ISO 27001 Control 5.32: Intellectual Property Rights

Alan Parker, ISO 27001 Consultant & Internal Auditor,
Helping UK SMEs hit ISO 27001 in 90 days.
B.Sc (Hons) Information Systems · Certified ISO 27001 Lead Auditor · CISMP · ITIL Expert · 30+ years in IT governance and security.
Read full bio →

Introduction

For years, control 5.32 meant one thing in practice: software licences. Are you running more copies of something than you paid for? Most organisations could not say. Very few tracked their licences properly, and an auditor asking for the licence record usually got a puzzled look.

Then the world moved to cloud services, and much of that problem quietly went away. Two things have taken its place. The first is the old question of whose intellectual property you are handling and whether you have the right to use it. The second is new, and it is the one everyone is now scrabbling to understand: what happens to information, including your customers’ information, when it goes into an AI tool.

This page covers what the control requires, why licence management has become less of a headache, and what to do about AI. The free legal and contractual requirements register further down includes a tab for licences and AI tools.

What control 5.32 actually asks for

The control requires you to implement appropriate procedures to protect intellectual property rights. That covers other people’s IP that you use, and your own. In practice:

• Using software and content legally. Acquiring it from legitimate sources, within the terms of its licence, and keeping proof that you have the right to use it.
• Staying within licence limits. Not exceeding the number of users, devices or uses you have paid for.
• Respecting copyright in content. Documents, images, fonts, software code and published standards, including ISO 27001 itself, which is copyright material and should not be shared around the business beyond what your licence allows.
• Protecting your own IP. Your code, designs and materials, and clear terms on who owns what you create for clients.
• Respecting your clients’ IP. Their material in your hands is theirs, and the way you use it has to match what you agreed.

In the 2013 edition this was control A.18.1.2. The wording has barely changed. What has changed is where the risks are.

Where the risks are now

Intellectual property is one of the legal requirements identified under control 5.31. Here is how the main areas look for a small business today.

Licence tracking: weaker than ever, and less of a problem

Very few organisations track their licences effectively. Ask how many copies of a particular product they are licensed for, and how many are in use, and most cannot say.

The move to cloud services has made that matter far less than it did. With Microsoft 365, Google Workspace and most SaaS products, the licence and the access are the same thing. Without a licence, you simply do not get in. Over the past ten years or so, that has taken most of the old licence compliance risk off the table for a typical small business.

It has not removed it entirely. The areas that still catch people out are:

• Desktop and server software still installed and licensed the old way, such as design tools, specialist engineering software and database servers.
• Personal or free accounts used for company work, where the free tier’s terms forbid commercial use or give the company no control over the data.
• Open-source components in the software you build. Most open-source licences are permissive, but some place obligations on how you distribute your product. Know what is in your code.
• Images, fonts and documents copied from the internet into marketing material and proposals.

For most SMEs, a simple record of the subscriptions and installed software you pay for, checked once a year against who has access, is proportionate. It also doubles as the list of tools for your asset inventory under control 5.9.

AI: the new intellectual property question

Everyone is now trying to understand what is happening around AI in their business: what they can do with it, what they should do with it, and what their people are actually doing with it already. From an IP and security point of view, the questions run in both directions.

What goes in

This is the crucial one, especially where your customers’ data is involved. When someone pastes a client’s contract, a customer database extract or proprietary source code into an AI tool, where does it go? Is it retained? Could it be used to train the provider’s models? Who at the provider can see it?

The answers depend entirely on the terms of the version being used, and they often differ between free, personal and business tiers of the same product. Make sure you understand the terms and conditions of the versions you are using, not the versions you assume you are using. Then check your customer contracts and NDAs: many restrict who their information can be shared with, and an AI provider may count.

What comes out

Who owns AI-generated code, text and images? Partly that depends on the provider’s terms, and partly on the law, which is still developing in several countries. For a business selling software or content to clients, it matters: if your contract says the client owns everything you deliver, you need to be confident you own it to give. Read the provider’s terms on output ownership, and on whether they offer any protection if their output turns out to infringe someone else’s rights.

What to put in place

• A short list of approved AI tools, on business terms that you have read.
• Clear rules on what information may and may not go into them, linked to your classification scheme under control 5.12.
• Company-owned accounts, so you control the settings and can remove access when people leave.
• A check of customer contracts before their data goes anywhere near an AI tool.
• A line in your acceptable use policy under control 5.10, and a short conversation with staff about why it matters.

None of this needs to stop people using AI. It needs to stop them using it in ways that give away information that is not theirs to give.

What auditors will look for

If I were auditing you, this is how I would work through 5.32.

1. A procedure or policy. How does the organisation make sure it uses software and content legally? It can be short.
2. The licence record. What do you pay for, and does it match what is in use? For SaaS I will check a sample against the admin console.
3. Software installation. Who can install software, and how do you stop unlicensed installs? This links to control 8.19.
4. AI tools. Which are in use, on what terms, and what rules govern the information that goes into them? I am asking about this on almost every audit now.
5. Contracts. Who owns what you create for clients, and how do you handle their IP?
6. Open source, if you build software. How do you know what licences are in your product?

Common issues

• No licence record at all, and nobody able to say what is paid for.
• Desktop software installed beyond the licence count, usually after staff changes.
• Staff using personal or free AI accounts for company work, with customer information going in.
• Nobody has read the terms of the AI tools in use, or checked which tier the business is actually on.
• Client contracts promising ownership of deliverables, with no thought about AI-generated or open-source content in them.
• Copies of ISO standards and other paid documents shared freely around the business.
• Images and fonts taken from the internet for marketing material.

The self-check

Five questions. If you cannot answer them today, an auditor will find that out for you.

• Which AI tools are your staff using this week, and on which tier?
• Have you read the terms on whether those tools retain or train on what is put into them?
• Has any customer data gone into an AI tool, and does that customer’s contract allow it?
• What software and subscriptions do you pay for, and who has access to each?
• Who owns the code and content you deliver to clients, and can you give them that ownership?

The first three are the ones to sit with. Licences mostly look after themselves now. AI does not.

A worked example

The details below are typical rather than drawn from a single engagement. This is a composite of a first look at 5.32 in a business of this size.

A 20-person digital agency building websites and apps for clients. Everything runs on Microsoft 365 and SaaS tools. No licence record, and no policy on AI.

What the review found

• The SaaS tools were, in effect, self-licensing. The real gaps were elsewhere.
• Staff were using five different AI tools, three of them on personal free accounts. Client briefs and, on occasion, client customer data had been pasted into them.
• The terms of two of the free tools allowed inputs to be used to improve the service.
• Client contracts assigned full ownership of all deliverables to the client. Much of the code was now written with AI assistance, and nobody had checked the tools’ terms on output.
• Two seats of a desktop design package were shared between five designers.

What changed

• Two AI tools approved, on business plans whose terms excluded training on inputs, with company accounts for everyone who needed them. Personal accounts stopped for company work.
• A one-page AI use policy setting out what client information may go in, aligned to the classification scheme.
• The contract template reviewed with the agency’s lawyer to address AI-assisted and open-source content in deliverables.
• Design licences brought up to the number of users, and a simple licence record created on the register’s licences tab.

The design licences cost money. The AI changes cost very little and removed the biggest risk the business had, which nobody had noticed because it had arrived so quickly.

How control 5.32 links to other clauses and controls

• Control 5.31, Legal, statutory, regulatory and contractual requirements. IP law and licence terms are legal requirements and belong on the register.
• Control 5.9, Inventory of information and other associated assets. Software and subscriptions are assets, and the licence record and inventory should agree.
• Control 5.10, Acceptable use of information and other associated assets. Where the rules on AI use and installing software usually live.
• Control 5.12, Classification of information. Decides which information can go into which tools.
• Control 5.23, Information security for use of cloud services. AI tools are cloud services, and the same due diligence applies.
• Control 8.19, Installation of software on operational systems. Controls who can install software, which limits unlicensed installs.
• Control 8.28, Secure coding. and Control 8.30, Outsourced development. Where open-source and third-party code is managed, and where IP terms with developers matter.

What I find in audits

In around half of the clients I have audited or worked with on ISO 27001 since 2024, staff were using personal AI accounts for client work. Pasting client material into an AI tool is now one of the easiest ways to put intellectual property at risk. More detail is in my findings report.

Frequently asked questions

Sources and further reading

Official legislation, standards and guidance referred to on this page.

• Copyright, Designs and Patents Act 1988. UK copyright law, covering software, documents and images.
• Intellectual Property Office. The UK government body responsible for intellectual property.
• Artificial intelligence. ICO guidance on AI and data protection, relevant when personal data goes into AI tools.
• ISO/IEC 27001:2022, Information security management systems. The standard itself, published by ISO.

Internal Audit Service

Get an independent view of your ISO 27001 ISMS before you go into an audit.

“Alan from Iseo Blue truly came to our rescue. His support ahead of our internal audit was outstanding, and he helped us get our ISMS 100% ready for the Phase 2 audit.“

– Quartile.

✓ Gain confidence
✓ Audit plan
✓ Independent view
✓ An ISO 27001 requirement

✓ Audit findings report
✓ Recommendations
✓ Review meeting
✓ Fixed price

£2,500

+ VAT where applicable

View DetailsBook a discovery call