Legal Said No. Data Said Yes. The 90-Minute Meeting That Fixed Both.

The slowest part of buying training data is rarely the data — it’s the hallway standoff between the data team that found the perfect corpus and the legal team whose job is to say “prove it.” This piece is a (composite, anonymized) transcript-style reconstruction of the meeting that resolves the standoff, with the four exhibits that turned a two-month review into ninety minutes. Steal the exhibits.

The Setup

A model team had scoped a licensed corpus — web-sourced records for a commercial fine-tune — and legal had three concerns: where the data came from, who could complain, and what happens if someone does. Two months of async review had produced a growing list of open questions and zero decisions. Someone finally booked the room.

What follows is the meeting, compressed to its decision points.

The Transcript, Compressed

Legal: Before anything else — where did this data come from? “The public web” is not an answer.

Data: Exhibit A. The corpus’s sourcing documentation — collection method, public-web scope, and the per-record fields: source domain, capture timestamp, license scope. Every record carries its own provenance. You can sample any hundred records and trace each one.

Legal: Per record?

Data: Per record. It’s a field in the data structure, not a paragraph in the contract. That’s actually the whole difference — we’re not asking you to trust a description of the corpus; you can audit the corpus.

Legal: And what does “license scope” say, exactly?

Data: Exhibit B. The license schedule, named by use: evaluation, training, commercial deployment of models trained on it. Our use case is line two and three. The vendor’s catalog works this way by design — Thordata’s datasets ship license scope attached to records, with sample-first evaluation, so this isn’t a bespoke legal artifact we negotiated; it’s the product’s standing posture.

Legal: If a rights-holder objects to their content being in the corpus — what happens?

Data: Exhibit C. The vendor’s takedown and exclusion process, with stated response times, and — the part you’ll care about — the mechanism for excluding specific sources from *future* deliveries. Combined with per-record provenance, that means an objection has a defined remediation path instead of an existential question about the whole corpus.

Legal: Last one. If we’re acquired, or if this model ships in the EU — does anything we’re signing today become a problem?

Data: Exhibit D. The portability and renewal terms: data is ours post-delivery in standard formats (JSON/CSV/Parquet, delivered to our S3), the license survives contract end for delivered data, and the compliance posture is documented for GDPR-region review — the vendor sells GDPR-compliant dataset lines specifically, which means our file already matches the format their existing EU customers’ counsel see.

Legal: …That’s the whole exhibit list?

Data: That’s the whole exhibit list.

Legal: We’ll circulate sign-off by Friday.

It took ninety minutes because ninety minutes is how long it takes to read four documents out loud with questions. The two months before it were how long it takes to not have the documents.

The Four Exhibits, Generalized

Steal this list for any licensed-data purchase:

The deep point the transcript encodes: the standoff dissolves when provenance is *structural* rather than *contractual*. A vendor whose records carry their own license scope converts legal review from an investigation into a verification — and verification is a meeting, while investigation is a quarter.

The Post-Mortem Note the Team Wrote

Three sentences worth quoting: “The two months we lost weren’t legal’s fault — we brought them a description and asked them to underwrite it. The ninety minutes worked because we brought them evidence. Next purchase, the exhibits are the checklist *before* the vendor call, not after.”

That checklist, in purchasable form: ask any candidate vendor for all four exhibits on day one. Vendors whose product architecture supports them — record-level license fields, documented sourcing, exclusion processes, standard-format delivery (Thordata’s catalog is built this way, datasets from roughly $0.25 per 1,000 records, sample-first so legal can see real records too) — answer in days. Vendors who need three meetings to produce them have told you something about their corpus.

FAQ

What if legal’s concerns are stricter than the four exhibits?
Then you’ve localized the conversation: regulated sectors sometimes need DPAs, security reviews, or jurisdiction-specific terms — those are contract artifacts, and vendors with enterprise motions handle them. The exhibits don’t replace that layer; they clear the *data* questions so the contract conversation is about actual contract terms.

Does this apply to scraped-in-house data too?
That’s the uncomfortable version of the question: in-house collections score zero on Exhibit A (no per-record provenance unless you built it) and usually zero on B and C. Running the four-exhibit checklist against your own pipeline is the fastest way to discover what the licensed path was going to save you from.

What about “ethically sourced” claims — same category?
Adjacent but real: ethical-sourcing documentation (opt-in collection models, sourcing methodology) is Exhibit A’s moral companion, and EU/ESG-minded buyers increasingly ask for both. Vendors that document sourcing methodology treat it as a spec; treat anyone who treats it as a slogan accordingly.

Where does search data fit the legal picture?
Simpler than corpus data but not exempt: SERP records contain indexed third-party content snippets, so the same “license by use” question applies. Structured per-response products — the SERP monitoring solution, at roughly $0.70 per 1,000 responses — come with the delivery-side terms already standardized, and continuous SERP data crawling keeps the same posture on an ongoing feed rather than reopening review per purchase.

The one-sentence version?
Legal reviews are slow when data is described and fast when data is evidenced — so walk into the room with provenance-in-the-records, a license schedule by use, a takedown process, and portability terms, and the meeting ends before the coffee does. And when you’re evaluating whether a corpus is “licensed ai training data” or a label, the exhibit checklist applied to the vendor’s own documentation is the fastest discriminator we know.