Who Owns an AI Agent? Code, Prompts and Data Exit Rights

If you pay for an AI agent, you should own what the project produces and be able to run it without the vendor. Many contracts do not say that.

An agent is not one asset. It is code, prompts, tests, logs, data, and sometimes model weights. Each can have a different owner unless the contract says otherwise.

This is a practical guide to AI agent ownership and exit rights. I am not a lawyer, and this is not legal advice. Use it to ask better questions, then have counsel write the clauses.

The Assets in an Agent Project

Before you argue about ownership, list what exists. A typical agent project produces eight things:

1. Code. The orchestration logic, tool connectors, and glue between systems.
2. Prompts. System prompts, templates, and instructions that shape behavior.
3. Evals. The test set and scoring method used to judge quality.
4. Logs and traces. Records of what the agent saw, decided, and did.
5. Your data. Documents, records, and examples the agent reads or learns from.
6. Derived data. Embeddings, indexes, and labeled examples built from your data.
7. Model artifacts. Fine-tuned weights or adapters, if any.
8. Configuration and runbooks. Infrastructure setup, deployment scripts, and operating instructions.

Most disputes happen on items 2, 3, 6, and 7. Buyers think about code. They forget the rest.

Code and Prompts

Start with a simple rule. You pay for the work, so you should own the work. The exception is the vendor’s pre-existing tools, which you license.

Here is why the contract language matters. In US law, a work made for hire has a narrow definition. The statute covers works by employees within their job, plus commissioned works that fall into nine listed categories and are backed by a signed written agreement. Custom software written by an outside firm does not obviously fit those categories. So do not rely on a handshake or on the phrase “work for hire” alone. Ask counsel for an explicit assignment of rights in the deliverables.

Prompts need their own line. Many vendors treat prompts as trade secrets and refuse to hand them over. That is a problem. If the agent’s behavior lives in prompts, then prompts are the product. Without them you cannot maintain or move the agent.

A clean split looks like this:

• You own: code written for you, prompts written for you, configuration, runbooks.
• Vendor owns, you license: their general-purpose frameworks and tools that existed before your project and are used on other clients.
• License terms for the second group: perpetual, irrevocable, royalty-free for your internal use, and survives termination.

My recommendation: if a vendor will not license its pre-existing tools on those terms, ask them to list exactly which parts are theirs. A vague “proprietary platform” can hide most of the system.

Evals and Logs

Evals are the quiet asset. A test set with correct answers tells you if the agent works. If the vendor keeps it, you cannot check a new vendor, a new model, or a new version against the old standard.

Ask for:

• The full eval set, including inputs and expected outputs
• The scoring method and any scripts
• Results from each release

Logs matter for three reasons: debugging, audits, and compliance. The EU AI Act sets one concrete floor. Article 26(6) says deployers of high-risk AI systems must keep automatically generated logs under their control for at least six months, unless other law says otherwise. Whether your agent counts as high-risk depends on its use, so check with counsel. But the principle holds for any agent: if the logs live only in the vendor’s system, you may not be able to produce them when asked.

Ask for logs in your storage, in a documented format, with a retention period you set.

For more on keeping logs useful, see my notes on least-privilege permissions for agents. Good permission design also makes good audit trails.

Models and Weights

Two separate questions here: who owns the output, and who owns the model.

Output. The major model providers have settled this in their business terms. Anthropic’s commercial terms say the customer retains rights to its inputs and owns its outputs, and that Anthropic may not train models on customer content from the services. OpenAI’s services agreement (effective January 1, 2026) says the customer owns all output and that OpenAI will not use customer content to improve its services unless the customer agrees. Terms change, so read the current version. And confirm your agent vendor passes these protections down to you instead of weakening them.

One caution. Owning output by contract is not the same as holding a copyright. The US Copyright Office’s January 2025 report on copyrightability concludes that prompts alone are unlikely to meet the human authorship bar. If a copyright claim on agent output matters to your business, talk to counsel early.

Weights. If a vendor fine-tunes a model for you, ask who holds the result. With an open-weight model, the answer may be set by the model’s license. For example, Meta’s Llama 3.1 license says the licensee owns its own derivative works and modifications, requires fine-tuned models to start with “Llama” in the name, and requires a separate license above 700 million monthly active users. Other licenses differ. Read the one that applies.

With a hosted fine-tuning service, I could not find vendor documentation that says whether you can export the tuned weights. So do not assume. Ask in writing: can I download the weights, and can I run them elsewhere? If the answer is no, you have a lock-in risk that should be priced into the deal.

Running Without the Vendor

Ownership on paper is not enough. You need to be able to run the agent.

Test it with one question: if the vendor disappeared tomorrow, could your team keep the agent running next week?

To say yes, you need:

• Source code in a repository you control
• Dependencies pinned and documented
• Deployment scripts that work in your environment
• Secrets and credentials held by you, not the vendor
• A runbook for common failures
• A handover session with your engineers

The strongest setup is running the agent in your own infrastructure from day one. Then the vendor never holds your data or your keys. That is the core of data sovereignty for AI agents.

Cloud exit has a legal angle in Europe. The EU Data Act, which applies from September 12, 2025, gives customers of data processing services the right to switch providers without losing data or functionality, and requires export in a machine-readable format. The same source says switching charges, including egress fees, are removed from January 12, 2027. This covers cloud and similar services, not every agent contract. But it shows where the market is heading, and you can ask for the same terms by contract.

Clauses to Ask For

Use this as a checklist when you review a draft. Ask counsel to turn each line into contract language.

Area	What to ask for
Assignment	Written assignment of IP in all deliverables on payment
Pre-existing tools	A list of vendor-owned components, plus a perpetual, irrevocable license to use them
Prompts	Delivered in full, in editable form, owned by you
Evals	Full test set, scoring scripts, and release results delivered
Logs	Stored in your environment, in a documented format
Your data	You own it. No training on it. No use for other clients
Derived data	Embeddings and indexes are yours and exported on request
Weights	Ownership stated. Export right stated. Base-model license terms disclosed
Run without vendor	Handover session, runbooks, and a repo you control
Exit	Delivery of all assets within a set number of days of termination
Deletion	Vendor deletes your data after exit and certifies it in writing
Reuse	Vendor may not reuse your confidential material or data
Subprocessors	Named list, with notice before changes
Escrow	Source escrow if any critical component stays vendor-owned

If you are comparing vendors, add this checklist to your scoring. My guide on how to choose an AI agent development company covers the rest of the evaluation, and build vs buy for AI agents explains how ownership changes between the two paths. Cost also moves with these terms, so check them against your quotes using the cost drivers in AI agent pricing.

Plain-Language Summary for Legal

Send this to your counsel as a starting point:

We are buying a custom AI agent. We want to own everything created for us: code, prompts, evaluation sets, configuration, and documentation. The vendor may keep ownership of general tools it owned before the project, and must grant us a perpetual, irrevocable, royalty-free license to use them in our business. Our data, and anything derived from it, stays ours. The vendor may not train on it or reuse it. Logs must be stored in our environment. If any model is fine-tuned for us, the contract must state who owns the weights and whether we can export them. On termination, the vendor must deliver all assets within a fixed period, help us hand over, and delete our data with written confirmation.

Edit it to fit your jurisdiction and risk. The point is to state your position in plain words before the vendor’s template does it for you.

Bottom Line

Own what you pay for. License what the vendor already had. Be able to run it without them.

Before you sign, list the eight assets and ask who owns each one. Pay extra attention to prompts, evals, derived data, and weights.

Then give the clause table to your lawyer. It will save you a long round of edits.

FAQ

Who owns what an agency builds? It depends on the contract. Without a signed assignment, the default may not favor you, because commissioned software often falls outside the narrow “work made for hire” categories in US copyright law. Ask for a written assignment of all deliverables, and a license to anything the vendor owned before the project.

What happens when the contract ends? Only what the contract says. Ask for delivery of code, prompts, evals, logs, and configuration within a set period, a handover session, and certified deletion of your data. Do this up front. After a dispute starts, you have little bargaining power.

Can I run the agent without the vendor? You can if you hold the source, the dependencies, the deployment scripts, and the credentials, and your team has been trained on them. Running the agent in your own infrastructure makes this far easier, since the vendor never controlled the environment.

What about fine-tuned models? Ask who owns the weights and whether you can export them. For open-weight models, the base license may set rules on naming and ownership, as Meta’s Llama 3.1 license does. For hosted fine-tuning, I could not find public documentation on weight export, so get the answer in writing.

What should I ask in writing? Five things: who owns the prompts, who holds the eval set, where the logs live, whether the vendor can reuse your data, and whether you can download any fine-tuned weights. If a vendor hesitates on any of them, treat that as information.

Does owning the output mean I hold the copyright? Not necessarily. Model providers like Anthropic and OpenAI assign their rights in output to the customer by contract, but copyright also requires human authorship. The Copyright Office has said prompts alone are unlikely to meet that bar. Ask counsel if this matters for your use.

Three Ways to Work With TMA

Need an agent built? We deploy production AI agents in your infrastructure. Working pilot. Real data. Measurable ROI. → Schedule Demo

Want to co-build a product? We’re not a dev agency. We’re co-builders. Shared cost. Shared upside. → Partner with Us

Want to join the Guild? Ship pilots, earn bounties, share profit. Community + equity + path to exit. → Become an AI Architect