As artificial intelligence (AI) becomes more widely used, the way outsourced work is performed for companies is also changing. AI is now being applied to conventional outsourced work such as building websites and apps, setting up customer service systems and automating internal operations. Even a company that never commissions AI development itself can face new legal issues when its contractors use AI.
Different questions arise, in particular, when a company supplies its internal data and operational know-how to build a customized AI system, compared with a conventional software development contract. Who holds the rights to an AI model trained on the company's data and to the resulting deliverables? May the developer use them for other clients, or even for the company's competitors? Can the results continue to be used after the original training data has been deleted?
In the United States, these issues are already being addressed in concrete contract practice and litigation. In Korea, by contrast, published case law and disputes on similar questions have not yet accumulated in meaningful numbers.
That does not mean Korean companies are free of these risks. The issues and contract practices discussed in the United States are a useful reference for preventing similar disputes in Korea. The actual allocation of rights, however, must be determined under Korea's Copyright Act, its Unfair Competition Prevention and Trade Secret Protection Act, and general contract law.
1. When AI Developed from Your Know-How Is Sold to a Competitor
Suppose a manufacturer engages an outside developer to build a customized AI system that automates its quoting and cost analysis.
The manufacturer gives the developer product cost data, customer-specific pricing, its quoting methodology and internal operating manuals accumulated over many years. Using this material, the developer either further trains an existing AI model or builds a system that searches the company's internal data to generate answers.
Now suppose that, once development is complete, the developer wants to sell the same system to other manufacturers, including the client's competitors.
The client may feel entitled to exclusive use of the system, having paid substantial development fees and handed over its core business information and know-how. It would be hard to accept a competitor benefiting, with little effort of its own, from know-how the client spent years building.
The developer's position is not simple either. It built the system using AI technology and development capabilities it already had, and it cannot develop entirely new technology from scratch for every client. If carrying out one client's project meant it could no longer use its existing technology, or the general technical experience gained during development, for other clients, its business would be significantly constrained.
The real question, then, is how far the developer may use technology it legitimately holds while the client's information and know-how remain protected.
Disputes over copyright in, or rights to use, deliverables have long existed in conventional outsourced software development. When an AI system learns from a company's internal data, however, another problem is added: even if the original data is never copied verbatim or disclosed to anyone, what the system learned from that data may end up being used in systems built for other companies.
2. A Problem Already Addressed in U.S. Contracts
As AI-assisted outsourcing has grown in the United States, it has become common practice to address separately in contracts the permitted scope of use of client data, and the rights and liabilities attached to AI-generated output.
The author has dealt with these AI-related issues directly in reviewing a range of contracts between U.S. companies, including advertising and marketing services agreements. Such contracts go well beyond whether generative AI may be used at all. They specify whether a client's confidential data may be entered into external AI tools or used to train models, whether prior approval is required before AI-generated material is included in deliverables, and who bears responsibility for that material.
It is particularly notable that these contracts treat entering client data into an AI tool separately from using it to train an AI model. Using a client's data for a specific task is a different matter from using that data to improve an AI system's performance for future work.
Disputes are also emerging. In 2025, a lawsuit was filed in the United States against the design software company Figma, alleging that it used users' designs and data without permission to train its AI products. The case does not concern ownership of a custom-built AI system, but it is notable because whether a vendor may use data supplied by its users to develop its own AI became the subject of a dispute. The court compelled arbitration and stayed the lawsuit, however, without ruling on whether the data use was unlawful.
These U.S. contract practices are an important reference when reviewing outsourcing contracts for Korean companies. Rather than importing U.S. clauses wholesale, however, the parties' rights and obligations should be defined specifically in light of Korean law, the actual development method and the parties' commercial relationship.
3. Paying for Development Does Not Make the AI Entirely Yours
How, then, would a dispute between the manufacturer and the developer described above be decided in Korea?
To begin with, the client does not automatically acquire exclusive rights to the entire AI system merely because it paid development fees and provided internal data. The developer's pre-existing technology, newly developed software, and the results of training on the company's data need to be examined separately as a legal matter.
Under Korea's Copyright Act, computer programs can be protected by copyright, but paying outsourced development fees does not by itself vest copyright in the program in the client. The actual rights must be determined by looking at how development took place and what the contract says. Nor is the result of training an AI model always recognized as an independent copyrighted work. What matters in the end is what was developed and which rights the parties agreed to transfer or license.
Conversely, the fact that the developer holds rights in the AI system does not entitle it to use the client's business information freely.
If information the company provided, such as cost data, pricing policies or manufacturing processes, qualifies as a trade secret under the law, it may be protected under the Unfair Competition Prevention and Trade Secret Protection Act. Even if it does not meet the requirements for a trade secret, a contract that designates it as confidential information or prohibits its use for any other purpose will be a key benchmark.
Using a company's data to train an AI system does not mean that every later provision of that model to other clients automatically infringes trade secrets. Even without directly disclosing or copying a trade secret, however, using it to save the time and cost needed for development can amount to use of the trade secret. Ultimately, the protected information, how it is actually used, and the scope permitted under the contract must be examined in detail.
The nature of AI technology makes this even more complex. If a company's data was used to further train the AI model itself, what the model learned may remain in it even after the original data is deleted. If, instead, the system keeps the company's data in a separate database and retrieves it only when needed, the model itself may not have learned from that data. The two cases inevitably call for different approaches to protecting the information and to handling it after the contract ends.
The key, therefore, is not simply deciding who owns the AI. It is distinguishing how the company's information is used by the AI and how far the developer may use the results for other clients.
4. AI Outsourcing Contracts Must Define the Scope of Use, Not Just Ownership
In reviewing contracts for Korean companies, we often find that these issues are not yet adequately addressed. The contracts contain conventional clauses on copyright ownership and confidentiality, but do not clearly deal with using client data to train AI or reusing the results for other clients. Such gaps can lead to disputes later, which is why it is becoming increasingly important in contract review to define the relevant rights and obligations according to how AI will be used.
For example, assigning copyright in the deliverables to the client does not resolve the question of whether the developer may use its pre-existing AI models or technology for other clients. Conversely, it may be possible to let the developer keep the rights to the model while contractually prohibiting it from providing a competitor with the results of further training on the client's data.
The same goes for confidentiality of client data. Prohibiting disclosure to third parties is different from prohibiting use for AI training. And providing only for the return or deletion of the original data may not fully settle how information that has already been used for training is to be handled.
That said, banning all reuse by the developer is not the answer either. Restricting even the developer's existing technology and general development know-how could drive up development costs or make the deal unworkable. A more realistic approach is to distinguish the information the client truly needs to protect, and the deliverables that genuinely require exclusive use, and to set the scope of reuse accordingly.
Once development is complete, it may also become difficult to tell which technology belonged to the developer from the outset and which parts were built using the client's data. These rights and the scope of use should therefore be settled when the contract is signed, not after the deliverables are finished.
In this sense, an AI development outsourcing contract is becoming more than a contract for handing over deliverables. It is a contract that determines who may use the information a company provides, and the results derived from it, and for what purposes.
5. Conclusion
As AI is put to work in business operations, the subject matter of outsourced development is changing. Where the main concern used to be who owns the programs and deliverables a developer completes, it now also matters how the data and know-how a company provides are used by AI, and how far the results may be reused.
Information a company has accumulated over many years is itself an important competitive asset. As AI expands the ways such information can be used, its protection also calls for a different approach than before.
What matters is not restricting the use of AI itself, but distinguishing the information a company provides from the technology the developer holds, and setting a reasonable scope for their use. Whether other companies may use an AI system built from your data can ultimately depend largely on the rights and obligations the parties agreed on before development began.
Related practice: Corporate & Business Advisory