Can a company sell or license its internal data to AI labs?

Checked October 10, 2026 · Nick Hensel, founder of Pinprick

Companies are being paid to do this. As of October 2026, at least two buyers publish open programs that pay companies to license internal records. Troveo, a data licensing marketplace, says a company can when it owns or controls the rights to the data and the process handles privacy, confidentiality and contractual restrictions properly. Whether your firm can depends on your contracts and the privacy laws that apply to you.

Disclosure. Pinprick offers a data licensing service that represents the firm selling, so we have a commercial interest in this topic. We are not a law firm and nothing here is legal advice. Use your own counsel before you sign anything. Sources are linked below.

Who is buying company data?

Two kinds of buyer. The first are companies that prepare training material for AI labs. micro1 and Mercor both run public programs. On October 9, 2026, The Next Web reported that micro1 had committed $1 billion over 12 months to buy and license company data, with capital from Citi and Hercules Capital.

The second kind are the large AI developers themselves. In 2026 Google bid $10 million for the internal records of the bankrupt Spirit Airlines, and its lawyers said the de-identified data would be used to train AI models, according to Fortune.

What do they want?

Records of how work gets done. micro1 lists standard operating procedures, knowledge bases, internal documents, CRM data, project histories and quality checks, plus records of how teams make decisions. Mercor asks firms to connect the tools they already use, such as email, Slack, Teams, shared drives and Salesforce.

Mercor's page gives the reason: frontier AI models are being trained to work inside companies, and public data and synthetic datasets cannot replicate that.

How does the process work?

Put together, the two buyers' pages describe these steps:

An assessment. You describe your company and your systems. The buyer decides if you are a fit.
Scope. You choose what is included. Mercor asks you to choose which tools to share, and says no data leaves your systems until you approve it.
An agreement. You sign a license with the buyer. This is where the real terms are set.
De-identification. Names and personal details are removed or replaced. Mercor says this step is automated on its platform. micro1 says personal information is removed "when relevant" and that companies can review samples first.
Payment. Mercor says payment typically arrives within two to four weeks of the signed agreement, depending on data extraction and processing time.

These are the buyers' own descriptions.

What makes a company eligible?

micro1 asks for 30 or more employees, established documentation, and records in English. It takes US companies first, then other Western markets. Mercor lists industries it wants, including legal, insurance, professional services, manufacturing, real estate and logistics.

A rights review comes before any of that. Troveo, a data licensing marketplace, calls it "the first serious step": establishing what the company has authority to license. See what company data can't be licensed.

What are good reasons not to do it?

There are several, and an honest answer includes them.

Your contracts may forbid it. Client agreements and NDAs often restrict how you use what clients gave you. One October 2026 analysis notes that removing names may not cure a confidentiality clause.
Removing names is not a guarantee. A 2019 study in Nature Communications estimated that 99.98% of Americans could be correctly re-identified in any dataset using 15 demographic attributes.
Your staff may object. In the proposed Spirit Airlines sale, unions representing flight attendants objected that personal information about former employees might not be properly redacted or anonymized, and the pilots' union argued some safety records should stay confidential even after de-identification, Fortune reported. No sale had been approved by the court when Fortune reported on it in September 2026.
The public pages leave out key terms. As of October 2026, neither micro1's nor Mercor's program page states how long the license lasts, whether it is exclusive, or who else may receive the data. Those are set in the agreement. See the terms that matter.
You may not want to. You may not want your methods used to train tools that your competitors can also buy. That is a fair reason to pass.

What should you do first?

Write down what you hold before you talk to a buyer: which systems, how many years, and roughly how much. Then mark what is yours and what belongs to clients. Ask your own lawyer to read that list. Only then is it worth asking what the records might be worth.

If the first you heard of this was a cold email, read how to check who is behind it.

Common questions

Is it legal for a company to license its internal data for AI training?

It can be, if the company owns or controls the rights to the records and handles personal data and third-party confidential material properly. Whether your firm can do it depends on your client contracts, your NDAs and the privacy laws that apply to you. That is a question for your own counsel, not for a buyer or a broker.

Who buys company data for AI training?

As of October 2026, micro1 and Mercor both publish programs that pay companies for internal records. Google also bid directly for the internal records of the bankrupt Spirit Airlines in 2026, Fortune reported.

Do we lose ownership of our data?

micro1's program page says companies keep ownership of their underlying data. What matters is what the license lets the buyer do with its copy, for how long, and who else can receive it.

How big does a company need to be?

micro1's page asks for 30 or more employees, established documentation and records in English, with US companies first. Mercor's page lists target industries and does not state a size.

How long does it take?

Mercor says payment typically arrives within two to four weeks of a signed agreement, depending on data extraction and processing time. That does not include the time you and your counsel take to decide what is in scope.