# How to run an AI training data procurement

URL: https://sellmydatatoai.net/guides/ai-training-data-procurement
Reviewed: 2026-11-08

An AI training data procurement runs in six gated stages: requirements, a brief or RFP, a scored shortlist, rights and quality due diligence, a contract with acceptance terms, and acceptance testing at delivery. Each stage needs a named owner and a written pass condition, because rights failures found after training are far more expensive to fix than failures found before signing.

## Key takeaways

- Treat rights evidence as a pass or fail gate before you score sellers on price or volume.
- Use a short brief for owners licensing existing records and a full RFP only for commissioned human data across several vendors.
- Meta's Llama 2 team reported that different annotation vendors produced markedly different downstream model performance, so test vendors on your own task.
- US fair use is unsettled for training: a June 2025 ruling in Bartz v. Anthropic favored training, while the Third Circuit rejected fair use in Thomson Reuters v. Ross in September 2026.
- Write acceptance tests into the contract before delivery, with a holdback tied to passing them.

Buying training data looks like ordinary vendor procurement until something goes wrong. A software license can be terminated. Data that has already shaped a model's weights cannot practically be returned, so the checks have to happen before training starts.

This guide sets out a procurement process an AI team, a legal team and a procurement lead can run together. It complements our guide on [how to buy AI training data](https://sellmydatatoai.net/guides/how-to-buy-ai-training-data), which covers sourcing routes and pricing, by focusing on stages, owners, gates and the paperwork each stage should produce.

## What are the stages of an AI training data procurement?

An AI training data procurement has six stages, and each one ends at a gate with a written pass condition. Moving to the next stage without passing the gate is how teams end up training on data they cannot defend.

| Stage | Lead owner | Output | Gate to pass |
| --- | --- | --- | --- |
| 1. Requirements | ML lead | Written requirement with the target evaluation | Budget holder signs off the use and the budget model |
| 2. Brief or RFP | Procurement lead | Request sent to sellers under a mutual NDA | At least two responses that answer every required field |
| 3. Shortlist | ML lead and procurement | Scored comparison of sellers | Every shortlisted seller passes the rights gate |
| 4. Due diligence | Legal and privacy counsel | Diligence file and sample test results | No open rights issue and a sample that meets the spec |
| 5. Contract | Legal counsel | Signed license with acceptance schedule | Acceptance tests, holdback and remedies agreed in writing |
| 6. Acceptance | ML lead and security | Acceptance report and provenance record | Delivered data matches the manifest and passes the tests |

## Who should own a training data procurement?

A training data procurement needs one accountable owner, usually the ML lead whose model will use the data, plus named owners for legal, privacy, security and budget. Data deals stall when nobody is sure who can say no.

- ML lead: writes the requirement, designs the sample tests and signs the acceptance report
- Procurement lead: runs the brief or RFP, keeps the scoring record and manages timelines
- Legal counsel: reviews rights evidence, negotiates the license and tracks copyright risk
- Privacy counsel: checks privacy notices, de-identification and state privacy law exposure
- Security lead: approves the storage environment, access controls and deletion process
- Budget holder: approves the pricing model, the payment schedule and any holdback

## How do you set requirements before going to market?

Requirements should start from the evaluation the data is meant to move, not from a volume target. If you cannot name the score you expect to improve, you cannot judge a sample or accept a delivery.

Volume is often the wrong lever. Meta's Llama 2 paper reports that its team set aside millions of third-party fine-tuning examples, collected 27,540 higher-quality annotations from its own vendor-based effort and saw results notably improve. The same paper notes that different annotation platforms and vendors produced markedly different downstream model performance.

Write down the training use, domain, volume range, time range, formats, rights, exclusivity, de-identification standard, delivery method and budget model. Our guide on [how to write a training data request](https://sellmydatatoai.net/guides/how-to-write-a-training-data-request) explains each field with examples.

## Should you issue an RFP or a short brief?

Issue a full RFP when you are commissioning new human data from several established vendors, and a short brief when you want to license records a company already holds. Data owners such as law firms or manufacturers rarely answer long RFPs, because selling data is not their business.

| Factor | Full RFP | Short brief |
| --- | --- | --- |
| Typical seller | Training-data companies and annotation vendors | Companies licensing their own records |
| What you are buying | Work to be done, such as demonstrations or preference labels | Rights to data that already exists |
| Length | Detailed scope, quality metrics, staffing and security questions | One to two pages of required fields |
| Price basis | Per task, per hour or per project | Flat license fee, per unit or recurring access |
| Main risk | Quality drift once work scales up | Rights gaps in the seller's records |

For commissioned work, our guide to [sourcing expert and human-generated data](https://sellmydatatoai.net/guides/sourcing-expert-and-human-data) covers vendors, pricing models and quality control in detail.

## How do you build and score a shortlist?

Build the shortlist in two passes: a pass or fail rights gate first, then a scored comparison of the sellers who pass. Scoring rights alongside price lets a cheap seller with weak evidence outscore a sound one.

1. Rights gate: the seller can show who may sign, how it owns the data and which contracts and privacy notices apply
2. Fit: the data matches the domain, time range, format and languages in your requirement
3. Sample result: a seeded random sample performs on your test plan
4. Documentation: a manifest, a datasheet and hashes tied to an exact version
5. Commercial terms: price, exclusivity, payment schedule and willingness to accept a holdback

## What due diligence should run before the contract?

Due diligence should confirm what is in the dataset, whether the seller can transfer it for AI use and who carries the risk if it is not as described. Nixon Peabody's October 2026 alert frames this as five questions.

1. What is actually in the dataset?
2. Does the seller have the right to transfer data for AI use?
3. Can sensitive material be removed without destroying the data's value?
4. What can the buyer do with the data and with what it creates?
5. Who bears the risk if the dataset is not what the parties expected?

Our [AI training data due diligence checklist](https://sellmydatatoai.net/guides/ai-training-data-due-diligence-checklist) lists the documents to request for each question. Two US points shape how hard you push.

First, the Federal Trade Commission warned in a February 13, 2024 post that it may be unfair or deceptive for a company to adopt more permissive data practices, such as using consumer data for AI training, through a quiet or retroactive change to its terms or privacy policy. Ask for the privacy notice in force when the data was collected. Nixon Peabody also notes that the FTC has required companies to delete models and algorithms built with improperly obtained data.

Second, US fair use law on training is unsettled. On June 23, 2025, Judge William Alsup held in Bartz v. Anthropic that training on lawfully acquired books was fair use but that building a library from pirated copies was not. In September 2026 the Third Circuit rejected Ross Intelligence's fair use defense for training a non-generative legal search tool on Westlaw headnotes, according to Nieman Lab. Our [AI training data lawsuits tracker](https://sellmydatatoai.net/ai-training-data-lawsuits) follows the open cases. Take independent legal advice on your own use.

## What should the contract settle?

The contract should settle permitted use, ownership of derived assets, warranties, indemnities and what happens if rights fail after training. For procurement, the key addition is an acceptance schedule that turns your sample tests into contract terms.

- Acceptance schedule: the tests, thresholds and inspection period that define a conforming delivery
- Holdback: part of the fee retained until acceptance, which Nixon Peabody lists among the risk tools alongside indemnities, liability caps, insurance and termination rights
- Staged access: a limited sample in a controlled environment first, then wider access as agreed conditions are met
- Change control: how the seller notifies you of changes to the dataset or its sources
- Deletion certificate: written confirmation of deletion at expiry or on a rights failure

The [AI data licensing agreement checklist](https://sellmydatatoai.net/guides/ai-data-licensing-agreement-checklist) covers the full clause list from both sides of the deal.

## How do you accept a training data delivery?

Accept a delivery only after the files match the manifest and pass the tests in the acceptance schedule within the inspection period. Check record counts, date ranges, formats and hashes first, then run quality and personal data checks on a random sample.

If you plan a pilot before the full license, our guide to [training data pilot design](https://sellmydatatoai.net/guides/training-data-pilot-design) explains sample sizes, held-out evaluation and staged payment.

## AI training data procurement checklist

Copy this checklist into your procurement tracker. Each row names the evidence that closes the item.

| Stage | Item | Evidence that closes it | Owner |
| --- | --- | --- | --- |
| Requirements | Training use and target evaluation named | Signed requirement document | ML lead |
| Requirements | Budget model approved | Budget holder sign-off | Budget holder |
| Brief or RFP | Mutual NDA in place with each seller | Countersigned NDA | Legal counsel |
| Brief or RFP | Every required field answered | Response log | Procurement lead |
| Shortlist | Rights gate passed | Seller's signatory, ownership and contract evidence | Legal counsel |
| Shortlist | Seeded random sample tested | Sample test report | ML lead |
| Due diligence | Privacy notice at collection reviewed | Dated copy of the notice | Privacy counsel |
| Due diligence | De-identification method checked | Written method and re-identification test | Privacy counsel |
| Due diligence | Third-party and open-source content cleared | Clearance log | Legal counsel |
| Due diligence | Storage environment approved | Security review | Security lead |
| Contract | Acceptance schedule and holdback agreed | Signed license | Legal counsel |
| Contract | Derived assets and rights failure remedies agreed | Signed license | Legal counsel |
| Acceptance | Delivery matches manifest and hashes | Acceptance report | ML lead |
| Acceptance | Provenance record filed | License, manifest, hashes and diligence file stored together | Procurement lead |

### If you place models on the EU market

Providers of general-purpose AI models placed on the EU market must keep a copyright policy and publish a summary of training content under Article 53 of the EU AI Act. The provenance record from stage 6 is what you will draw on. Our guide to [the EU AI Act and training data transparency](https://sellmydatatoai.net/guides/eu-ai-act-training-data-transparency) covers the summary in detail.

## How does Sell My Data To AI fit into a procurement?

Sell My Data To AI can run stages 2 and 3 for you as an independent broker. Buyers pay nothing to submit a requirement or review a shortlist, and any fee is agreed in writing before an introduction. Every seller passes our eight-point vetting standard before any buyer sees their data, covering authority to sign, ownership, contract restrictions, privacy notices, third-party content, de-identification, sample quality and manifest accuracy.

We do not take custody of raw data. You review redacted samples under a mutual NDA and sign the license directly with the seller. We are a broker, not a law firm, so take your own legal advice before signing. To start, [submit a data requirement](https://sellmydatatoai.net/request-data) or [book a buyer consultation](https://sellmydatatoai.net/book-a-consultation?side=buyer).

## Frequently asked questions

### How long does an AI training data procurement take?

An AI training data procurement usually takes weeks rather than days, and most of the time goes on rights diligence and contract review. Commissioned human data adds vendor ramp-up and calibration. Licensing existing company records adds time for the owner to gather privacy notices, contracts and IP assignments. Plan the gates first and the timeline follows from how quickly each owner can close them.

### Do we need an RFP to buy training data?

You need a full RFP only when you are commissioning new work, such as demonstrations or preference labels, from several established vendors. To license data a company already holds, a one to two page brief works better, because most data owners are not set up to answer long RFPs. Both should state the training use, rights needed and budget model.

### Is training on licensed data protected by fair use?

A license does not depend on fair use. It gives you contractual permission for the uses it lists. Fair use matters when you rely on data without a license, and US courts are split so far: Bartz v. Anthropic favored training on lawfully acquired books in June 2025, while the Third Circuit rejected fair use in Thomson Reuters v. Ross in September 2026. Take independent legal advice.

### What is a holdback in a data license?

A holdback is part of the license fee that the buyer keeps back until the delivered data passes acceptance tests. It gives the seller a reason to fix nonconforming records quickly. Nixon Peabody lists holdbacks alongside indemnities, liability caps, insurance and termination rights as tools to allocate risk when a dataset is not what the parties expected.

## Sources

- [Shopping for AI training data? Five diligence questions before you buy](https://www.nixonpeabody.com/insights/alerts/2026/10/26/shopping-for-ai-training-data-five-diligence-questions-before-you-buy), Nixon Peabody LLP, accessed November 2026
- [AI (and other) Companies: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive), Federal Trade Commission, accessed November 2026
- [District court rules AI training can be fair use in Bartz v. Anthropic](https://www.akingump.com/en/insights/ai-law-and-regulation-tracker/district-court-rules-ai-training-can-be-fair-use-in-bartz-v-anthropic), Akin Gump Strauss Hauer and Feld, accessed November 2026
- [Federal appeals court upholds Thomson Reuters' landmark AI copyright win](https://www.niemanlab.org/2026/09/federal-appeals-court-upholds-thomson-reuters-landmark-ai-copyright-win/), Nieman Lab, accessed November 2026
- [Llama 2: Open foundation and fine-tuned chat models](https://arxiv.org/abs/2307.09288), arXiv (Touvron et al., Meta, 2023), accessed November 2026
- [Regulation (EU) 2024/1689 (Artificial Intelligence Act)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng), EUR-Lex, Publications Office of the European Union, accessed November 2026

---

Book a free consultation: https://sellmydatatoai.net/book-a-consultation