AI Vendor Contracts: Trace Data, IP and Open-Source Dependencies
Map what enters an AI service, what the vendor may retain or reuse, what leaves it, and which software and licence dependencies remain hidden.
Cross-market
Technology and intangible dependencies
Vendor, Data & IP Control
Expose the permissions and dependencies hidden inside software, AI, data, source code and third-party service arrangements before control is tested.
Which vendor permission or technical dependency could quietly change who controls the asset?
Training rightsData returnOpen sourceAccount control
Technology terms and regulatory duties change quickly. Verify the current product, data flow, licence and jurisdiction before relying on a control map.
Start here
One useful entry point.
Begin with a representative mechanism, then use the grouped paths below to go deeper.
Design before pressure
Practical owner guides
Bankruptcy turned sensitive data into a transferred business asset
A genetic-data investigation and later SEC filing connect credential stuffing, linked relatives and a completed Chapter 11 asset sale.
Canada / United Kingdom / United States
Outsourcing the system did not outsource the breach
A Singapore breach decision split consequences between a healthcare data owner and its IT provider, exposing the limits of vendor transfer language.
Singapore
When the network goes dark, the incident log can become the next data risk
A cyclone connectivity review reveals why offline workarounds need data-minimisation, custody and deletion rules before the network fails.
Australia (Queensland)
A founder breakup can freeze the breach clock
A cofounder document-access fight reveals how privilege, authority and system custody can obstruct a time-sensitive incident response.
Delaware, United States
The platform can become the first hostage in a cofounder exit
A preliminary-injunction dispute shows why email, product platforms and records need continuity controls independent of founder status.
Illinois, United States
The buyer can inherit the notification work
An FTC order split data-breach consequences between a former owner and buyer, turning privacy diligence into an operating handover.
United States
The cloud region failed when heat defeated redundant cooling
A Google Cloud incident shows how extreme heat, cooling failure and recovery sequencing can reach systems that appear regionally resilient.
United Kingdom / global cloud services
Ransom-returned data is not an incident scope
A Canadian laboratory breach investigation shows why payment, returned data and regulator findings answer different incident questions.
Canada
A review response can disclose more than the complaint
A health-privacy settlement shows why reputation response authority should be separated from access to customer facts.
United States
The AI inventory that cannot explain its use case
A list of AI tools becomes more useful when it records the decision use, affected people, data path, owner and material-change triggers.
EU framework illustration and voluntary US institutional framework; applicability Not assessed
The Authority Matrix Failed at the Bank Portal
A guide to testing documentary authority, external mandate, digital identity, system roles, approval workflow and recovery as connected layers.
General cross-system method; bank mandate, platform entitlement and corporate authority not assessed
The certificate expired exactly when the service needed it most.
A practical second lens for connecting a business-critical certificate or key to its service, owner, lifecycle triggers and replacement evidence.
General operational method informed by US institutional guidance; no reader-specific standard or compliance conclusion
The Cloud Exit Test That Was Never Run
A practical guide to separating a paper exit clause, an export capability and observed evidence from a controlled recovery exercise.
Operational method with an EU Data Act source lead; scope, dates and rights not assessed
A cybersecurity profile is a conversation between the board and the system
A NIST CSF Organizational Profile can expose ownership and trade-offs without becoming a certification, maturity score or legal safe harbour.
Voluntary US institutional framework; no regulated-sector conclusion
The domain was authenticated on paper. The report had nowhere to go.
An evidence-aware guide to assigning ownership around email-authentication records, report routes, exceptions and review triggers.
General operational method informed by US institutional material; no universal or reader-specific duty stated
The domain was live. The organization could not show who could move it.
A domain-control record separates registrar access, registrant and transfer roles, renewal notices, recovery evidence and unresolved legal or IP questions.
ICANN policy context; registrar, registry, country-code and local-law treatment not assessed
Can You Prove the Environmental Claim You Repeat?
A source-to-claim record for checking environmental statements received from suppliers before they reach products, sales material or customers.
United Kingdom with a United States comparison
The Payment System Has a Privileged Account Nobody Owns
A guide to treating privileged payment access as a named operational dependency with evidence, review, recovery and change triggers.
General controls method; bank, platform and sector-specific duties not assessed
A Ransomware Playbook Needs a Decision Clock, Not Only a Restore Plan
An evidence-aware guide to separating incident observations, authority, recovery choices, assumptions and specialist escalation in a timestamped decision record.
General incident-decision method; legal, notification, insurance and sanctions duties not assessed
The service had an administrator. The business did not have a recovery path.
A critical SaaS tenant needs a reviewable account-holder, privileged-role, recovery and handoff record—not confidence in one current login.
General operational method informed by United States institutional guidance; provider and local-law treatment not assessed
The model changed quietly: who notices first?
A versioned change record can separate a vendor announcement from the buyer's tested operational impact, decision and rollback path.
General operational method; contract, privacy and legal scope Not assessed
Open-Source Notices Are a Delivery Dependency
A release-evidence guide for connecting shipped components to licence records, notice treatment, named owners and visible exceptions.
Cross-market software-release method; licence and distribution effect not assessed
The report arrived. The organization still did not know what it had decided.
A vulnerability-disclosure channel needs a bounded handoff from receipt to triage, communication, technical assessment and remedial decision.
United States federal guideline context; private-sector and other-jurisdiction treatment not assessed
The vendor has an SBOM. Do you have a decision record?
An SBOM can identify software components, but an owner still needs a versioned record of receipt, review, exceptions, changes and incident use.
General operational method; no jurisdiction-specific conclusion
Check the live trigger
Dated regulatory radar
A configuration error exposed sensitive HR dossiers to dozens of managers
A Hamburg regulator's retailer decision shows how access configuration, retention, and sensitive workplace notes can become one connected governance problem.
Germany
Background GPS continues after the app is closed
Canadian privacy findings involving an app's background location collection show how an abandoned business plan can leave a live data practice behind.
Canada
Mobile consent design became a EUR50 million case
CNIL's platform provider decision shows why layered notices and consent design can become the practical object of regulatory scrutiny, not a footer detail.
France / European Union
A hidden spreadsheet tab turned redaction failure into a safety problem
An ICO penalty notice shows how a hidden spreadsheet tab turned a redaction mistake into a safety and workforce problem.
United Kingdom (Northern Ireland)
Voice deletion promises conflict with model training
A voice-assistant order shows why a deletion request may have a different technical meaning once children's voice and location data feed algorithmic systems.
United States
DORA's subcontracting question: which critical service actually moves?
A DORA-related subcontracting map should connect an ICT service to its function, sub-provider, change route and exit dependency without assuming every vendor is in scope.
European Union financial-sector framework; entity, service and criticality scope Not assessed
The Digital Identity Wallet Question: Who Becomes the Relying Party?
A regulatory-radar guide to mapping role, purpose, user journey, requested attributes, evidence, data boundaries and change governance before integration.
European Union framework; Member State rollout, role and sector treatment not assessed
NIS2 supply-chain risk is not a vendor questionnaire
A supplier questionnaire can inform a NIS2-related review, but scope, supplier criticality, evidence, ownership and national implementation remain separate questions.
European Union directive framework; national law and entity scope Not assessed