Data licensing audit: what it covers and who runs it
The short answer
An audit reviews records before an AI license. No industry standard exists. Five parts: inventory of systems, rights check, sensitive records list, buyer threshold test and buyer match. Thresholds are self-reported. Rights questions go to counsel.
The five parts below are my own structure. Each draws on a dated source, and the table says which.
What do the companies check at intake?
Each buyer runs its own light version of an audit.
-
micro1. micro1's David Revland, who works on human data, said in an undated recorded forum talk that a data manifest form asks which services you use and a rough size for each.
He said micro1 supplies instructions for finding sizes (self-reported, talk date not stated). See what a data manifest form is.
-
Handshake AI. Its data partnerships page runs an estimator that asks for headcount, years in operation and country, then describes a scoping call on data parameters, de-identification, terms and timeline.
-
Troveo. Its first step is Scope, which it describes as deciding what is in and what is out. Anonymizing follows, documented in a manifest.
What does Frankfurt Kurnit say to check?
Frankfurt Kurnit Klein & Selz lists the review steps. Involve legal, privacy, security, HR and communications people. Inventory systems, record types, volume and timeframes.
Review customer, partner, vendor and platform terms. Exclude categories such as privileged material, HR files, payroll, health information, union communications and customer confidential data. Document the review.
What are the five parts of an audit?
| Part | What it checks | Source behind it |
|---|---|---|
| Inventory | Systems, plan tier, who administers it, size, years covered | Revland (micro1), undated forum talk, FKKS |
| Rights | Contracts, notices and third-party content that touch the records | FKKS |
| Sensitivity | Categories to exclude before any transfer | FKKS |
| Thresholds | Headcount, volume, years, language, location | Buyer pages above |
| Buyer fit | Which buyer's published terms match the records | Buyer pages, our buyer directory |
The table rows for rights and sensitivity are fact-gathering. Whether a record may be licensed is a decision for counsel. The rights check asks seven questions on it.
Where do the numbers come from?
My 1 TB page and inventory template show the columns to fill in. The readiness checklist lists the published thresholds.
Who runs the audit?
You can. Start with the inventory and the thresholds, then hand the rights and sensitivity rows to counsel. Or use managed readiness, our optional paid service.
It builds a buyer one-pager, a systems inventory, questions for your counsel, a buyer shortlist with each buyer's current criteria and a term-question checklist from descriptions and counts, never records.
It takes 2 to 3 weeks with two rounds of revisions, and every legal question goes to your lawyer in writing.
The audit can end in a no. A company may fall outside every buyer's thresholds, and nothing here promises a buyer or a price. Talk to a privacy or commercial lawyer in your state before you sign.
micro1 may pay us a referral fee if a company we introduce goes ahead with it. How we are paid
Apply to micro1's data partnership (paid link)micro1's own data-partnerships pagePaid link. How we are paid
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
