Owning your model estate

Summary

"You own your data" is now standard language in AI contracts. It is also close to meaningless, because the data was already yours and it is not where the value has moved.

The value has moved into the artefacts derived from that data: the resolved entity graph, the tuned weights, the evaluation suite, the pipeline definitions and the accumulated decision history. Those are what make the capability work, and their ownership is frequently unaddressed or quietly assigned to the vendor.

This paper enumerates the six artefacts that constitute real ownership and what has to be true of each.

Why the distinction is not academic

Consider an insurer three years into a claims automation programme. The models have been trained on four million of its own claims, tuned against its own outcomes, and evaluated against a suite its claims function wrote.

If the vendor relationship ends and the insurer keeps only its raw data, it has kept the least valuable artefact. Three years of encoded operational knowledge is gone, and the replacement programme starts at zero — not because the data is missing but because everything derived from it was somebody else's.

The switching cost that creates is not a side effect of the commercial model. In many cases it is the commercial model.

The six artefacts

1. Model weights

Every version, in a portable format, with the tokeniser and configuration needed to load them elsewhere.

The common weakening: access to weights only through the vendor's runtime. That is not possession, it is a viewing right that ends with the contract.

2. Training and tuning corpora

The prepared datasets, including labels, splits and preprocessing. Raw source data is not sufficient — the preparation is a substantial part of the work and encodes decisions that are expensive to reconstruct.

3. The resolved entity graph

The governed records, survivorship decisions, lineage and quarantine state. This is the artefact with the longest half-life; models get retrained, the entity graph accretes.

4. Evaluation suites

Cases, rubrics, weights and thresholds. Whoever holds these defines what "safe to deploy" means. If it is the vendor, the buyer has outsourced its own safety bar.

5. Pipeline and orchestration definitions

Training pipelines, retrieval configuration, agent definitions, tool contracts and policy gates — as portable definitions, not as configuration inside a proprietary console.

6. Decision history

Every trace: what was decided, on what evidence, by which version, under which policy. This is both the audit record and, in practice, the most valuable training data the organisation has.

What to put in the contract

Ownership language should specify artefact, format, cadence and destination, not intent.

• Artefact: enumerated as above, not "the deliverables".
• Format: open and documented. "The vendor's export format" is a dependency wearing a guarantee's clothing.
• Cadence: continuously available or on a defined schedule — not "on termination", which is when relations are worst and cooperation is least likely.
• Destination: a repository the buyer controls.

Add a restoration test: at least annually, the buyer stands up the estate from the escrowed artefacts in an environment the vendor does not operate, and confirms it runs. Untested escrow is a belief.

The vendor's legitimate interests

This is not a demand for the vendor's own intellectual property. Base model weights the vendor licensed, the platform source code, and generic tooling are reasonably the vendor's.

The line is derivation: artefacts derived from the buyer's data and the buyer's decisions belong to the buyer. That line is clean and most disputes come from vendors preferring it blurred.

Why we take this position

We build, deploy and operate these estates, and we would rather compete on whether we are good at that than on whether leaving is painful.

A customer who could leave next quarter and does not is telling you something real. A customer who cannot leave is telling you nothing at all, and that is a worse business to be in than it looks — it removes the only reliable signal you had.

Model contract clauses, an artefact inventory template and the restoration-test runbook are available in the developer portal.