What questions will your legal team ask about training data, and how do you prepare?

Thessaly University Library holds four centuries of donated letters, diaries, and estate papers. Colophon is the AI tool that reads a freshly scanned manuscript and drafts the catalog description a human archivist used to write by hand. Bram Oosterhuis leads the digital collections team, and keeps a paper index card, one per donated collection, in a box on his desk.

How to answer this, stage by stage

Nobody is grading whether you can list every legal question word for word. They're grading whether you can show which prep task actually has to happen first.

Let's learn

Colophon reads a freshly scanned manuscript, a letter, a diary page, an estate ledger, and drafts the short catalog description an archivist used to write from scratch, one document at a time.

Before Colophon existed, "digitized" was the only status the library tracked on any document. A letter scanned in 2019 and a letter scanned last month sat in the same digital shelf, with no separate note on whether either one was actually cleared for a new use like training a model.

Now, with Colophon live, every newly digitized document flows straight into training data, on the same day it's scanned, unless someone actively stops it.

The turn: the unknown 18 percent isn't really the danger. The real danger is that "unknown" and "fine" had always been treated as the same thing, because nobody had ever asked the question out loud until a curator did, almost in passing.

What I would leave alone: Thessaly's collection of pre-1850 university administrative records needs no special provenance review. Public institutional records that old carry essentially no rights risk, and treating them like the donor-restricted collections would waste real audit time on the safest slice of the archive.

The lesson: a legal question about training data is really a question about whether your records already separate what you have from what you're allowed to do with it. If they don't, every answer legal asks for has to be built from scratch, under whatever deadline happens to be live that week.

Now here is the same thing as a story

The short version above is what you'd say defending Colophon's launch readiness to the university's general counsel. Read this one for how the gap actually got found.

Bram Oosterhuis has led Thessaly's digital collections team for five years. He can usually tell, just from the box a donation arrived in, whether a collection is going to have unusual restrictions attached.

Colophon had been drafting catalog descriptions for eight months, quietly, on whatever the scanning team fed it that week. Nobody had drawn a line between "material we've digitized" and "material we've confirmed we can reuse," because for eight months nothing had gone wrong.

Five plain questions. Bram realized he could answer all five confidently for maybe a third of the archive.

Then, at a routine cataloguing meeting, a rare-books curator asked a question that wasn't meant to be dramatic at all: "Wait, are we allowed to train on the Quillenbeck family's letters? Didn't they restrict access to the correspondence about the divorce?"

The Quillenbeck letters took the second branch. Nobody had ever actually walked them down it.

Nobody in the room knew for certain. The donor agreement was in a physical folder in a different building, and nobody could say, without checking, whether Colophon had already trained on those specific letters.

Three of these four fields already existed for most collections. Rights status, the one that actually mattered, was the one nobody had filled in.

Bram spent the next week running a sample audit, fifty documents pulled at random, just to see how big the real gap was before committing the whole team to a full inventory.

Full re-scanning, the most expensive option, turned out to be the least useful one. The provenance audit, far cheaper, sat right where the real risk was.

The sample confirmed it: about one in six documents had no rights status recorded at all, and the Quillenbeck letters were among them, sitting quietly in Colophon's training set for the last eight months.

Legal sign-off was always the last box. It just couldn't move until the second one, rights status, actually got filled in first.

Bram pulled the Quillenbeck letters out of the active training set that same week, brought the family's original 1987 donor agreement to the university's counsel, and got a narrow written clearance for the correspondence that wasn't restricted, three weeks later.

Pulling the letters out before anyone downstream had used Colophon's output cost a week. Doing it after a public catalog entry existed would have cost far more.

The old approach treated every scanned document as reusable the moment it was scanned. The new one asks the rights question first, and only feeds a document into training once that question has an actual answer on file.

I built the single "digitized" status field because it answered the only question anyone was asking at the time. It took one curator's offhand question at a meeting that was supposed to be about something else entirely to see that the field had been quietly doing double duty for years, standing in for a promise it never actually made.

ORDER, ranked by what breaks firstNot a checklist. ORDER is what forces you to say which prep task actually has to happen before the others.

The recap, one line per letter: outcome is launching without a rights problem discovered after the fact, reversibility is a pre-launch check versus a public takedown, dependency is legal sign-off waiting on rights status waiting on inventory, evidence is the fifty-document sample that sized the real gap, and rank is sample first, restricted collections second, full re-scan never.

And if you want to be sure it really works, try it somewhere elseSame five letters, a small-town newspaper's photo morgue instead of a university archive. This time the hardest-to-undo item isn't a document at all.

The Cascade Weekly Ledger, a small regional newspaper, is training an AI captioning tool on eighty years of its own archived photographs to speed up digitizing back issues. Farida Nasser edits the paper and is handling the legal prep herself, since there's no in-house counsel.

Outcome: publish digitized back issues with accurate captions, without the paper being sued by a freelance photographer whose work it never actually owned outright. Reversibility: identifying which decades used staff photographers, whose work the paper owns, versus freelancers, whose contracts often only licensed one-time print use, is nearly impossible to sort out after captions built from those photos are already published online. A quick contract-file check, by contrast, is cheap and repeatable. Dependency: knowing which decade a photo comes from unlocks knowing which contract template applied then, which unlocks knowing whether the paper can use it this way at all. Evidence: pulling twenty photo captions at random from the 1990s freelance-heavy years showed that nearly half lacked any surviving contract on file. Rank: check the freelance-heavy decades first, since that's where an unreversible mistake is most likely, and leave the staff-photographer decades, clearly owned outright, for a lighter later pass.

Four weeks, in this order, for the newspaper's photo archive too. Skip the sample audit and every later week gets guessed at instead of planned.

Swap the trigger and it still runs.
Speed: an interviewer caps you at sixty seconds. Say "sample-check first to size the gap, then fix the hardest-to-undo problem before the cheap one," and stop.
Cost: there's no budget for a full-time archivist to run the provenance audit. Say so honestly, and start with the sample check alone, done by whoever's available, since even a partial answer beats no answer when legal asks.
The model gets better, for real: if Colophon's descriptions get more accurate, that changes nothing about the rights question underneath. A better model trained on the same unresolved letters is still trained on unresolved letters.

Where people run it wrong.
They wait for legal to ask the questions instead of building the record before anyone asks.
They treat "we've always had this data" as the same thing as "we've confirmed we can use it this way."
They start with the most expensive fix, a full re-scan or a full manual review, instead of a cheap sample that shows whether the problem is even that big.

How to use it live. When asked what legal will ask about training data, don't recite the questions from memory. Say which one is hardest to undo if the answer turns out wrong, and start there.

Flashcards (tap any card to flip it)

Check yourself Score: 0 / 0