Almost every AI vendor contract has a line that says something like “you retain ownership of your data.” It reads well, and it makes the deal easy to sign. But that sentence often does a lot less than it sounds like it does. For a dealer, the gap between what the contract says and what you can actually do with your data is where you get quietly locked in. Here is how to read past the reassuring language.
Ownership on paper, control in practice
A contract can say you own your data while the vendor holds every practical lever over it. They store it. They decide the format. They control access and export. They set what happens when you leave. You hold a title to something sitting in someone else’s building, and you need their cooperation to touch it. Ownership that you cannot exercise is a word, not a right.
Think of it like owning a car that lives in a locked garage you do not have the key to. The title has your name on it, and none of that helps when you want to drive somewhere today. With data, the vendor holds the key, sets the hours, and decides how hard it is to get your own property back out.
The clauses that hollow out the promise
Read past the ownership line and look for what surrounds it. A broad license grant lets the vendor use, copy, and process your data however they like, including to train their models on your customers. Aggregated and anonymized data carve-outs let them keep and monetize insights drawn from your operation, forever, even after you leave. Vague export language promises return without specifying the format, the timeline, or the completeness. Each clause chips away at the ownership the headline promised.
These rarely look alarming on their own. A license to use your data “to provide and improve the services” sounds routine, and it is broad enough to cover training models on your customer conversations. An anonymized-data carve-out sounds harmless, and it lets the vendor keep the most valuable thing you produced, the patterns across all your deals, long after you have gone. The danger is in the ordinary wording, not in some obvious trap.
Residency is not ownership
Vendors often answer ownership questions by talking about where data is stored: which region, which cloud, which security certification. That is residency, and it is not the same thing. Knowing your data sits in a compliant data center tells you nothing about whether you can get it out, whether the vendor is training on it, or what you keep when the relationship ends. Do not let a residency answer settle an ownership question.
It is a common bait-and-switch in a sales conversation, usually not even a deliberate one. You ask who owns the data and whether they train on it, and the answer comes back about being hosted in a certified region with encryption at rest. Those are real security facts and they answer a different question. Note that the ownership question went unanswered and ask it again.
What true ownership and portability look like
Real ownership shows up in what you can do, not what the contract asserts. You can export your complete data, in a standard usable format, whenever you want, without asking permission. The vendor does not use your customers to train models you do not control. When you leave, you take everything and their copies are deleted. And the system is built on open standards like MCP, so your data and integrations can move to another provider without being rebuilt from scratch. That last point matters most: portability by design beats portability by promise.
The better model: own the context itself
The cleanest way out of this trap is to not hand over the data in the first place. AI built on context you own works from your systems and your records without absorbing them into a vendor’s platform. The AI connects to your data; it does not swallow it. There is no ownership clause to argue about because the data never left your custody. When the arrangement is built that way, “your data” means exactly what it says. A dealer running this model does not have to trust a paragraph on page nine of a contract, because there is no copy in a vendor’s environment to fight over later.
What to do before you sign
Take any AI contract to whoever handles your legal review and point them at three things: the license grant, the export terms, and the exit clause. Ask the vendor to put export format, timeline, and deletion-on-exit in writing. If they will not, the ownership line at the top was decoration. You want a deal where owning your data means you can actually walk out the door with it.
Frequently asked questions
Is a broad license grant always a red flag?
Not always, because a vendor does need some license to actually run the service on your data. The red flag is scope. A license limited to operating the product for you is reasonable; one that lets the vendor use your data to train their models, build other products, or keep insights forever is not. Read for what the license allows beyond simply delivering the service you bought.
What does anonymized data actually give away?
It gives away the patterns, which are often the valuable part. Individual records stripped of names may not identify a customer, but the aggregate view of how your store prices, what sells, and how your deals move is real competitive intelligence. A carve-out that lets a vendor keep and monetize that means your operation is quietly funding insights that may end up helping competitors.
How do I test export before I commit?
Ask for a full export during the trial and see what comes back. A vendor built for portability returns your complete data in a clean, structured format quickly and without drama. One built to lock you in stalls, charges a fee, or hands over a partial or unusable file. What actually lands in your inbox tells you more than any promise in the contract.
This is the kind of capability you should own, not rent. See how VCTRS gives dealers AI built on context you own on our AI for car dealerships page.