The Interim Measures for the Administration of Generative Artificial Intelligence Services require a lawful source of training data, and together with the Data Security Law and the Personal Information Protection Law they form the compliance framework. Regulatory and judicial practice in 2024 continued to stress three points: traceable provenance, a clear scope of licence, and limits on re-provision. Where the licence chain breaks, risk appears.
Three common breaks in the chain
The first is sub-licensing: a dataset bought from a supplier may not have upstream proof that the supplier itself was entitled to sub-license. The second is scope mismatch: a licence covers research use, while the data is used for commercial training and external service. The third is aggregation dilution: after several sources are combined, the limits attached to an individual source are obscured by the overall narrative. All three are probed in due diligence, filing review or litigation. A licence-chain review therefore looks at how documents connect, not merely at whether a contract exists.
Personal information and copyright in parallel
For data containing personal information, a company must assess the legal basis, whether separate consent was obtained and whether sensitive personal information is involved. On copyright, it must ask whether the corpus contains protected works, whether the licence covers reproduction and adaptation, and whether output may be substantially similar. The two analyses cannot substitute for each other: lawful processing of personal information does not mean there is no infringement. For multimodal models, image, audio and text sources are often licensed separately and must be checked one by one.
Re-provision and record keeping
Whether model output amounts to re-provision of training data depends on similarity to the original and identifiability. The regulatory question is whether a company can explain the data flow. Procurement contracts, licences, cleaning records, training logs and version records form the basic evidence loop. The records need not be voluminous, but they must answer three questions: where the data came from, on what basis it is used, and where it went. Without those answers, even a complete compliance statement lacks support.
Contract terms that matter
Procurement and licensing contracts should state the scope of the licence, the permitted purpose, whether training and fine-tuning are allowed, whether external services may be provided, restrictions on re-provision, handling of data on termination, and IP warranties and indemnities. For datasets of unclear provenance, a price advantage usually corresponds to a higher evidentiary cost. Passing upstream commitments downstream is the usual way to keep the chain intact.
Offshore model services and cross-border training
Using an offshore model service, or training abroad, triggers both outbound data transfer and overseas-processor issues. Whether training data is transferred, whether inference inputs contain personal information, and whether the service provider uses data for model improvement all need confirmation in the contract. Where outbound transfer cannot be excluded, the filing route and alternatives should be assessed. Making “does it leave the jurisdiction” a standard question before procurement is more effective than remedying afterwards. Where the model provider is also the data supplier, licensing and outbound review should be combined rather than handled separately.
For licence-chain review and contract assessment, see our data compliance service and IP protection service; for clause design, see commercial contracts.
This article is based on the Interim Measures for the Administration of Generative Artificial Intelligence Services, the Data Security Law, the Personal Information Protection Law and public regulatory and judicial information from 2024. It is for reference only and does not constitute legal advice.