Who Actually Owns a Fine-Tuned Model?

A department spends six months and a crore of rupees helping a vendor specialise a model on its file style. The contract ends. The vendor keeps the adapter. The department keeps a login that no longer works. That story is already happening. It is a drafting failure, not a mystery of AI.

Indian law has not handed you a special AI-ownership statute. Until a court or the legislature does, the MSA is the law of the project. Write it as if no one will be friendly later. They will not be.

What the law does not do

DPDP does not assign intellectual property. It tells you who is accountable for personal data. It does not tell you who owns weights. The Copyright Act, 1957 can protect original literary works, including software, and allows assignment in writing. Model weights sit awkwardly in that framework. Courts have not given Indian buyers a clean, AI-specific ownership rule.

Trade secret law can protect training sets and prompts if you actually keep them secret. It will not help if officers pasted the same set into a public chatbot. Confidentiality is a practice, not a clause alone.

Split the object before you argue

Object	Usual owner if the contract is silent	What you should demand
Base model weights	The model licensor	A licence you can keep using after exit, with no phone-home licence server
Your documents and prompts	You, as data and often as copyright	Express reservation; no training or evaluation rights
Fine-tune / LoRA / adapter	Whoever the MSA names, else the vendor in practice	Assignment to the institution, plus escrow and a tested export
Eval sets and gold answers	Whoever produced them	Institution ownership if built from official records
Platform code	The vendor	A licence wide enough to run and migrate for a defined period
Logs and traces	Often uncontrolled	Your SIEM; vendor retains only what the DPA allows

Argue about one object at a time. A meeting that says we want to own the AI will lose to a vendor who says of course, meaning the chat transcript. Name the adapter.

Clauses that actually work

1. Assignment of all project-specific weights, adapters, tokenisers and eval sets to the institution on creation, not on request.
2. A surviving licence to any vendor platform needed to load those weights for twelve months after exit, or an export that does not need that platform.
3. An escrow or quarterly export of those artefacts in a documented format, with a restore test minuted.
4. A warranty that no other customer will receive a model improved by your personal or confidential data.
5. A deletion certificate that covers the vendor's training cluster, not only the production tenant.
6. A price that does not reset if you take the adapter to a second model.

What to do if the work already started

Stop new fine-tunes until the assignment exists. Inventory adapters already created. Demand an export now, while the relationship is warm. If the vendor refuses, you have learned the exit while you still have leverage. That is an unpleasant meeting and a cheap one, compared with the meeting after the last invoice.

Open weights do not settle ownership

Open-weight licences decide what you may do with the base model. They do not decide who owns the adapter you paid to build on your plant logs. Some licences also constrain how you share a combined work. Read the licence with counsel before you assume you can take the fine-tune to another vendor. Open is not the same as yours, and yours is not the same as portable.

If the licence of the base model forbids the way you want to exit, choose a different base now. Exit constraints discovered at termination are just cut-off with better branding.

Evaluation sets are the quiet IP

Gold answers built from real files are often more valuable than the adapter. They encode how your department writes, what it considers a good noting, and which exceptions matter. Vendors love to keep them as a benchmark. You should treat them as official records. Assign them. Ban reuse. Export them. They are how you measure the next vendor, not how you improve the last vendor's brochure.

Payment milestones for ownership

Do not pay the last tranche until the export loads on your hardware. Make the restore a deliverable, not a courtesy. Vendors who cannot load the adapter without their platform have not delivered ownership. They have delivered a dependency. Pay for the former. Do not pay for the latter.

Take ownership of artefacts already in flight

This week: freeze new fine-tunes. Inventory adapters, eval sets, prompts and tokenisers already created. Demand an export now. Load it. If it will not load, you have learned the exit while the relationship still works.

Next week: send the assignment clause, the reuse ban, the quarterly export, and the last-tranche-on-successful-restore milestone. If the vendor says the adapter is entangled with secret sauce, stop fine-tuning on their platform. Fine-tune on yours, or accept that you are funding their product.

This quarter: put eval sets in your official-records handling. They are how you will score the next vendor. They are not a vendor marketing asset. If a leaderboard could identify your department, the set never leaves.

Objections you will hear — and what to do with them

Vendors will say they cannot assign weights because of investor IP. Then they cannot train on your records. Those are the two chairs. They do not get both.

They will offer a licence instead of assignment. A licence can work if it survives exit, loads without their platform, and does not reset the price when you change the base model. Most offered licences fail at least two of those. Read them as if the vendor has already been acquired.

Finance will not want to withhold the last tranche. Show them the ZIP that will not load. Withholding is how you avoid paying for a souvenir. If withholding is impossible, take a bank guarantee against a successful restore.

Researchers on campus will want to publish the adapter. Publishing may be fine for a non-sensitive corpus with a cleared licence. It is not fine for adapters built on student or patient text. Split research artefacts from operational artefacts in the contract.

Someone will say open-source means we already own it. Open-source is a licence on someone else's work. It is not an assignment of the work you paid to add. Two documents. Read both.

How this shows up in the file

Ownership that cannot be loaded is branding. Schedule the restore. Withhold the last tranche or take a guarantee. If the vendor's investor-IP story forbids assignment, stop sending them your records. Those are the two chairs. Sitting in both is how departments fund someone else's product.

Eval sets deserve the same seriousness as adapters. They encode how you write and what you accept. They are official records if they were built from official files. Treat them that way in the MSA and in the records schedule.

If work has already started without these clauses, freeze new fine-tunes today and demand an export this week. Warm relationships still return ZIP files that open. Cold ones return ZIP files that lecture you.

What the next noting must contain

“Who Actually Owns a Fine-Tuned Model?” belongs in a file, not only in a search result. A P2 Procurement should be able to point at one artefact that proves “fine tuned model ownership”: a packet capture, a processing schedule, a scored evaluation row, a dated notice, or a refusal rule. If the only evidence is a slide, you have a heading.

There is no section that says the ministry owns the adapter. If the MSA is silent, you may have paid to improve a vendor's product. DPDP 2023 does not define sovereign AI and does not write a blanket localisation rule for every model hop. CERT-In’s 28 April 2022 directions still set specified incident clocks and 180-day log retention in India for in-scope events. The November 2025 AI governance text is guidance, not a statute. A Proprietary Article Certificate, when it is lawful, lives in GFR Rule 166 — not Rule 161.

Write three dated sentences under C1 Sovereignty & Data Residency: what was decided, which designation owns it after the next posting order, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the designation that owns “fine tuned model ownership”, plus a deputy.
• Attach one artefact a stranger can open next year.
• Name the instrument you are actually using — Act, direction, GFR clause, GeM term, or guideline paragraph.
• Leave unsourced percentages, GMV slides and house forecasts out of the noting.
• Revisit when the model, the SI, the notice, the region or the posting changes.