Can we fine-tune a model on our customers' data?

Only if your customer agreement grants a right that covers it. Most SaaS terms grant a licence to host, process, and display customer content for the purpose of providing the service. Training a model whose weights persist after the customer leaves is a different use, and the safe reading is that a general service-provision licence does not reach it. Aggregate-and-anonymised improvement clauses are the usual hook, and they were mostly drafted for analytics, not for model weights.

Are model weights a derivative work of the training data?

It is unsettled, and you should not build a business on either answer. The safer position is that the training copies themselves are reproductions requiring a right, that weights can memorise and re-emit training material, and that your exposure is therefore best managed at the input licence and the output filter rather than by winning an abstract argument about derivative works.

Does the AI vendor's licence allow us to fine-tune and keep the result?

It varies enormously. Open-weight licences may restrict fields of use, impose acceptable-use terms that flow through to your product, or require attribution or the same licence on derivatives. Hosted fine-tuning services often keep the tuned model inside their platform, so you hold a right of use rather than an asset. Read for portability and for what happens on termination before you build a roadmap on it.

Does our vendor's copyright indemnity cover a model we fine-tuned?

Frequently not. Output indemnities commonly exclude modified models, customer-supplied training data, and cases where filters or safety features were disabled. Fine-tuning is the single most common act that voids the protection people assume they are relying on, and the exclusion is usually two clauses below the headline promise.

What is the risk in fine-tuning one model on many customers' data?

Cross-tenant leakage. A model tuned on all tenants can surface one customer's phrasing, pricing, names, or internal terminology to another, which is a confidentiality breach even where copyright never enters the picture. Per-tenant adapters, or retrieval over a permissioned index instead of training, avoid the whole class of problem.

Fine-Tuning on Customer and Licensed Content: Copyright and License Risk 2026

Question One: Did the Data's Licence Contemplate Training?

Start with the instrument that put the data in your hands. A customer agreement typically grants a licence to host, process, transmit, and display customer content for the purpose of providing the service, sometimes with a narrow right to use aggregated and de-identified data to improve it. A fine-tune is not obviously inside either grant: the purpose is not the provision of that customer's service, and the artefact is a durable model that survives the contract's termination.

The same test applies to every other source. Licensed reference content usually permits internal use and display, not incorporation into a distributed model. Content scraped under a site's terms of use is governed by those terms whatever the copyright analysis says. Partner and marketplace data almost always carries a purpose limitation. The question is never "is training legal in general" — it is "what did this specific agreement grant".

Question Two: What Does the Model Vendor's Licence Allow?

Open-weight licences are not interchangeable. Some carry field-of-use restrictions and acceptable-use policies that flow through to your customers. Some require you to license derivatives on the same terms or to preserve attribution and naming conventions. Hosted tuning services often keep the tuned model inside the platform, which makes it a right of access rather than an asset you own — a material fact if your plan involves moving providers or selling the model. Read for three things: what you may build, what you may keep, and what happens when the agreement ends.

Question Three: What Comes Back Out of the Weights?

Memorisation and Regurgitation

CRITICAL RISK

Small, repetitive, or heavily duplicated training sets increase the chance the model reproduces distinctive passages verbatim — the failure mode most likely to look like infringement to a rights holder.

Cross-Tenant Leakage

CRITICAL RISK

One model tuned on all customers' data can surface tenant A's pricing, names, or internal terminology in tenant B's session. A confidentiality breach regardless of the copyright position.

Personal Data Inside the Weights

HIGH RISK

Tickets and CRM notes carry personal information. A deletion request against a model you cannot selectively unlearn is a much harder problem than deleting a row.

Voided Vendor Indemnity

HIGH RISK

Output indemnities routinely exclude modified models, customer-supplied training data, and disabled safety filters — three conditions a fine-tune commonly satisfies at once.

Unownable Output

MEDIUM RISK

Whatever the model emits still faces the human-authorship rule. The fine-tune improves relevance; it does not make the output a protectable work.

Question Four: Do You Need a Fine-Tune at All?

A large share of fine-tuning projects are solving a retrieval problem. If the goal is for the model to know your documents, retrieval over a permissioned index gets you there with the access controls intact, the deletion story straightforward, and the customer's material never entering the weights. Reserve tuning for format, tone, and task behaviour — where the training data can be your own examples rather than your customers' content.

Pre-Training-Run Checklist

Every item is cheap before the run and expensive after it, because untraining is not a thing.

Build a dataset provenance record: for each source, the agreement that supplied it and the clause that permits training— Required

Read the customer agreement's improvement clause literally; if it says aggregated and de-identified, the dataset must be both— Required

Check the base model licence for field-of-use limits, derivative-licensing terms, and whether you can export the tuned weights— Required

Re-read the vendor's output indemnity for the modified-model and customer-data exclusions before relying on it— Required

Deduplicate the dataset and strip PII and secrets before training — duplication is what drives memorisation— Engineering

Use per-tenant adapters or retrieval instead of one shared tuned model on multi-tenant data— Architecture

Run a memorisation probe on the finished model against distinctive strings from the training set— Testing

Keep the dataset snapshot and its provenance manifest so the model can be rebuilt without a tainted source— Documentation

Add an explicit, opt-in training right to the customer agreement if training is part of the roadmap — retroactive consent is the hard version— Contract

Audit your AI product's compliance exposure

RatedWithAI helps tech teams understand their compliance posture across accessibility, privacy, and AI regulation requirements. Start with a free scan.

Scan Your Product for Free →

Frequently Asked Questions

Our terms let us use data to 'improve our services'. Is that enough?

It is the clause everyone points at and it is thinner than it looks. Improvement language was largely written for analytics and debugging, it usually sits next to an aggregation or de-identification qualifier, and it has to survive a customer reading it after the fact. If training is a real part of the plan, add a specific right rather than stretching a general one.

Does de-identifying the data solve the copyright question?

No — those are different problems. Removing names addresses privacy; it does nothing about the fact that the text is somebody's copyrighted expression held under a purpose-limited licence. You need both analyses, and the copyright one turns on the contract, not on the identifiability of the content.

What if the customer asks us to delete their data after we trained on it?

Plan for it before you train. Deleting the source rows is straightforward; extracting a customer's influence from the weights is not, and the practical answer is usually retraining from a clean dataset snapshot. That is only possible if you kept the snapshot and its provenance manifest — which is why the manifest is on the checklist.

Is a LoRA or adapter different from a full fine-tune legally?

The training-copy and licence questions are the same: you still made copies of the material and still need a right to do so. What changes is engineering leverage — adapters can be per-tenant, swapped out, and discarded, which makes deletion and leakage far more tractable. Better architecture, same contract analysis.

Who owns the tuned model?

Whatever the base model licence and the tuning service agreement say, which is often less than teams assume. Hosted tuning may leave you with a right of use inside that platform rather than portable weights. Settle ownership, export rights, and post-termination access in writing before the model becomes load-bearing for the product.

Related Guides

AI Vendor Copyright Indemnification

The exclusions that decide whether the promise still applies after you modify the model.

Training Data Copyright Lawsuits

How the disputes over training corpora are being framed.

Deletion Requests Against a Model

What a deletion right means once the data is in the weights.

Open-Weight Model Licence Compliance

Field-of-use limits and derivative terms on the base model you tuned.