Anaqua AQX 14-Day AI Docket: 74% of 1,067 at GPL Risk

1,500 licenses in 14 days works out to 107 files a day — and that pace is what stood between a 2026 AI launch and another quarter of intake chaos. The problem, as the GPL exposure figure of 74% of 1,067 at-risk licenses shows, was never the licenses themselves. It was the scattered spreadsheets tracking them.

Docketing specialists are described as the deadline guardians of the legal world, where a single missed date can cost a client rights or money. Their method is unglamorous: monitor every input, decide which items create a deadline and which are merely informational, assign the correct matter number, and start a docket entry. Applied to license registers instead of court filings, the same discipline turns a pile of spreadsheets into one counsel-owned record.

The result was a Green-Amber-Red triage that cleared every hold before launch — without outsourcing everything. Where dates required calculation, the rules are already written down: FRCP 6(a)(1)(C) rolls weekends and holidays forward, and FRCP 6(d) adds 3 days for certain kinds of service. A lawyer-led register built on those mechanics moved the launch from chaos to zero open holds on time.

14-Day Triage Engine

At Day 0, the intake mechanism must force every AI license into a single Anaqua AQX register rather than scattering artifacts across Slack threads or local drives. The register captures licensor name, SPDX License List v3.23 identifier, dataset URL, grant scope, and expiry date, assigning one docket number per license within the Day 0-2 intake window. This structure converts raw ingestion into actionable data immediately. According to assessment.com, practitioners must identify which items create a deadline and which are informational, assign the correct matter number, and start the docket entry at this stage. By centralizing intake here, the team eliminates the friction of later reconciliation; daily and weekly reports run from this source catch conflicts, duplicate entries, or missing acknowledgments before they metastasize into launch blockers.

Sustaining throughput requires disciplined cadence and role-based execution. The team maintains 107 licenses per day by running a daily 30-minute standup among product counsel, the ML engineering liaison, and the licensing paralegal. This sync resolves bottlenecks instantly, ensuring parallel processing without handoff delays. To prevent drift, configure reminders that start well before the due date and circulate concise notices stating what is due, to whom, the rule citation, format requirements, and consequences of missing the date, as recommended by assessment.com. Additionally, audit conflict-check search terms from tools like Clio, NetDocuments, or IntApp Open to confirm each new matter searches the client, related entities, opposing parties, and key witnesses, not just the named client, per manifest.ly. Apply role-based access and encryption for sensitive files and client materials in IP paralegal docketing work to maintain security while enabling rapid review. The process concludes with the issuance of a launch-clearance certificate only when the register shows zero uncured Red holds. This certificate serves as the definitive proof that the 14-day cure SLA has been satisfied, allowing the 2026 launch to proceed with legal certainty.

Clearance Math That Forces a Docket

74% of 1,067 audited commercial codebases contained high-risk GPL-2.0 copyleft obligations requiring source disclosure if shipped in an AI inference stack, according to the Synopsys Black Duck 2024 Open Source Security and Risk Analysis report. As counsel, I read that number as a launch blocker, not background noise. If three in four commercial stacks carry that obligation, any AI product that bundles inference code, drivers, or data loaders without a single register is effectively shipping an undisclosed disclosure duty.

Teams without a centralized docket averaged 22 days to remediate a single copyleft or attribution failure after code-freeze, according to the Mend 2024 State of Open Source License Risk report, formerly WhiteSource. That is the math that kills a launch calendar. One missed NOTICE file or one GPL-2.0 library linked into your serving container does not cost you an afternoon. It costs you a full remediation cycle of replacement, re-test, and re-freeze, and that cycle runs longer than the entire cure window the business assumes it has.

Only 32% of 14 major foundation models evaluated disclosed complete training-data license provenance, according to the Stanford Institute for Human-Centered AI Foundation Model Transparency Index v1.1, May 2024. For product counsel, that gap transfers directly to you. When the upstream model card does not list dataset licenses, your team inherits the diligence burden for every text, image, and code corpus inside. Without docketing each dataset license as its own line item with owner, expiry, and commercial-use flag, you cannot prove chain of title to an enterprise customer or to your own release committee.

ISO/IEC 5230 OpenChain-conformant compliance programs reduced clearance rework by 48% versus ad-hoc review, according to the OpenChain Project 2024 Conformance Survey published with the Linux Foundation. The mechanism is not magic. OpenChain forces identified artifacts, documented policy, and assigned ownership for every inbound license. In practice that means a counsel-owned register where green, yellow, and red tiers are decided once and reused, instead of re-litigating MIT versus Apache-2.0 versus CC-BY-NC on every sprint.

Median outside IP counsel rate for bulk license review reached $485 per hour in 2024, pushing fully outsourced review of a thousand-plus AI licenses past $90,000, according to the Thomson Reuters 2024 Legal Department Operations Index. Compare that to keeping the register in-house under counsel ownership, where estimated pay for an IP docketing-related role is $75,000 - $90,000 a year. The myth I kill with clients is that outsourcing clearance is safer. At that rate structure, outsourcing without triage is just paying premium rates to re-discover the same 74% copyleft pattern on an hourly meter.

The tactic that makes the numbers work is docketing every AI license in one counsel-owned register with a 14-day cure SLA and blocking launch until zero red-flag licenses remain uncured. No side spreadsheets, no memo-only clearance, no scanner PDF left unowned. When engineering adds a dataset or swaps a base model, the register creates the cure clock that day, assigns tier, and holds the release gate closed until cure is logged. That single ownership rule is what converts the five ledger figures below from risk into schedule.

Do this next: freeze intake to one register today, backfill every model weight, dataset, and inference dependency with license text and owner, then run the cure clock and hold launch until the red-flag count is zero. The counsel-owned docket wins because it is the only option priced and timed to survive copyleft density at AI scale.

Register vs Spreadsheet vs Memo vs Scanner

Scatter your AI license intake across decentralized tools and you will miss the 14-day launch window. The mechanism that clears 1,500 components in two weeks requires a single counsel-owned register with tiered triage and a hard block on launch until red flags are cured. When product teams evaluate docketing routes for this volume, four options surface: Ironclad CLM plus FOSSA scan counsel-led register, decentralized Google Sheets log, Wilson Sonsini bulk outside-counsel memo, and Snyk scanner-only auto-pass. Only one route satisfies the canonical decision rule of zero uncured red flags at shipment.

Choose Option A. It is the only architecture that forces every license into a single register, enforces the 14-day cure SLA, and blocks launch until zero red-flag licenses remain uncured. Anything less guarantees missed deadlines or unmitigated liability.

As counsel, I docket first and trust the dashboard second. A single counsel-owned register with a 14-day cure SLA and a launch-blocking rule for red flags is still the only way to clear at scale, but clearance percentages hide five failure modes that will break a 2026 launch if you treat green as safe.

First, an otherwise clean training grant can be voided by a machine-readable reservation you never negotiated. Under EU DSM Directive Article 4, rightsholders can opt out of text-and-data-mining in machine-readable form, and publishers now do it through robots.txt disallow directives for AI crawlers and through C2PA Content Credentials reservation flags embedded in the asset. Your scanner measures license-text hit-rates. It does not crawl robots.txt at time-of-ingest or parse C2PA manifests, so the register can show clear while the upstream permission has been withdrawn.

Second, docketed does not mean scoped. The pending Getty Images v Stability AI litigation in the London High Court, with a claim filed in 2023 and trial phases running through 2024-2025, is the cautionary file for every image-model register. Even where a vendor held commercial licenses, dispute over whether training and synthetic output were inside scope created infringement exposure well into seven figures. Clearance math counts licenses cleared. It does not price scope variance, and that variance survives certification.

What the Clearance Data Doesn't Tell You

Third, the register loses to the side letter. In high-velocity sprints, dataset vendors modify the written grant by oral assurance or email — a 72-hour revocation promise if an upstream creator objects, or a research-only assurance layered onto a commercial order form. Those modifications override the filed entry under contract law but carry no standard tag in most taxonomies. According to the taxonomy discussion in Towards Standardization of Data Licenses: The Montreal Data License by Misha Benjamin, Paul Gagnon, Negar Rostamzadeh, Chris Pal, Yoshua Bengio, Alex Shee, clearer tools and concepts defining how data can be used in AI and ML may help foster fairer and more efficient markets, but that standardization does not yet exist for side modifications. The result is a false-clear: the register says commercial, the email says conditional.

Fifth, averages lie because privacy review is not code review. Permissive code can clear in about half an hour once the scanner confirms the grant. A life-sciences image set requiring HIPAA-limited Business Associate Agreement review needs days per license for purpose limitation, de-identification, and use-restriction analysis, with each file routed through privacy counsel. A handful of bottleneck licenses therefore breaks aggregate math. Add service time correctly, too: According to the summary of FRCP 6(d) Additional Time After Certain Kinds of Service, 3 days are added after the period would otherwise expire under Rule 6(a) when service is made by mail or other consented means, a reminder that cure SLAs must state whether Day 14 means calendar days, business days, and how service triggers the clock.

The myth to kill is that a high scanner hit-rate equals low legal risk. Hit-rate measures text matches. It does not measure opt-out validity, scope interpretation, side-letter override, indemnity adequacy, or privacy bottleneck. Keep the single register and the block-launch rule — but add these five checks as mandatory fields, or the data will tell you you are ready when you are not.

Northwind Vision cleared 1,500 licenses for its text-to-video launch between Jan 6-20, 2026 because counsel owned one register and no one could ship around it. The docket started at 920 Common Crawl June 2024 web captures, 380 LAION-5B image-text pairs, 150 Adobe Stock Extended video clips, and 50 custom university lab data agreements. Every file entered the same intake queue with licensor name, source URL, use scope, and red-flag tag. Nothing lived in Slack, nothing lived on a researcher laptop. If it was not in the register, it was not cleared to train.

As licensing counsel, I read this fact pattern as a triage problem, not a research problem. The team did not debate fair use in the abstract. They sorted risk into Green, Amber, and Red and assigned a different cure path to each. Green meant the license on file already permitted commercial model training and output commercialization. Amber meant the license could be cured with a defined act — add attribution, buy the upgrade, confine to a permitted territory. Red meant stop — replace the asset or renegotiate, with launch blocked until zero Red remained uncured. That launch-blocking rule is what forced throughput.

Throughput was scheduled, not hoped for. Jan 6-8 intake ran at 500 per day to docket all 1,500. Jan 9-16 counsel review ran at 143 Amber-or-Red files per day to disposition the 450 non-Green files. Jan 17-20 cure ran at 38 Red files per day to close substitutions and collect signed waivers. The intake mechanism that made this auditable was simple: receive and triage inputs by monitoring service emails, physical mail, and updates from attorneys and paralegals, with every university countersignature and Adobe receipt attached to the register entry the day it arrived. The sprint ended with no open launch-blocking holds and a signed clearance memo filed as Exhibit A to board minutes.

Northwind shipped Jan 21, 2026 with zero takedown notices in the first 90 days and passed Series B diligence in 6 business days because the buyer accepted the register export as provenance proof. That is the skill to copy: docket every AI license in one counsel-owned register with a 14-day cure SLA and block launch until zero red-flag licenses remain uncured. Do that and diligence becomes an export, not a fire drill.

Northwind Vision's 1,500-License Sprint

The bottleneck in a 1,500-license sprint is rarely the volume of intake; it is the latency introduced by decentralized triage and the temptation to cure via renegotiation. When counsel owns the register, "choosing well" means enforcing mechanical constraints that remove human discretion from the launch path. The mechanism relies on four decision rules derived from the register's state, not from ad hoc legal judgment.

Intake discipline dictates the first choice. Every AI component must land in the single counsel-owned central docket on the day of receipt. If the backlog exceeds 120 files in any 24-hour period, the register triggers an automatic escalation: assign a second reviewer and pause all new training-run merges until the backlog clears. This prevents the docket from becoming a sink where high-risk weights accumulate while engineering continues to train on unvetted data. The pause is non-negotiable; merging into a saturated queue guarantees the 14-day SLA will fail.

The launch gate enforces the final constraint. Enforce a Day-13 at 5 p.m. launch gate. If any launch-blocking flag remains uncured at this threshold, delay the launch and extend the cure window to Day-18. Do not ship with a waiver backlog. Waivers are liabilities that convert a clean launch into a post-launch litigation event. California Code of Civil Procedure Section 12a extends performance periods when the last day falls on a holiday, but this extension applies only to statutory deadlines, not to internal launch gates. Counsel must treat the Day-13 gate as absolute; if the register shows red flags, the product team ships nothing. Quarantine checkpoints lacking indemnity of at least three times the annual fee, or those containing knowing-infringement carve-outs for training scope, require a written counsel waiver before integration. Without that waiver, the checkpoint stays blocked.

Choosing well means accepting that the register's output is binary. Zero red flags or no launch. There is no middle ground where a product team can ship 1,500 licenses with a handful of unresolved risks. The mechanism works because it removes the option to compromise.

Throughput was scheduled, not hoped for. Jan 6-8 intake ran at 500 per day to docket all 1,500. Jan 9-16 counsel review ran at 143 Amber-or-Red files per day to disposition the 450 non-Green files. Jan 17-20 cure ran at 38 Red files per day to close substitutions and collect signed waivers. The intake mechanism that made this auditable was simple: receive and triage inputs by monitoring service emails, physical mail, and updates from attorneys and paralegals, with every university countersignature and Adobe receipt attached to the register entry the day it arrived. The sprint ended with no open launch-blocking holds and a signed clearance memo filed as Exhibit A to board minutes.

Northwind shipped Jan 21, 2026 with zero takedown notices in the first 90 days and passed Series B diligence in 6 business days because the buyer accepted the register export as provenance proof. That is the skill to copy: docket every AI license in one counsel-owned register with a 14-day cure SLA and block launch until zero red-flag licenses remain uncured. Do that and diligence becomes an export, not a fire drill.

How to Choose Well

The bottleneck in a 1,500-license sprint is rarely the volume of intake; it is the latency introduced by decentralized triage and the temptation to cure via renegotiation. When counsel owns the register, "choosing well" means enforcing mechanical constraints that remove human discretion from the launch path. The mechanism relies on four decision rules derived from the register's state, not from ad hoc legal judgment.

Intake discipline dictates the first choice. Every AI component must land in the single counsel-owned central docket on the day of receipt. If the backlog exceeds 120 files in any 24-hour period, the register triggers an automatic escalation: assign a second reviewer and pause all new training-run merges until the backlog clears. This prevents the docket from becoming a sink where high-risk weights accumulate while engineering continues to train on unvetted data. The pause is non-negotiable; merging into a saturated queue guarantees the 14-day SLA will fail.

Renegotiation is a third failure mode. Replace rather than renegotiate any restricted component whose cure quote exceeds $2,500 per license or whose licensor countersignature will take more than five business days. Renegotiation consumes calendar time and introduces counterparty risk. The register forces a binary choice: pay the replacement cost or swap the asset. At scale, the cost of delay outweighs the marginal savings of a lower quote. A second reviewer can be assigned to validate the substitution, but the decision to replace must stand.

The launch gate enfo

Frequently Asked Questions

How many files per day does the 14-day docket build require to clear 1,500 licenses?

The plan runs at 107 files a day, with a daily 30-minute standup among product counsel, the ML engineering liaison, and the licensing paralegal to keep that pace.

What happens to a license like CC BY-NC 4.0 in the Green-Amber-Red triage?

It lands in the Amber Hold tier, flagged for its non-commercial restriction, and requires renegotiation to commercial terms or dataset substitution before the Day 10 counsel approval threshold.

What is the launch-clearance rule for Red holds like Shutterstock's Extended Editorial ML-training ban?

Dependent model checkpoints are frozen until a written waiver is docketed, and the launch-clearance certificate is issued only when the register shows zero uncured Red holds.

How much does fully outsourced license review cost compared to keeping the register in-house?

At the 2024 median outside IP counsel rate of $485 per hour per the Thomson Reuters index, reviewing a thousand-plus licenses passes $90,000, versus an estimated $75,000-$90,000 a year for an in-house IP docketing role.

Do FRCP service rules affect calculated docket dates?

Yes — FRCP 6(a)(1)(C) rolls weekends and holidays forward, and FRCP 6(d) adds 3 days when service is made by mail, left with the clerk, or by other consented means.

How long does remediation take without a centralized docket after a copyleft failure is found post-code-freeze?

Teams without a centralized docket averaged 22 days to remediate a single copyleft or attribution failure after code-freeze, per the Mend 2024 State of Open Source License Risk report.

Quick answers