FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: IT consultants and developers
Training or fine-tuning a model on data you do not have rights to use can expose you and your client to intellectual property and data protection claims. The developer often controls the training pipeline, so it is often the first party asked where the data came from.
Part of: AI in IT consultants and developers
In short
Developers fine-tune and train models for clients on documents, code, images and customer data. Two legal risks follow. Intellectual property: training data may be protected by copyright or database right, and outputs may reproduce it. Data protection: personal data in training sets needs a lawful basis, transparency and security. Contracts often add IP indemnities that go beyond PI cover. BCS clauses 2.4 and 3.4 apply, and public sector contracts may bar training on buyer data under PPN 017. Technology PI may respond to some IP and data claims, subject to the wording, but indemnities and deliberate infringement are common gaps.
Projects include fine-tuning a language model on a client's support history, training a classifier on scanned documents, building a code model on the client's repositories, or enriching a client dataset with scraped public content. The developer selects data sources, prepares and labels data, runs training and evaluates outputs. Choices made at each stage, particularly about data sources, decide much of the legal risk.
BCS members must know and comply with relevant legislation (2.4) and must not disclose confidential information (3.4) under the BCS Code of Conduct. The AI Cyber Security Code of Practice asks developers to document data, models and prompts (principle 8), track and protect assets (principle 5) and dispose of data and models properly (principle 13). Documentation of data provenance is the single most useful record if a rights question arises later.
Personal data in training sets is regulated by UK GDPR. The ICO's AI guidance hub covers AI and data protection and offers a risk toolkit, and the ICO's guidance plans include final foundation models guidance in Autumn 2026. For public sector clients, contracts under PPN 017 may prohibit using buyer data to train AI without written approval.
Illustrative scenario: a developer fine-tunes a model for a publisher to draft product descriptions. To improve quality, the team adds text collected from competitor websites and a licensed database whose terms did not permit machine learning use. The model later produces passages close to the competitor copy. The competitor and the database owner both raise claims against the publisher, which relies on an IP indemnity in the development contract to claim against the developer.
A data protection variant: a model trained on customer service transcripts memorises account details and reproduces them in responses to other users, leading to complaints and a possible breach.
Clients increasingly ask developers for indemnities covering IP infringement by the model or its outputs. Technology PI policies often include some cover for unintentional IP infringement arising from your professional services, but the extent varies, and liability you accept only because of a contractual indemnity may be excluded or limited. Deliberate or knowing use of unlicensed material is commonly outside cover. Patent infringement may be treated differently from copyright. See AI IP infringement insurance and AI-generated content and IP claims.
Training projects raise questions that ordinary software contracts may not answer. Who owns the fine-tuned model weights? Can the developer reuse techniques, prompts or base components for other clients? May the developer use the client's data, or learning from it, on other projects? If the contract is silent, a dispute may arise later over reuse, particularly where a second client's model behaves suspiciously like the first. Agreeing ownership, licence back, confidentiality and deletion of training data at the end of the project protects both sides and reduces the chance of a confidentiality claim under BCS clause 3.4 principles.
Apex arranges technology PI for developers who train and fine-tune models. A broker reviews how your policy treats IP and data claims and whether your contract indemnities fit your cover. See also LLM integrations and the IT consultants AI hub.
Usually, if the client has the right to use that data for training and has agreed to it in writing. Check for third-party licence limits, personal data issues and public sector terms such as PPN 017, which may bar training on buyer data without approval.
The client publishing the output usually faces the claim first. It may then claim against the developer under the contract, especially if you gave an IP indemnity or chose the training data. Clear records of data sources are your best defence.
Many tech PI policies include some cover for unintentional IP infringement in your professional services, subject to the wording. Contractual indemnities beyond your legal liability and deliberate use of unlicensed material are common exclusions.
Yes. Personal data used in training is subject to UK GDPR, including lawful basis, transparency and security. The client is usually the controller, but the developer should help identify personal data and reduce it to what is necessary.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
