A — 0: Rights are unknown or someone assumes owning the database is enough. B — 1: Sources are inventoried, but some processing, supplier or teacher-output permissions are unresolved. C — 2: An authorised owner has documented the permitted purpose, suppliers, restrictions and any required legal review.
Evidence to attach: rights register and approval, not raw customer records. If weak: pause the affected transfer/training work. Model-specific licences and contracts need their own review; an open-weight label is not permission for every use.