The default nobody expects #
UK copyright has two rules that point in opposite directions, and knowing which one applies is the whole point.
Employees
- Work created in the course of employment
- GOV.UK states the employer is the first owner of any copyright in the work, subject to any agreement to the contrary
This is the rule everybody has internalised.
Commissioned work
- Work you commission from a freelancer or a company
- GOV.UK states the first legal owner of copyright is the person or organisation that created the work and not you, the commissioner, unless you otherwise agree it in writing
Ownership is not one thing #
Asking "do we own it" gets a reassuring answer about whichever part the supplier was thinking of. Split it into four, and ask about each.
| What | Why it matters | What you want |
|---|---|---|
| The accounts | Whoever holds the logins controls whether the thing runs at all | Everything in your name, supplier invited in as a removable user |
| The work itself | The default for commissioned work is supplier ownership unless agreed otherwise | Assignment in writing, and a copy delivered to you |
| Your data | Records, correspondence and whatever the system accumulated while running | An export you have seen, in a form something else can read |
| The understanding | Owning something nobody in your business can explain is a thin kind of ownership | A plain English description of how the work happens, kept current |
The last row is not a legal question at all, which is exactly why it gets left out of contracts and then becomes the thing that actually traps people. It is covered alongside the other forms in what being locked in looks like.
Owning it and having it are different #
A contract can assign ownership perfectly and still leave you with nothing usable, because ownership and possession are separate. A business that owns work it has never been sent, held in an account it cannot reach, is in the same practical position as one that owns nothing.
So ask for delivery as well as assignment, and ask for it early. Requesting a copy of what has been built while the relationship is good is an ordinary administrative step. Requesting it during a dispute is a negotiation.
Where AI makes this slightly more interesting #
Two wrinkles are worth being honest about rather than glossing over.
Some of what gets built is configuration rather than code. Settings inside somebody else's product, connections between services, instructions written into a tool. You can own the arrangement in the sense that it was made for you, and you cannot own the product it sits inside. The useful question is therefore not only who owns it, but whether you could reproduce it if you had to, which comes back to whether anybody wrote down how it works.
Ownership of AI generated material is unsettled ground. Whether, and how, copyright attaches to output produced by a model is a live question rather than a decided one. We are not going to pretend otherwise. For a business commissioning a working process, the practical exposure is almost never about the copyright status of the generated text. It is about accounts, delivery and exports, which are all matters of contract and administration.
What happens if the supplier disappears #
Suppliers stop trading, get bought, change direction, or turn out to be one person who becomes unavailable. It is worth thinking through the specific morning it happens.
-
Does the work keep running?
If the accounts are yours, usually yes, at least for a while. If they are not, that is the first thing to find out and not on the day.
-
Can somebody else pick it up?
A new supplier needs access, a copy of what exists, and a description of what it is meant to do. The third of those is what turns a week of work into a month.
-
Can you go back to doing it by hand?
Only if anybody still remembers how. This is the argument for not deleting the manual process the moment it stops being used.
-
What happens to the personal data they held?
Where a supplier processes personal data on your behalf, the ICO lists deletion or return of it at the end of the contract among the minimum terms the contract must contain, which is one of the reasons to know whether you have that contract at all. The detail is in what a data processing agreement is for.
What to do about it, in about ten minutes #
Before signing anything, get four answers in writing.
- Whose name the accounts are in
- Who owns what gets built
- When you will be sent a copy of it
- What stops working on the day you leave
Those four cover almost all of the practical risk, and none of them requires you to understand the technology.
The wider list is in questions to ask an AI supplier, and where ownership fits into reading a whole proposal is in how much AI automation costs.