Share the smallest authorised sample that can answer a defined evaluation question. An NDA alone is not an evaluation plan.
Use staged disclosure: catalogue metadata, a small screened sample, then a controlled pilot if the earlier stage supports it. Before release, record recipient identity, approved purpose, prohibited reuse, duration, transfer method, permitted processors and the evidence required at close. Have legal, security and commercial owners approve the same release version.
For a hypothetical retrieval test, a buyer might need representative technical articles with a fixed set of queries and answer references. That does not automatically justify an entire archive download. Let the agreed test determine sample size; avoid arbitrary “industry standard” percentages.
NIST's generative AI profile recommends documented data-curation, protection and retention practices. Its voluntary guidance supports the governance principle, not a guarantee that a particular sample is safe. NIST AI 600-1 — Generative Artificial Intelligence Profile, July 2024
Access logs show recorded access, not every subsequent action. Screen third-party and sensitive material before delivery. If the buyer needs training during evaluation, treat that as a separately approved use rather than silently accepting it as testing.