Insights · 6 min read

Common Mistakes When Selling Company Data to AI Labs, and Fixes

Most expensive errors happen before a buyer is involved, and a few happen in the contract. Here are the ones public evidence points to.

Bearish AI · October 21, 2026

Selling company data is new enough that there is no settled playbook. Public reporting and research do show where sellers and buyers get hurt. These mistakes fall into four groups: rights, privacy and secrets, the deal itself, and how the data is built and shown. Nothing here is legal advice; use it as a checklist to take to your lawyer.

Rights mistakes

The first mistake is confusing possession with permission. An audit of more than 1,800 text datasets found license information omitted on more than 70 percent of entries on popular dataset hosting sites and wrong on more than 50 percent, a reminder that even large communities lose track of rights. Your own archive has third-party code, customer-supplied material and confidentiality clauses. Check them before you spend on preparation.

The second is including data about customers or employees. The US Federal Trade Commission has warned that using customer data for model training contrary to what customers were told can violate the law, and says it has required deletion of models and algorithms built on unlawfully obtained data. MIT Technology Review reports that sellers exclude HR records, and quotes a lawyer who advises AI startups calling this kind of workplace data “legally radioactive.” Ask your counsel what applies to the people in your archive.

The third is believing that pseudonymization settles the question. The European Data Protection Board says pseudonymized data that can be attributed to a person with additional information is personal data, and that pseudonymization alone will normally not be sufficient for data protection by design or for security. It reduces risk. It does not replace a review of rights, confidentiality and licensing.

Privacy and secrets mistakes

Deleting a leaked credential from history is not the same as revoking it. GitHub’s guidance says to rotate or revoke first, because rewriting history cannot remove copies from forks and clones and cached views may remain. Scan the entire history, since secret scanning covers all branches and old commits.

Do not rely on one detector. The StarCoder team’s regular expression for keys scored an F1 of 6.74 percent, and their best model 70.41 percent. Layer patterns, models and human review of samples, and record the miss rate.

Do not ship the lookup table. If you replaced names with stable stand-ins using a table, the EDPB says that table is personal data and has to be protected. Delivering it undoes your work.

Deal mistakes

Read the grant. A draft license reported in October 2026 asked for a non-exclusive, royalty-free, perpetual, irrevocable, transferable and sublicensable license. Seller-friendly terms are possible, but you have to ask. Our clause guide is at /insights/ai-data-licensing-agreement-terms.

Price exclusivity. Two environment founders told Epoch AI independently that exclusive deals cost about four to five times as much as non-exclusive ones. Granting exclusivity as a courtesy leaves that premium on the table.

Know what you are selling. MIT Technology Review reports that buyers quote very different numbers for the same archives because their estimates of usable yield are uncertain, and that founders who sold had little visibility into who bought their data. Sellers who can show what their data yields, for example as verified tasks, negotiate from evidence.

Build and presentation mistakes

For coding tasks, do not leave the answer reachable. An open issue on the SWE-bench project showed agents running git log --all to read later commits containing fixes. A separate audit found shortcut attempts in 60.7 to 90.1 percent of trajectories on one benchmark under standard evaluation. See /insights/bug-history-to-fail-to-pass-coding-tasks.

Do not send a sample that is cleaner than the rest, and do not send anything without a data card. A buyer who finds the full set does not match the sample will re-check everything. See /insights/data-cards-and-provenance-for-ai-training-data.

Process mistakes

Order matters. Teams that link records before pseudonymizing have to redo the links. Teams that prepare data before checking rights pay to clean material they cannot sell. Teams that skip logs on early passes cannot show removal counts later. A sensible order is rights, secrets, people, duplicates, links, documentation, sample. It is the same order used in /insights/prepare-company-data-for-ai-labs.

Why these mistakes repeat

Most of them come from treating the sale as a file transfer. It is closer to publishing something about your company and your people, and keeping the right to do so. If you treat each stage as one that has to produce evidence, whether a memo, a log or a count, the mistakes show up while they are still cheap to fix.

A short pre-flight list

• Rights: written, reviewed, with exclusions listed.
• Secrets: rotated, with the scan covering the full history.
• People: pseudonymized, with mapping held separately and a sample reviewed.
• Terms: grant, term, exclusivity and warranties read by a lawyer.
• Documentation: data card, removal counts and a sample made the same way as the rest.

The free estimator at /estimate gives a conservative range and shows how unclear rights or personal data pull the number down, which is a quick way to see which of these mistakes would cost you most.