Three places: direct to an AI lab, to an intermediary that resells under its own paper, or through a broker acting for you. All three license rather than buy outright, and all three want 50 or more staff and three years of records or more.
What sells
The operating record of a real company: mail, drives, documents, CRM, ERP, tickets, code. Customer lists and scraped web data are a different and much cheaper market.
What does not
Health and treatment records, privileged client files, export-controlled material and anything a customer owns. One ERP export on its own rarely clears.
How to choose
Ask who sets the price, whether the licence is exclusive, and whether you can license the same records again. An intermediary buying as principal sets its own price once. A broker acting for you runs buyers against each other.