How to prepare a data room for an AI data buyer

A buyer that wants company data for AI training will ask the same few questions in the same order. A data room that answers them up front makes the review faster, and it shows you what to settle inside the company before you share anything.

This page is a checklist grouped by what a data buyer asks. It is general information, not legal advice.

What to do before you build the data room

• Start with an inventory. If you cannot say what the data is, where it came from and who may agree to share it, nothing else in the room will help.
• Do not put personal data in a room before you have settled who may agree, and what the privacy notices and contracts allow.
• AI data buyers pay companies to license their work records, like email, chat and documents. Apply once to see which buyers fit before you prepare anything. No files and no company records are needed to start.

What an AI data buyer asks, in order

A data room checklist for an AI data buyer, grouped by the question the buyer asks.

The buyer asks	Put in the room	Why it speeds the review
1. What is it?	An inventory of each dataset: name, what it contains, fields or schema, volume, time range, languages, formats, how often it is updated. A small sample, prepared as in the section below.	The buyer can decide in minutes whether the data is of interest.
2. Who owns it?	For each dataset, how the company came to hold it: created by staff, supplied by customers, bought, scraped, or licensed in. Employee and contractor agreements that assign rights to the company. Any third-party content inside.	A buyer can license only what you can license.
3. May it be used for training a model?	The privacy notices and terms in force when each dataset was collected. The lawful basis or consent for personal data, if any. Records of processing. Contracts that limit use, require deletion or make a customer the owner. Opt-outs and deletion requests received and how they were handled.	The buyer sees that your right to use the data has been checked.
4. Where did it come from?	Provenance for each dataset: the source, when and how it was collected, who issued it, what was done to it since. A written lineage note is enough to start.	Buyers ask for the history before they ask for the data.
5. What state is it in?	File formats, completeness, known errors, labels or annotations and who made them, de-identification steps and their limits.	The buyer sees the work needed to use it.
6. What is in it that must not leave?	A list of personal data, credentials, trade secrets, and anything a customer made confidential. Which of it is removed before sharing.	It shows you control what is shared.
7. What limits sit on it?	Customer contracts, supplier terms, third-party data licenses, open-source licenses, export or sector rules, and any promise made to individuals.	The buyer sees the limits early, not late in the review.
8. Who can say yes, and how is it shared?	Who is authorized to agree for the company, with the approvals behind it. How the buyer will review: where, by whom, under what terms, and a log of who saw what.	The buyer knows it is dealing with someone who can sign.

1. What is it?

Put in the room

An inventory of each dataset: name, what it contains, fields or schema, volume, time range, languages, formats, how often it is updated. A small sample, prepared as in the section below.

Why it speeds the review

The buyer can decide in minutes whether the data is of interest.

2. Who owns it?

Put in the room

For each dataset, how the company came to hold it: created by staff, supplied by customers, bought, scraped, or licensed in. Employee and contractor agreements that assign rights to the company. Any third-party content inside.

Why it speeds the review

A buyer can license only what you can license.

3. May it be used for training a model?

Put in the room

The privacy notices and terms in force when each dataset was collected. The lawful basis or consent for personal data, if any. Records of processing. Contracts that limit use, require deletion or make a customer the owner. Opt-outs and deletion requests received and how they were handled.

Why it speeds the review

The buyer sees that your right to use the data has been checked.

4. Where did it come from?

Put in the room

Provenance for each dataset: the source, when and how it was collected, who issued it, what was done to it since. A written lineage note is enough to start.

Why it speeds the review

Buyers ask for the history before they ask for the data.

5. What state is it in?

Put in the room

File formats, completeness, known errors, labels or annotations and who made them, de-identification steps and their limits.

Why it speeds the review

The buyer sees the work needed to use it.

6. What is in it that must not leave?

Put in the room

A list of personal data, credentials, trade secrets, and anything a customer made confidential. Which of it is removed before sharing.

Why it speeds the review

It shows you control what is shared.

7. What limits sit on it?

Put in the room

Customer contracts, supplier terms, third-party data licenses, open-source licenses, export or sector rules, and any promise made to individuals.

Why it speeds the review

The buyer sees the limits early, not late in the review.

8. Who can say yes, and how is it shared?

Put in the room

Who is authorized to agree for the company, with the approvals behind it. How the buyer will review: where, by whom, under what terms, and a log of who saw what.

Why it speeds the review

The buyer knows it is dealing with someone who can sign.

Start with your records of processing

If the data includes personal data and the GDPR applies to the company, Article 30 asks each controller to keep a written record of its processing. The record covers, among other things, the purposes of the processing, the categories of data subjects and of personal data, the categories of recipients, and, where possible, the envisaged time limits for erasure. Article 30(5) exempts an enterprise or organization employing fewer than 250 persons from the record-keeping obligations in paragraphs 1 and 2 unless its processing is likely to result in a risk to individuals’ rights and freedoms, is not occasional, includes special categories of data under Article 9(1), or includes personal data relating to criminal convictions and offenses under Article 10. Ask counsel whether the article applies to you.

If you already have these records, add them to the room: they are the best starting point for rows 3 and 4 of the table. If you do not, writing them is a good first job whether or not the article requires it.

Show where the data came from

Row 4 asks where each dataset came from. A short written lineage note for each dataset is enough to start: the source, when and how it was collected, who issued or supplied it, and what has been done to it since. You do not need to follow any standard to prepare a room.

Prepare a sample without sharing personal data

A sample helps a buyer judge quality. Prepare it before you decide anything else:

1. Choose a small part of the dataset that shows its range.
2. Remove or mask personal data and anything confidential. Say what you did.
3. Keep the original untouched.
4. Do not send the sample anywhere until the person who can agree for the company has agreed.

OpenTrain never receives or holds the data a company licenses, so send a sample only to the buyer, never to OpenTrain.

What buyers ask to see in a sample

What a buyer needs to see is that buyer’s decision. Ask each buyer these questions before you prepare a sample for it:

1. Which datasets do you want a sample of, and how large a sample?
2. What format do you need? Is a field list or schema enough to start?
3. What do you remove or transform before anyone else sees the data? Can we see a representative sample of the result before we sign?
4. Who at your company, or at your vendors, will see our sample, and where?
5. Is the sample covered by a confidentiality agreement, and what happens to it if we do not sign a license?

This page is a general readiness list. It is not any buyer’s list, and it does not say what any buyer will accept.

Common questions about data rooms for AI data buyers

Do I need all of this before I apply?

No. You can apply before you prepare anything. No files and no company records are needed to start.

Is a data room the same as sharing the data?

No. A data room holds the documents about the data. Sharing the data itself is a later step and is between the company and the buyer.

Does a complete data room mean a buyer will pay more?

We make no such claim. We have no dated source for it.

Sources

• General Data Protection Regulation, Article 30, records of processing activities. EUR-Lex.

Sources: Amounts in "How much a company can earn": the AI data buyer's own data-licensing page, read October 29, 2026. You see the buyer's name and link when you see which buyers fit. Business Insider, 'AI labs are fueling a wild market for your Slack DMs', October 13, 2026. Read October 24, 2026.