Buyer diligence

How to assess an AI data buyer before sharing

Check identity, purpose, procurement, sample controls, and downstream use without assuming every inquiry is a genuine offer.

Sources and guidance · Reviewed October 2026

Verify the counterparty and the request

Confirm the legal entity, official website, contact domain, and role of the person requesting data. Use an independently reached official channel if an inquiry is unexpected. A recognizable company name in an email signature does not establish that the sender can buy data or authorize a contract.

Ask whether the party is the end user, an intermediary, an annotation vendor, or a research collaborator. Identify who would receive the sample and who would sign. If an intermediary will pass material onward, the downstream recipient and rights should be part of the discussion before transfer.

Ask what decision the sample supports

A credible evaluation request should explain the task, required format, intended use, approximate scope, and decision process. It need not reveal a confidential model roadmap, but it should provide enough information for you to assess relevance and permission. Vague demands for a full archive deserve clarification.

Clarify whether the sample will be inspected by people, processed in automated pipelines, used in model training, or retained for later projects. Set evaluation terms before sending content. Begin with aggregate descriptions and a cleared sample rather than unrestricted source-system access.

Review operating and contractual controls

Ask about access management, retention, subprocessors, incident notification, and methods for removing or correcting affected records. Understand whether the buyer can distinguish evaluation copies from training corpora. Avoid taking general security marketing as proof that your specific data flow is controlled.

Review warranties, indemnities, liability limits, and any demand for exclusivity with qualified advisers. A seemingly attractive price may shift substantial risk onto the seller or include far broader rights than the stated task requires. Compare the entire proposed arrangement, not just the payment line.

  • Verify procurement and signing authority.
  • Identify affiliates and onward recipients.
  • Document the evaluation decision and expected feedback.

Watch for mismatched incentives

A request for fees to unlock an unexplained offer, pressure to bypass review, or insistence on raw credentials should trigger a pause. So should a buyer refusing to identify the contracting entity or sample use. Do not send sensitive data merely to prove that a dataset exists.

Keep an inquiry log with what was shared, with whom, under which terms, and what remains pending. If the evaluation does not progress, apply the agreed retention and deletion process. A buyer relationship should become more specific as diligence advances, not increasingly opaque.

Common questions

Does a public data program guarantee a purchase?

No. A program may accept inquiries or evaluate data without committing to buy any particular collection.

Should I give a buyer direct access to production systems?

Prefer a scoped, reviewed export unless a separately authorized integration is genuinely necessary. Production access can expose far more than the proposed dataset.

Sources & further reading

FTC: AI companies must uphold privacy and confidentiality commitments ↗
Use this as a preparation framework. It is not legal advice, a valuation or a promise that a buyer will accept your data.