Can a contractor license its project records to AI companies?

This guide is general information, not legal, tax or accounting advice. Laws, contract terms and exceptions vary by state, by claim and by contract, so confirm how any of this applies to you with an attorney or CPA licensed where you work.

A commercial MEP contractor can usually license a copy of its project records to an AI company. Frankfurt Kurnit Klein & Selz, a New York law firm, answers the legality question with "it depends," and the dependencies are specific. You need the right to share each record under your owner contracts, GC subcontracts, NDAs and software agreements. Personal information about employees and client contacts usually has to be removed or handled the way privacy law requires. Federal work and anything marked as controlled usually stays out. Your attorney decides how each of those applies to your records.

Is it legal for a company to license its business records for AI training?

In most cases it is. No US federal law flatly bans a private company from licensing a copy of its own business records. The limits come from what you agreed to in contracts, what privacy law says about personal information in the records, and special rules for regulated material like controlled federal information. An attorney has to review all three before a license is signed.

Frankfurt Kurnit's October 2026 guidance, written for companies fielding these offers, says most companies can't sell everything a buyer asks for, and the review usually takes more work than the offer suggests.

Privacy promises you've already made also count. The Federal Trade Commission warned in February 2024 that "a business that collects user data based on one set of privacy commitments cannot then unilaterally renege on those commitments after collecting users' data." That applies to employee handbooks and privacy notices as well as consumer policies.

Licensing also leaves a record. Frankfurt Kurnit notes that a prior data sale will come up in diligence if you ever sell the company, so the review and the reasons behind it should be documented.

Who is buying company records for AI training?

AI developers and the data companies that supply them are buying internal business records, including email, documents, spreadsheets and workflow history. They want real examples of how work gets done in a specific industry. Public examples so far include a bankruptcy auction of an airline's internal data and dozens of smaller deals for shut-down startups' archives.

The largest public example is Spirit Airlines. Google won the August 2026 bankruptcy auction for Spirit's business data and software code with a $10 million bid, per an August 14 court filing reported by Skift. Mercor, an AI data company, was the backup bidder at $7.5 million. The court's final approval of the sale hadn't been confirmed when this guide was written. The data included finance, operations and revenue management records and about 100 million emails. All customer and loyalty data was excluded.

Smaller deals are more common. Forbes reported in April 2026, as summarized by Gizmodo, that SimpleClosure, a firm that winds down startups, handled nearly 100 data deals in a year, with payouts of $10,000 to $100,000 per company.

Buyers also go around companies. TechCrunch reported in October 2025 that AI labs hire former employees through Mercor because, in its CEO's words, "their customers don't want to give them data to automate large portions of their value chains."

What do you need before you can license your project records?

You need the right to share every record in the license. That right comes from your contracts. Before anything goes to market, someone has to read your prime contracts and subcontracts, your NDAs and your software agreements, and flag every clause that limits disclosure or use of project information. Records you can't clear stay out.

Here's where the limits usually sit:

Drawings and specs usually belong to someone else. Section 1.5.2 of AIA A201-2017, in the version the Universities of Wisconsin publish, lets contractors, subcontractors and suppliers use the design team's drawings and specs only for the Work, and bars using them on other projects without written consent from the owner and architect. The State of Louisiana's owner-modified A201 goes further: the contractor may not disclose "any information in connection with the Work or the Project" without the owner's written consent, and subcontractors are bound to the same terms.

Software terms can restrict use too. Frankfurt Kurnit points to Slack's API terms, which bar third-party apps from using data pulled through the API to train large language models. For how long you need to hold the originals while all this happens, see how long a contractor should keep project records.

Which privacy laws apply to employee and client contact data in project records?

Project records carry personal information: names, emails and phone numbers of your employees, GC project managers, owner reps and vendor contacts. Privacy law can apply to all of it. California's CCPA is the main example, because it covers employee and business contact data. A privacy attorney decides which laws apply to your records and what has to be removed.

The CCPA applies to for-profit businesses doing business in California that meet any one of three tests. The one most contractors hit is gross annual revenue of $26.625 million or more in the prior calendar year, the inflation-adjusted figure effective January 1, 2025, according to the California Privacy Protection Agency.

The CCPA's exemptions for employment-related personal information and for business-to-business data expired on December 31, 2022, according to the California Attorney General. Since January 1, 2023, California employees, job applicants and business contacts have the same rights as consumers.

Selling personal information covered by the CCPA brings notice and opt-out duties. Frankfurt Kurnit notes that data has to meet the statute's definition of deidentified, Cal. Civ. Code 1798.140(m), to fall outside those duties.

Other states have their own privacy laws, and health information, biometric data and call recordings carry separate rules. Your privacy attorney maps those to the states where you work and hire.

California isn't the only rule. Other states have their own privacy laws, health or financial information in your records can bring federal rules into play, and a union contract may limit how employee information is shared. Your privacy attorney decides which apply.

What records usually get excluded from a data license?

Most licenses leave out federal and defense project records, controlled unclassified information, payroll and HR files, privileged legal communications, records under a litigation hold, and any personal information that can't be reliably removed. Each exclusion either carries a legal restriction, belongs to someone else, or costs more to clean than it's worth. Your attorney makes the final call on each category.

1. Federal and defense work. Controlled unclassified information is governed by 32 CFR Part 2002, which reaches any organization that handles it. On Department of Defense contracts, DFARS 252.204-7012 requires contractors to safeguard covered defense information under NIST SP 800-171.
2. Payroll and HR records. Pay, benefits, discipline and medical information are high-risk personal data. Frankfurt Kurnit lists HR and payroll records among the first things to exclude.
3. Privileged material. Emails with your attorneys about claims, disputes or change order fights can lose privilege if shared.
4. Records under a litigation hold. Those stay out until your attorney releases the hold.
5. Union and labor communications. Frankfurt Kurnit notes that employee discussions of pay and working conditions may be protected under Section 7 of the National Labor Relations Act, and some collective bargaining agreements limit what can be sold.
6. Personal data that can't be removed. Scanned handwriting, photos of crews and voice recordings are hard to clean.

How does de-identification work, and what are its limits?

De-identification removes or replaces names, contact details and other identifiers before the records are used for training. It's usually done by a specialist firm working to a written standard, followed by testing and sign-off. It lowers the risk but doesn't remove it. Linked project records can still point back to a person or a company, models can repeat what they were trained on, and removing names doesn't make confidential content any less sensitive.

The Spirit Airlines deal shows a common structure. According to The Next Web's reading of the sale agreement, the data goes to a third party acceptable to Google, Google pays all de-identification costs, and the third party certifies the work against the CCPA while keeping records linked across the data set.

Regulators set a high bar for anonymous. The FTC wrote in July 2024 that "data is only anonymous when it can never be associated back to a person."

Scale is the hard part. Frankfurt Kurnit notes that removing identifiers from millions of messages is difficult, and that buyers want records linked, which makes individuals easier to profile. For an MEP contractor, a job number tying an RFI to a change order and a cost code is the value, and it's also a thread back to the project.

Training is permanent. Frankfurt Kurnit notes that once a model is trained on data, the data can't practically be removed, and models can repeat parts of what they were trained on.

What does a data license typically cover?

A data license sets what the buyer gets, what it can do with the records, for how long, and what happens if something goes wrong. Frankfurt Kurnit advises negotiating use restrictions, the split of privacy responsibility and remedies before any data moves. The main terms are below. Your attorney negotiates the final language.

A field-of-use clause addresses one risk Frankfurt Kurnit flags directly: the buyer could use your data to build a product that competes with you.

Deletion terms have limits. They can require the buyer to delete the copy it received, and they can't pull your records back out of a model that's already been trained.

How does Conduit fit?

Conduit Data is a broker. It never buys, holds or de-identifies data. Before anything goes to market, Conduit checks your contracts and software agreements. Federal and defense work, payroll and HR records are excluded. The buyer removes identifying details, in-house or through a specialist it hires, under standards written into the license.

You approve who does the de-identification and review a cleaned sample before delivery. Your attorney reviews every license before you sign it.

The license covers a copy, so you keep the originals and your retention schedule doesn't change. Records that fail the contract check, or that your attorney won't clear, stay out of the license. Your privacy attorney decides how privacy law applies to your records.

Frequently asked questions