Who owns your AI when you hire someone to build it

When you build something custom with a vendor or contractor, the question of who owns what is not small print. It's the difference between a tool you control and a tool that controls you.

Three things matter: code, data, and accounts. If a vendor owns any of them, you are renting, not owning.

Code: Can you read it and move it?

Code is the set of instructions that makes your AI tool work. If the vendor writes it and keeps it secret, you are locked in. If they own it legally, you cannot move to another provider without starting over.

What to ask for: "Do we own the code you write? Can we read it? Can we use it with another provider if we choose to leave?"

A good answer sounds like: "Yes. We'll give you the full code under a licence that lets you use it, modify it, and run it anywhere."

A bad answer sounds like: "The code stays with us, but you don't need to worry about it." This means you are renting a black box. If the vendor raises prices, disappears, or stops supporting your tool, you have no options.

Real example: A Burnaby accounting firm hired a developer to build a tool that reads expense receipts and sorts them by category. The developer kept the code proprietary. Two years later, the firm wanted to add a new feature. The developer quoted $8,000 and a six-week wait. A different developer could have done it in two weeks for $2,000, but couldn't touch the code without legal risk. The firm was stuck.

Data: Where does it live and who can access it?

Your data is your business. Customer records, transaction history, files, invoices—these are yours. If a vendor stores them in their own database and you don't have access, you cannot leave without losing everything.

What to ask for: "Where does our data live? Can we download it anytime? Can we access it directly, or only through your tool?"

A good answer sounds like: "Your data lives in a database you control. You have admin access. You can download it in standard formats like CSV or JSON whenever you want."

A bad answer sounds like: "Your data is secure in our cloud. We back it up. You can export a report if you need to." This is not the same as owning your data. A report is a snapshot. A database export is your data.

Real example: A Surrey property manager used a vendor's system to track tenant requests and maintenance history. The system worked well for three years. Then the vendor was acquired by a larger company. Prices tripled. The property manager wanted to switch, but could not get a clean export of the tenant data—only PDFs of old reports. Rebuilding the database from scratch would take a month of staff time. The firm paid the higher price rather than lose continuity.

Accounts: Who holds the login?

Accounts are the usernames, passwords, and credentials that run your AI tools. If the vendor holds them, they control access. You cannot revoke it, audit it, or transfer it without their help.

What to ask for: "Who has the login credentials to the accounts where our data and tools live? Can we change the password and revoke access anytime we want?"

A good answer sounds like: "You hold the primary login. We have a secondary admin account for support, but you can revoke it anytime. You can change your password without asking us."

A bad answer sounds like: "We manage the account for you. You don't need to worry about passwords." This means they have permanent access. If you disagree with them, they can lock you out.

Real example: A Kelowna dental clinic used a vendor's tool to send appointment reminders and collect patient feedback. When the clinic's contract ended, the vendor refused to transfer the account until the final invoice was paid, even though the clinic disputed one charge. The clinic lost access to two years of patient feedback data for six weeks while the dispute was resolved.

What lock-in actually costs

If you don't own code, data, and accounts, switching providers is not a simple move. It typically involves:

• Time to extract and clean data: 2 to 8 weeks, depending on volume and complexity.
• Time to rebuild or reconfigure workflows: 4 to 12 weeks.
• Staff hours to oversee the migration: 200 to 600 hours across your team.
• Cost to hire a consultant or developer to help: $5,000 to $30,000.
• Risk of data loss or corruption during transfer: varies, but real.

A 12-person software company in Gastown spent $18,000 and three months migrating away from a vendor whose pricing had become unaffordable. The money and time could have been spent on new features or hiring.

A Calgary distributor stayed with an expensive vendor for two years after their contract ended because the cost of migration was higher than the cost of overpaying. They eventually left, but lost momentum on other projects while the migration happened.

How to protect yourself

Ask these three questions before you sign:

1. Do we own the code? Can we read it, modify it, and use it elsewhere. 2. Do we own the data? Can we download it in standard formats anytime. 3. Do we hold the account credentials? Can we change passwords and revoke access without asking permission.

If the answer to any of these is no, negotiate. Make ownership a condition of the contract. Get it in writing. Verify it's true before you go live.

If the vendor won't agree, the cost of that tool is not just the monthly fee. It's the monthly fee plus the cost of being stuck.

Where to start

• Before your next conversation with a vendor or contractor, write down the three questions above and ask them in the first call. Listen for the exact answer, not the reassurance.
• If you already have an AI tool or custom software running, ask your current provider these three questions this week. If you don't get clear yes answers, ask what it would cost to change that.
• Pull together a one-page summary of what data your business creates and stores—customer records, files, transactions, communications. This is what you need to own and be able to move.