Do not infer AI permissions from ordinary internal-use access. Map ingestion, embeddings, retrieval, external processing, training and deletion separately, then review each against the actual licence and applicable law.
Does internal use include an AI research assistant?
Not automatically. An analyst reading a report and a system copying that report into a searchable corpus perform different activities. A private interface does not establish that every underlying processor, storage location or subsequent use is permitted. Describe the proposed workflow before asking for a permission decision: which documents enter, which organization operates the system, and which users can retrieve passages or export answers.
WIPO's copyright FAQ distinguishes protected expression from unprotected ideas. That does not resolve a particular AI ingestion arrangement. The inventory below supports procurement review; it does not establish that every embedding requires a licence or that every internal deployment qualifies for a legal exception.
Separate retrieval from changing model parameters
Retrieval typically selects stored material to supply context for a response. Training or fine-tuning changes model parameters using a dataset. The same project can do both, and an operator's improvement program may introduce training even when the buyer only requested retrieval. Ask for specific processing and retention terms rather than relying on a product label such as private AI or enterprise search.
Include intermediate artifacts in the review: extracted text, document chunks, vector representations, indexes, prompts, response logs and evaluation sets. Identify whether those artifacts remain linked to restricted source material and who can access them. A licence that permits retaining a finished committee memo may say nothing about preserving an entire reusable corpus after the research subscription ends. Record the distinction rather than assuming identical treatment.
Inspect a synthetic permission matrix
Consider an entirely fictional scope request involving forty research documents. The buyer proposes a retrieval index for six named employees, with no external recipient access and no parameter training. These counts define a hypothetical request, not an allowance offered by any supplier. The matrix deliberately separates copying into the index from showing a short passage to an authorized user because approval of either activity need not settle the other.
The reviewer would attach the relevant agreement provisions and technical evidence to each row. An unresolved row remains unresolved; the table does not grant rights. If the processor retains prompts for its own improvement, that changes the stated request and must return for review. The example is useful precisely because a system can satisfy its user-access restriction while failing its separate processing or retention boundary.
| Illustrative requested activity | Requested boundary | Evidence to resolve |
|---|---|---|
| Index 40 documents | Buyer-controlled retrieval only | Copying and retention permission |
| Retrieve passages | Six named employees | Recipient and extract scope |
| Parameter training | Excluded | Processor terms and settings |
| End of licence | Disposition reviewed separately | Index, backups and log treatment |
Check what leaves the approved boundary
Follow one sample query from the user's browser through retrieval, model processing and logging. Ask whether a support team can see its contents, whether attachments pass through another service, and whether an exported answer contains lengthy extracts. An assurance that documents never appear on a public website is narrower than evidence that no unapproved recipient receives them. Include the system's troubleshooting route, not just its normal interface.
NIST's Generative AI Profile identifies intellectual-property and data-privacy risks among the issues organizations should manage. It is a risk framework, not permission to ingest licensed material. An appropriate buyer response is to request an inspectable data-flow description and test with synthetic documents first. Do not upload restricted reports to an unapproved service merely to discover whether its search or deletion features work as advertised.
Test deletion without promising unlearning
Deleting a source file may leave chunks, indexes, cached responses and backups elsewhere. Ask which objects are removed, when access stops, and what evidence demonstrates the stated result. For retrieval, a synthetic identifier planted in a test document can help check whether the active index still returns it after deletion. A negative search result alone does not prove that every stored copy has been erased.
Training introduces a different exit question because removing a dataset is not equivalent to reversing its influence on parameters. Avoid promising model unlearning based on a document deletion button. Before allowing training, resolve the intended continuing use, any required disposal and the evidence the parties can realistically provide. Where the buyer cannot establish an acceptable end-state, narrow the proposed activity rather than describing an untested remedy as reliable.
Record decisions by activity and reopen them on change
The approval record should answer concrete questions: may the buyer create the index, may this processor receive passages, may users export responses, and may any party train on the material? Name the agreement version and technical configuration reviewed. Keep a rights decision separate from answer-quality testing; a permissioned assistant can still misquote research, and an accurate answer can still expose material beyond its agreed audience.
Failure modes include enabling processor improvement, adding affiliates and retaining trial corpora beyond approval. Link the activity record to source-level rights and retention inventories. Generated prose is not automatically unrestricted merely because it looks new; review its content and permitted audience.
Evaluation checkpoints
- Internal delivery is not a blanket AI permission.
- Separate retrieval artifacts, processor disclosure and parameter training.
- Deletion evidence must identify which copies and artifacts it covers.
Source notes
Related questions
Internal Use and Redistribution of Model Results
Map recipients, channels and transformations before sharing licensed investment model material outside an evaluation team.
Derived Data and Retention After a Licence Ends
Classify transformed outputs, working copies and evidence archives before agreeing to deletion or post-termination access.
Data Rights Versus Model Rights
Trace input licences, model permissions and output distribution without assuming one agreement covers the entire workflow.
First edition, 16 October 2026. Illustrative procurement situations are not actual client engagements or legal advice.