The executive sponsor should ask what the provider’s agent learns or preserves while performing the buyer’s work. The service may accumulate case history, customer preferences, exceptions, decision precedents, workflow instructions, and configurations. Those assets can determine how the service operates and how difficult it becomes to replace.
Morgan Lewis’s contracting analysis recommends explicit treatment of output, training-data use, return, and deletion rights.1 The buyer should extend that assessment to the actual knowledge artifacts created in its delivery model. A general statement that the buyer owns its data does not necessarily settle use of configurations, derived context, or shared improvements.
Distinguish the buyer’s confidential material, third-party licensed content, provider background technology, and newly developed work. The parties may legitimately need different rights in each. The objective is a usable allocation that protects the buyer’s service and the provider’s lawful reusable capability, rather than an unsupported claim that everything belongs to one side.
Ownership, permission to use, confidentiality, privacy, and technical portability are different questions. A buyer can own an artifact but lack the format, license, or expertise needed to operate it. A provider can possess information without permission to reuse it for another customer or model improvement.
The UK copyright report examines licensing and policy questions; it does not create a universal ownership rule for AI-generated material.2 EU, UK, Swiss, US, and other rights should be assessed for the specific artifact and contribution. Contractual allocation should not assume that copyright exists in every output or that a contract can grant rights held by someone else.
A hypothetical exception library may combine buyer procedures, provider-developed handling patterns, and licensed reference material. The rights schedule should distinguish those layers. The buyer needs continuity and investigation access, while reuse elsewhere must remain within the permissions and confidentiality applicable to each contribution.
Figure 1 proposes a record of artifact, permitted use, buyer access, and exit treatment. Identify where the information is stored, whether it is shared across customers, how it changes, and who can export or delete it. Include backups, retrieval indexes, and downstream copies where relevant.
The study’s accounts of operational knowledge held outside formal systems show why practical access deserves attention.3 They do not establish ownership of any agent memory or workflow. The buyer should investigate which knowledge its own service requires and whether the agreed rights reach the place where that knowledge resides.
State whether learning may be used only to perform the buyer’s service, to improve a dedicated configuration, to improve a shared product, or to train a broader model. These uses have different consequences. Consent to one should not silently authorize the others, particularly where confidential or personal information is involved.
The buyer should secure the evidence and working context needed for investigation, correction, and transition. Test an export with representative artifacts and confirm that a qualified recipient can interpret it. A file containing embeddings or prompts may be insufficient without source references, versions, state, and necessary licenses.
For personal data, privacy specialists should assess purposes, roles, retention, lawful grounds, and individual rights separately from intellectual-property ownership. A permission to reuse a workflow does not automatically permit reuse of customer information embedded in its examples or memory.
The provider should identify background methods it intends to retain and any limitations on customer transfer. The buyer can then decide whether a license, documentation, transition assistance, or a different architecture addresses the dependence. An unexamined proprietary claim should not become a barrier discovered only at exit.
A reasonable objection is that allocating every future improvement is impossible. Define artifact categories, permitted purposes, default treatment, and a review route for material new forms of learning. The schedule should be updated as the service changes rather than attempt to predict every technical representation.
The executive should receive the rights map, unresolved third-party permissions, data-use restrictions, tested export, and continuity limitations. Reassess the decision when the provider introduces shared memory, a new training purpose, or a broader reuse claim. The service’s growing knowledge should remain governed as deliberately as its initial access.
The buyer should approve a relationship in which operational knowledge remains usable for the intended service and protected against unauthorized reuse. Ownership language matters, but access, lawful use, and transfer determine whether that language supports the business when the provider changes or the relationship ends.
The study is a nonrepresentative cross-section of 850 vendor delivery-team respondents on 150 engagements serving Tier 1 financial institutions, collected during January–June 2026. Neither banks nor vendors corroborated the accounts. It establishes reported experience, not causation, legal breach, or market prevalence. Its application here is a mechanism to investigate, not an estimate of conditions in other industries. The author-supplied version 1.8.2 is dated November 1, 2026 and is cited as a forthcoming manuscript consulted October 23, 2026.4
This is an analytical decision paper based on the supplied study and selected primary public sources checked through October 23, 2026. The original contribution is a delivery-knowledge rights record separating ownership, permitted learning, confidentiality, operating access, and usable transfer of agent memory and workflow artifacts. The proposed method has not been independently validated. Legal requirements depend on the entity, activity, jurisdiction, and effective provisions; supervisory observations, research, and professional commentary have distinct authority.