Build a lineage register linking each input, transformation and output to its supplier and proposed use. Check who supplies the data, whether the buyer needs a direct licence, and what permissions apply to storage, calculation and sharing. Resolve conflicts through the actual agreements and jurisdiction-specific review before expanding access.
Trace the calculation back to its inputs
List price histories, corporate actions, classifications, economic series, benchmarks and buyer-supplied holdings separately. For each input, identify the immediate supplier and, where available, the original provider. A model vendor may deliver a finished score without supplying the data used to calculate it. Conversely, a downloadable implementation may require the buyer to acquire inputs independently. Both arrangements can be workable, but their evaluation costs and permissions differ.
WIPO's copyright FAQ distinguishes expression from underlying ideas. That general distinction does not decide whether a particular dataset, database, access arrangement or downstream product can be reused. Avoid turning the statement that a numerical fact is not a computer program into a conclusion about unrestricted dataset copying. Ask qualified reviewers to consider the relevant contractual, database, intellectual-property and other legal questions in the jurisdictions actually involved.
Separate receipt, calculation and distribution
Describe three stages: receiving data, using it in a computation and distributing the resulting material. A buyer might be able to view a series through a terminal while needing different arrangements for automated processing or downstream delivery. Do not assume that every source uses those categories identically. Send the proposed workflow to the relevant provider and ask which current documents and permissions govern that specific activity.
Nasdaq's European policy resource center separately lists non-display and derived-data materials. This is a useful example of why a generic market-data subscription description is insufficient, not a statement that Nasdaq's terms govern every dataset. Save the applicable policy version and effective date when reviewing a real purchase. A page may display both current and future documents; a future fee or policy should not silently replace the version under consideration.
Check open-data exceptions at series level
The World Bank's terms summary notes that some third-party indicators have additional conditions recorded in metadata. The procurement lesson is narrow: a recognizable open-data portal is not enough to establish the reuse status of every series it distributes. Inspect the exact dataset metadata and controlling terms. Record attribution requirements and restrictions without suggesting that the original data provider endorses the buyer's model or resulting investment conclusions.
Treat buyer-supplied data with the same care. Owning an account relationship does not answer whether holdings files contain confidential client information or whether a provider can retain submitted records for other purposes. Specify the minimum fields needed for evaluation and prefer synthetic holdings when real data adds no analytical value. Keep privacy, confidentiality and security reviews connected to the data inventory while recognizing that they answer different questions from model licensing.
Work through a hypothetical input register
Consider a hypothetical allocation-model evaluation that requires five input families: prices, corporate actions, sector labels, economic indicators and a benchmark. The buyer can document a proposed permission route for three families, while sector labels and the benchmark remain unresolved. The register is therefore complete for 3 / 5 = 60% of families by count. That percentage is an administrative measure, not a probability that the evaluation is lawful or usable.
The benchmark may be indispensable even if it occupies only one row. The team requests clarification for both unresolved families and avoids producing purportedly comparable results from an improvised substitute. It can test file parsing with synthetic inputs in the meantime. No real provider's terms are assumed in this example, and no claimed model performance follows from the inventory. Completion requires resolving the dependencies needed for the intended test, not reaching a convenient percentage.
For each family, the buyer records whether the vendor supplies the input, the buyer supplies it, or only an output is delivered. This exposes duplicated purchases and missing permissions before engineering begins. The same register can later support a targeted renewal review when a source changes or a new report audience is proposed.
| Hypothetical status | Input families | Share by count |
|---|---|---|
| Proposed route documented | 3 | 60% |
| Unresolved | 2 | 40% |
| Total | 5 | 100% |
Ask how transformations affect downstream questions
A ranking, normalized value or combined indicator should remain connected to its input lineage. Transformation may change the relevant licensing analysis, but it does not supply a universal exemption from upstream conditions. Explain whether an output reveals input values, enables their reconstruction or serves a different purpose. Ask the relevant rights holder about the concrete output rather than requesting a blanket assurance that all derived material belongs to the buyer.
Include retraining and research reuse in the proposed workflow. A permission to calculate daily scores may not answer whether the buyer may train a separate model using years of those scores. Likewise, evaluation access may leave commercial deployment unresolved. These are agreement questions to identify, not assumed restrictions to invent. Preserve the provider's response and have the contractual reviewer confirm how it fits the controlling documents and any negotiated amendments.
Close the chain before approving the use
The approval record should connect the intended use to every necessary input and the resulting output path. Note which permissions are supplied by the vendor, which depend on buyer agreements and which remain conditions before use. Avoid a single green status that hides unresolved dependencies. A technically successful replay can coexist with an incomplete permission review; report both states plainly so the procurement committee understands what has actually been established.
Ask counsel to reconcile conflicting documents, applicable law and any third-party limitations. Public source pages help identify questions but do not establish the terms of a private transaction. Revisit the register when the data source, legal entity, calculation purpose or recipient changes. This approach preserves a practical distinction between permission to use a model and permission to obtain, process, retain or distribute the information moving through it.
- Trace each input to a specific permission route.
- Do not score an unresolved critical dependency as a minor paperwork gap.
Evaluation checkpoints
- Model and data permissions can belong to different suppliers.
- Inspect series metadata even on open-data portals.
- Transformation does not establish unrestricted downstream use.
Source notes
Related questions
Source Code Versus Model Output Rights
Distinguish inspectable code, executable packages and delivered results before choosing a model licence.
Derived Data and Retention After a Licence Ends
Classify transformed outputs, working copies and evidence archives before agreeing to deletion or post-termination access.
Internal Use and Redistribution of Model Results
Map recipients, channels and transformations before sharing licensed investment model material outside an evaluation team.
Designing a Bounded Investment Model Trial
Predeclare a model evaluation's scope, evidence, resources and decision rules without overstating what a short trial proves.
First edition, 16 October 2026. Illustrative procurement situations are not actual client engagements or legal advice.