Our corpus was scraped from public pages. Where does that leave us?
Public visibility alone does not establish that a corpus can be used for training. Review copyright, source terms, privacy, relevant reservations, and the intended use. The hiQ decision concerned a specific computer-access question; it was not a general grant of training rights.
Record to review: A source inventory with collection times, access conditions, applicable reservations, and the license or legal basis relied on. Identify missing records rather than assuming public access resolved them.
Some of it came from behind a login. How bad is that?
Login access adds questions about authorization and account terms. Computer-access law, contracts, copyright, and privacy may all matter. Record whether access was authorized and what conditions applied; using an account does not reduce the review to contract alone.
Record to review: Source-level access records showing the account or credential used, authorization, collection time, applicable terms, and relevant rights.
We bought the dataset. Isn't that the vendor's problem?
Buying a dataset does not by itself establish that the seller had all the rights needed for your use. Review the grant, source records, restrictions, warranties, and any indemnity. Supplier documentation and contractual protection address different parts of the risk.
Record to review: The signed delivery agreement and supporting source and rights records, with gaps and restrictions identified.
We licensed directly from rights holders. Are we clear?
Direct licensing is useful evidence, but the grant still needs to cover your intended use. Check the material covered, training and fine-tuning rights, term, territory, redistribution, personal data, and any third-party content. A license does not answer questions outside its scope.
Record to review: The executed agreement, the rights holder’s authority, and the clauses supporting your intended use, alongside relevant consent records.
It's synthetic. Doesn't that avoid the whole question?
Synthetic generation changes the evidence required; it does not eliminate rights and disclosure questions. Review the generator’s terms, relevant inputs, outputs, and intended use. California AB 2013 includes synthetic-data use in the disclosures required from covered developers; it does not impose the same obligation on every synthetic-data supplier.
Record to review: Generator identity and terms, relevant input history, production records, output review, and the disclosure assessment for the applicable developer and deployment.
We acquired it. Nobody here built it.
An acquired corpus needs a review of the records that survived the transaction. Preserve source and rights documentation, interview relevant custodians where possible, and distinguish contemporaneous records from later reconstruction. Missing evidence should be identified explicitly.
Record to review: A source inventory, acquisition agreements, retained evidence, and a gap register stating what remains unknown.
Honestly, it's mixed, and some of it we can't trace.
Start with an inventory that separates documented sources from unresolved ones. Disclosure obligations vary by law and by the entity deploying the system. A high-level summary does not clear rights in an untraceable asset. Decide what requires further investigation, replacement, or restricted use.
Record to review: An inventory of traceable and untraceable material, supporting records, unresolved questions, and the actions taken to address them.
None of this requires talking to us. If you can produce the records above, you can answer the questions coming your way. If you can't, that's worth knowing before someone else finds out.
Our manifest format records asset declarations and fingerprints. Source logs, consent, and agreements may require separate supporting files. The open-source verifier checks manifest structure and delivered-file integrity; it does not determine legal compliance. You can run it against any delivery using the format, including ours. tgs-verify on GitHub.