad enough to support that.

Restrictions You Need To Know About

A supplier may want to restrict certain uses. That's normal, but you need to know the boundaries before you build around the data.

Common restrictions include:

• no use for generative AI model training
• no use to build a competing dataset or competing product
• no redistribution of raw data
• no attempts to re-identify de-identified data
• no use for decisions about individuals, such as credit, insurance, employment or health outcomes
• no use outside Australia or no transfer to overseas cloud providers

Restrictions aren't necessarily a deal-breaker. The issue is whether they match your business model. If your product roadmap depends on a restricted use, you may need to negotiate before signing.

Who Owns The Dataset, Model And Outputs?

The agreement should say who owns the original data, trained model, derived data and outputs, because these aren't always the same thing.

Data licensing is usually not a sale. In most cases, the supplier keeps ownership of the original dataset and gives you permission to use it in certain ways. Your business may then create new things from that data, such as model weights, insights, reports, embeddings or customer-facing outputs.

That raises a practical question: what belongs to you, what belongs to the supplier and what can each side use after the agreement ends?

Original Data

The supplier will usually own or control the original dataset, or at least warrant that they have the right to license it to you. You should ask for clear warranties that they have the rights needed to provide the data for your intended use.

If the supplier only has limited rights themselves, they may not be able to grant you broad AI training rights. This is especially important where data has been scraped, aggregated from third parties or contributed by customers.

Derived Data And Model Improvements

Derived data can include cleaned data, annotations, labels, embeddings, statistical insights and feature sets. These items can become extremely valuable, especially if your team has invested time improving the dataset.

Your contract should say whether you own derived data you create, whether the supplier can access it and whether you can keep using it after the licence ends.

Model improvements need the same attention. If your model learns patterns from the licensed data, does the supplier have any claim to the model? Can you keep using the trained model after termination? Do you have to delete model weights or retrain without that data?

These questions are much easier to deal with upfront than after your product is live.

Outputs

Outputs are the content, recommendations, predictions, summaries or reports your system produces. If customers will rely on those outputs, your agreement should confirm whether you can use, display, sell and store them.

For example, if you license property market data to power an AI valuation tool, you'll want the right to show generated reports to paying customers. A licence that only allows internal analysis may not get you there.

How Do Privacy And Copyright Laws Affect AI Training Data In Australia?

Privacy and copyright laws can affect AI training data if the dataset includes personal information, sensitive information, creative material, software code or content sourced from third parties.

In Australia, the Privacy Act 1988 and the Australian Privacy Principles apply to many businesses, including businesses with annual turnover over $3 million and some smaller businesses, such as health service providers and businesses that trade in personal information. Even if your business is under the threshold, your customers or suppliers may require Privacy Act-style obligations in your contract.

Personal Information

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable. It can include names, email addresses, device IDs, location data, images, voice recordings and behavioural data.

If the dataset includes personal information, you need to think about:

• whether the information was collected lawfully and fairly
• whether individuals were told their information may be used for AI training or analytics
• whether the proposed use is within the original purpose of collection or a permitted secondary use
• whether sensitive information is involved, such as health information or biometric information
• whether data will be disclosed overseas, including to cloud or AI infrastructure providers
• how you'll secure the data and manage a data breach

Under the Notifiable Data Breaches scheme, an eligible data breach may need to be reported to affected individuals and the Office of the Australian Information Commissioner. Your data licence should set out practical breach notification steps, cooperation obligations and timeframes between you and the supplier.

De-identification can help, but only if it's done properly. If individuals can be reasonably re-identified, the data may still be personal information. For AI training, re-identification risk can increase when datasets are combined, so it's worth being cautious about "anonymous" labels that haven't been tested.

Copyright And Scraped Content

The Copyright Act 1968 can be relevant if the dataset includes text, images, audio, video, software code, product descriptions, articles, reviews or other creative material. Australia doesn't have a broad text and data mining exception that automatically lets you copy protected material for AI training.

This means you should check whether the supplier has the rights to license the material for your intended AI use. If the data was scraped from websites, you should also consider website terms, platform rules, confidentiality obligations and whether the collection method created other legal risks.

Copyright can also arise in a database or compilation where there has been enough skill and effort in selecting or arranging the material. Don't assume that because a single data point looks factual, the whole dataset is free to copy or train on.

Can You Share Licensed Data With Contractors, Customers Or Cloud Providers?

You can only share licensed data with contractors, customers, cloud providers or related companies if the agreement allows it.

This is a common gap in AI projects. Your technical setup may involve several parties, even if your commercial deal only names your business and the data supplier.

You may need to share or process the data through:

• cloud hosting providers
• AI model providers or API providers
• data labelling contractors
• software developers and consultants
• related companies or offshore teams
• enterprise customers who receive outputs or reports
• auditors, investors or potential acquirers reviewing your business

Your contract should make clear whether these are allowed disclosures, and whether a separate data processing agreement is needed. If they're allowed, you may need to ensure those parties follow confidentiality, privacy, security and deletion obligations.

For example, Mike runs a Sydney SaaS business that licenses customer support transcripts to train a support automation tool. His developers are in Australia, but the model API is hosted overseas and a data labelling team in the Philippines reviews sample tickets. If his data licence only permits use "by Licensee in Australia", Mike may be breaching the contract without realising it.

For privacy purposes, overseas processing can also raise Australian Privacy Principle 8 issues where personal information is disclosed to an overseas recipient. Your contract should deal with responsibility for cross-border disclosures and any customer notices or consents needed.

Practical Steps Before You Sign An AI Data Use Contract

Before you sign, you should check that the contract matches your actual product, technical architecture and growth plans.

A template can be a useful starting point, but AI data deals often need tailored drafting because small wording differences can change what you're allowed to build.

Map Your Intended Uses

Write down exactly how your business will use the data. Include your current product and realistic future uses.

Your list might cover:

• proof of concept testing
• training and fine-tuning
• human review and annotation
• combining with customer data
• use in a paid product
• customer reporting and dashboards
• product improvement after launch
• retention of model weights or embeddings after the agreement ends

Then compare that list to the permitted uses in the licence. If something isn't covered, ask for it to be added clearly.

Ask For The Right Warranties

Warranties are promises from the supplier. For an AI training data licence, you may want warranties that:

• the supplier has the right to license the data
• your intended use won't breach third-party rights, if the supplier has approved that use
• the data was collected lawfully
• privacy notices and consents were handled where required
• the dataset doesn't knowingly contain malware or unlawful material
• the supplier hasn't imposed conflicting obligations on the data

Suppliers may resist broad warranties, especially for aggregated datasets. That's a commercial negotiation. What matters is that the risk is visible and allocated in a way your business can live with.

Check Termination And Deletion Rules

Termination clauses can be especially tricky for AI. If the licence ends, do you need to delete the raw data only, or also derived data, embeddings, fine-tuned models and backups?

Your agreement, or a data processing schedule where relevant, should answer:

• what must be returned or destroyed
• whether you can keep audit records
• whether you can keep models already trained on the data
• whether you must stop selling products built using the data
• what happens to customer outputs already delivered

If the supplier expects full deletion from trained models, you need to know whether that's technically possible. If it's not, the contract should use a practical approach rather than promising something your engineering team can't deliver.

Align Your Customer Terms

If your product uses licensed data to generate customer outputs, your customer contracts, privacy policy and product terms should line up with the data licence.

For example, if your data supplier prohibits customers from reverse engineering raw data from outputs, your customer terms may need to pass that restriction on. If the supplier limits use to certain industries or territories, your sales team needs to know that before signing customers.

You should also avoid overstating what the data or AI system can do. The Australian Consumer Law prohibits misleading or deceptive conduct, so your marketing, demos and customer contracts should be careful about accuracy claims, model performance and limitations.

Key Takeaways

• A right to access data isn't the same as a right to use it for AI training, fine-tuning or commercial products.
• Your data licence should clearly define permitted AI uses, restrictions, ownership of derived materials and rights to use outputs.
• Privacy and copyright issues can sit underneath the dataset, especially where personal information, scraped content or third-party material is involved.
• Onward sharing with cloud providers, contractors, model APIs, offshore teams and customers should be expressly covered.
• Termination clauses should deal with raw data, derived data, embeddings, model weights, backups and products already in market.
• Your customer terms and marketing should line up with the data licence so you don't promise more than you're allowed to deliver.

If you'd like help with your AI data licence, privacy obligations, ownership clauses or customer terms for an AI product, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.