We have an offer to license our data to an AI developer. Which terms in the contract really matter?

Scope and field of use

The licence should describe the dataset precisely (sources, period, volume, format, version) and the permitted use just as precisely. ‘Training AI models’ is not a field of use; it is a door left open. The questions to settle are whether the buyer may use the data for pre-training, fine-tuning, evaluation or all three; for one named model, a family of models, or anything it builds; for internal use only, or for models it offers to third parties; and whether affiliates may use it. Rights not expressly granted should be stated as reserved to the seller.

Two further points are often forgotten. The first is whether the buyer may keep and use the trained model after the licence ends; in practice it almost always may, so the price must reflect a permanent use. The second is whether the buyer may create derivative datasets, synthetic data generated from the licensed data, for example, and on what terms.

Exclusivity

Exclusivity is the buyer's most valuable request and the seller's most expensive concession, because the same data can often be licensed several times to buyers who do not compete. If exclusivity is granted, it should be narrow: limited in time, in field (a sector, a type of model, a territory), and perhaps to a defined part of the dataset. A clause that lets the seller end exclusivity if the buyer does not reach agreed milestones or minimum payments is worth asking for.

Samples and evaluation

Buyers want to test before they pay, and that is reasonable. The risk is that a generous sample delivers most of the value without a licence. An evaluation agreement, signed before any sample leaves the company, should limit the sample in size, allow use only to assess the dataset, prohibit training on it, impose confidentiality, and require deletion within a short period with written confirmation. Where possible, evaluation can take place in a controlled environment rather than by delivering copies.

What the buyer may not do

Restrictions protect both the company and the people in the data.

• No attempt to re-identify individuals, and no linking of the dataset with other data in order to identify them.
• No resale, sublicensing or disclosure of the raw data, except to named service providers bound by the same terms.
• No use of the data to compete with the seller in its own business, where that risk is real.
• No use outside the agreed field, and no transfer of the data outside agreed jurisdictions without consent.

Warranties, indemnities and the liability cap

The buyer will ask for warranties on rights, provenance and personal data, for the reasons explained on our page on the AI Act. The seller's protection lies in the drafting: warranties limited to the seller's knowledge after reasonable enquiry; a disclosure schedule listing known exceptions; indemnities limited to third-party claims that arise from a breach of an express warranty; a cap, usually linked to the fees received over a defined period; and a short claims period. Under Greek law, an advance agreement that excludes or limits liability for intent or gross negligence is void.

Where one side imposes standard terms and refuses to negotiate, the EU Data Act may help the weaker party. For contracts concluded after 12 September 2025, a term on data access and use, or on liability and remedies for breach of data-related obligations, that was unilaterally imposed by one enterprise on another is not binding if it is unfair. Excluding the imposing party's liability for intentional acts or gross negligence is always unfair; terms that allow it to use the other party's data in a manner significantly detrimental to that party's legitimate interests, in particular trade secrets, are presumed unfair. This is a safety net for imposed terms, not a substitute for negotiation.

Deletion, return and audit

At the end of the licence the buyer should delete or return the raw data and its copies and confirm this in writing, with any exceptions (legal retention, backups pending overwrite) stated in the contract. Whether models already trained may continue in use must be decided expressly, as noted above. An audit right, exercised by an independent auditor on reasonable notice and with costs shifting to the buyer if a breach is found, gives these obligations teeth. For revenue-share deals, the audit right must also cover the figures on which payment is calculated.

Payment structure

There are three basic models. An upfront fee, sometimes in instalments tied to delivery milestones, is simple and transfers the risk of the model's success to the buyer. A recurring fee, per year or per delivery of updated data, suits datasets that keep their value only if refreshed. A revenue share or royalty can look attractive, but its value depends on a definition of revenue the seller cannot easily verify; it needs a minimum guarantee, clear reporting and an audit right. Many deals combine an upfront fee with a smaller recurring component.

Whatever the structure, the contract should state whether amounts include VAT, who bears withholding taxes if the buyer is abroad, the currency, and what happens on late payment.

Governing law and disputes

Under EU rules the parties are free to choose the law that governs their contract. International buyers propose their own law and courts as a matter of course. For a Greek company, Greek law with Athens courts, or arbitration in a neutral seat, is a reasonable counter-proposal. Whatever law the contract chooses, the GDPR continues to apply to the Greek company's own processing of personal data. A litigation venue the company cannot afford to use makes every other clause weaker.

Questions clients ask

Sources

• Regulation (EU) 2023/2854 (Data Act), Article 13(1), (3)-(6) and Article 50
• Regulation (EC) No 593/2008 (Rome I), Article 3(1): freedom of choice of law
• ΑΚ 332 (Αστικός Κώδικας): άκυρη η εκ των προτέρων συμφωνία απαλλαγής από ευθύνη για δόλο ή βαριά αμέλεια
• Regulation (EU) 2016/679 (GDPR), Article 3(1): territorial scope