2026년 11월 09일 법률칼럼 Corporate & Biz

Rights Warranties and Personal Data Responsibility in AI Training Data Agreements

1. Rules Governing Training Data Agreements
2. Scope of Copyright Warranties and Indemnities
3. Responsibility for Data Containing Personal Information
4. Treatment of Data and Models After Termination
5. Fee Calculation and Responsibility for Outputs
6. Implications for Businesses
Related Laws and References

Structuring the scope of the license, copyright warranties and indemnities, personal data responsibilities, and post-termination treatment of models

In agreements to supply or purchase training data for AI companies, rights infringement or personal data issues may surface after the data has already been used for training. Korea's Framework Act on Artificial Intelligence has been in force since January 22, 2026, but rights issues concerning training data are still assessed under the Copyright Act and the Personal Information Protection Act.

This article summarizes the key points to review in training data agreements: the scope of the license, copyright warranties and indemnities, responsibility for personal data processing, and the treatment of data and models after termination.

1. Rules Governing Training Data Agreements

The Framework Act on Artificial Intelligence has been in force since January 22, 2026. However, the Act focuses on matters such as labeling generative AI outputs and the obligations of operators of high-impact AI, while rights issues concerning training data are still assessed under the Copyright Act and the Personal Information Protection Act.

The government has stated that it will provide a guidance period of at least one year before imposing administrative fines. The guidance period defers sanctions; the statutory obligations apply from the effective date.

Training data agreements are generally structured as licenses permitting a certain scope of use of the data. The agreement should specify which uses are permitted, such as training, fine-tuning, evaluation, and commercial services.

2. Scope of Copyright Warranties and Indemnities

The Korean Copyright Act has no specific exception for AI training, so whether training is permitted is assessed under the fair use provision (Article 35-5).

In February 2026, the Ministry of Culture, Sports and Tourism and the Korea Copyright Commission issued guidance on assessing fair use in generative AI training. Although it is not a court ruling, it indicates that training used for services that compete with the original works is unlikely to qualify as fair use.

It is safer for the data provider to give warranties only to the extent it has verified its rights, and to set limits on warranties by identifying third-party works in the dataset through lists and source information. The purchaser should use indemnity clauses to determine who bears defense costs and damages if an infringement claim arises.

3. Responsibility for Data Containing Personal Information

Providing data that contains personal information, such as member posts or customer service records, for purposes beyond those for which it was collected may itself be problematic. If there is no consent to third-party provision, the parties should first consider whether the data can be provided after pseudonymization.

The Personal Information Protection Act permits the processing of pseudonymized information without the data subject's consent for purposes such as scientific research, but prohibits re-identification (Articles 28-2 and 28-5). The agreement should specify who performs pseudonymization and who is responsible if a risk of re-identification arises.

The Personal Information Protection Commission's guidance on personal data processing for generative AI also advises reviewing the legal basis and safeguards from the stage of collecting training data. The purchaser may require representations and warranties that the provider has a lawful basis for processing.

4. Treatment of Data and Models After Termination

It is common to require deletion of the data upon termination. The difficulty is that it is technically hard to remove only the influence of specific data from a model that has already been trained.

The agreement should distinguish whether existing models may continue to be used after termination and whether the data may be used to train new models. For data found to be infringing, the parties may also impose obligations to retrain without that data or apply output filters.

Requiring a deletion certificate and audit rights allows the parties to verify compliance with post-termination obligations.

Clause	Key Review Points
Scope of use	Permitted scope of training, fine-tuning, evaluation, and commercial services
Copyright	Warranties limited to verified rights, identification of third-party works, indemnities and caps
Personal data	Warranty of lawful basis, party responsible for pseudonymization, prohibition on re-identification
After termination	Deletion certificate, conditions for continued use of existing models
Fees and outputs	Calculation method and audit rights, obligation to prevent reproduction of original works

5. Fee Calculation and Responsibility for Outputs

Fees may be set as a fixed amount, a unit price based on data volume, or a share of revenue from the model. If fees are tied to revenue, the agreement should include calculation criteria and rights to inspect records.

If AI outputs are too similar to the supplied data, they may conflict with the provider's original business. The parties should consider making technical measures to prevent verbatim reproduction, and liability for breach, obligations of the purchaser.

The agreement should also separately address whether the provider's name or brand may be used to promote the AI service.

6. Implications for Businesses

Training data agreements are transactions in which it is difficult to control how the data is used once it has been provided. Defining the scope of the license and the limits of warranties in concrete terms allows providers to avoid excessive liability and purchasers to reduce unexpected infringement risks.

Standards on copyright fair use and personal data processing are being shaped by government guidance, but court decisions have not yet accumulated in this area. When concluding an agreement, companies should also consider renegotiation clauses addressing changes in these standards and the allocation of liability in disputes.