Which contract-level practice helps address IP concerns and lawful data sourcing in AI risk management?

• A. Establish policies and procedures addressing IP-related concerns and ensure lawful data sourcing.
• B. Postpone policy development until issues arise.
• C. Only audit external AI providers annually.
• D. Focus solely on model testing.

Answer: (A)

Establishing policies and procedures at the contract level provides the formal guardrails needed to manage IP and data-sourcing risks in AI. When vendor agreements and data-use terms are defined upfront, the organization can specify who owns the data and the model outputs, what licenses apply to training materials, and what restrictions govern data usage. This creates clear expectations for suppliers, enabling traceability of data provenance, attribution requirements, and compliance with IP laws and licensing terms. It also establishes rights to audit and verify data sources, enforce changes if data is found to be misused, and require indemnities or remedies if IP issues arise. By embedding these controls in contracts, the organization can systematically enforce lawful data sourcing, protect proprietary assets, and reduce the risk of inadvertent IP infringement across AI initiatives.

Postponing policy development invites ambiguity and reactive risk management. Auditing external AI providers only annually misses ongoing monitoring and verification as data sources or datasets change. Focusing solely on model testing neglects the broader risks around where data comes from, how it’s licensed, and who holds IP rights to the outputs.