AI, IP, and copyright

3 questions hide inside “we use AI for that.” Who owns what comes out. What the model was trained on. What the company can publish or sell.

They are usually treated as one question and answered as one. They have different answers, they move at different speeds, and only one of them is genuinely open. What follows is directional, not legal advice.

Question one: who owns what comes out

In the US the main part of this question is now settled. Copyright needs a human author, an appeal court confirmed it, and the Supreme Court declined to reopen it. A work produced entirely by a model, with no human doing anything except asking, has no copyright at all. The Copyright Office has gone further and said that prompts on their own are not authorship, however many of them there are, because the person writing them is not controlling how the result comes out.

What is not settled is where the line falls once a person is involved. Copyright can attach to what the human contributed: the selection, the arrangement, the edits, the parts of the finished work that are recognisably theirs. How much is enough gets decided case by case, and “case by case” is the honest answer rather than a dodge.

Registration is a US procedure rather than a universal one. In India and the UK copyright arises the moment a work is made and registration is optional, so “cannot be registered” is not how the question arrives there. Countries also differ on the underlying rule. The UK has a provision giving authorship of a computer-generated work with no human author to whoever made the arrangements for it, which points the opposite way from the US position. The UK government reported in 2026 that the provision is little used and could be repealed, then left it there without introducing legislation.

This matters most for the assets a company would sue over if a competitor copied them: brand identities, signature creative work, software with large AI-written portions. For internal documents, briefs and working drafts it is close to academic.

One thing to hold on to: this is the same question wherever the AI came from. Output from a consumer chatbot, an internal tool built on an API, a self-hosted model or a vendor product all sit on the same line.

Question two: what the model was trained on

Large text and image models were trained on enormous quantities of material pulled off the internet. Much of it was copyrighted. Most of the people who made it were never asked.

Courts have started to answer this, and “nobody knows anything yet” is no longer true.

The most useful US ruling so far split the question in two. Training a model on books the company had lawfully bought and scanned was held to be fair use, and emphatically so. Downloading and keeping a library of pirated books to build that training set was not. The piracy half then settled for roughly 1.5 billion dollars, about 3,000 dollars a book and the largest copyright settlement in US history. A settlement produces money and no precedent.

A second US ruling in the same month also found training to be fair use, and the judge said plainly that the authors had lost on the arguments they chose rather than on the strongest argument available to them. He pointed at the one they had not run: that a model trained on a body of work can flood the market with substitutes for it. Nobody has yet argued that on a properly built record.

The first UK judgment went its own way for a reason that has nothing to do with fair use, which is not a thing in UK law. The image library that sued could not show the training had happened in the UK, so that claim fell away before it was tested. The court also held that a model’s weights are not themselves an infringing copy, because the images are not stored inside them. What survived was a narrow finding about watermarks appearing in some early outputs.

How the training material was obtained has mattered more than what the model did with it. Buying books and scanning them was fine. Torrenting the same books produced the only nine-figure number in the field so far. The training step itself has survived every time it has been squarely decided.

What remains genuinely open is easy to state. No appeal court anywhere has ruled on training, so every one of these decisions is a first-instance decision a higher court could unpick. The market-substitution argument has not been tested. And fair use is a US rule: it allows some copying without permission when the new use is different enough in purpose from the original and does not take the original’s place in the market. Most other countries have narrower listed exceptions and no general equivalent, so a US fair use win says very little about what happens elsewhere.

The disclosure side has moved too. Providers of general-purpose models sold into the EU now have to publish a summary of what they trained on, to a fixed template: the kinds of data, the scale, the main public datasets, which web crawlers were used, and how opt-outs were handled. It is a summary rather than a list, and it is the first time anything about training sets has been published because the law required it rather than because a lab chose to.

Across the surfaces the answer shifts less than people expect. The large closed-model providers do not publish their training sets in detail and are the main defendants. Open-weights models from large labs were built from similar material and face the same questions. A self-hosted model does not inherit a cleaner history because it runs on company hardware; it inherits whatever the people who trained it pulled from.

Question three: what can be published or sold

This is the question that lands on day-to-day work, because it touches everything customer-facing. A campaign whose hero image came from an image model, whose headline came from a chat model and whose landing page came from a coding assistant carries 3 different exposures rather than one.

There is a mechanism underneath all 3, and it is what tells you which output is actually at risk.

Why a model ever reproduces someone’s work

A model does not store copies of what it was trained on. What it stores is a pattern learned across an enormous number of examples. The reason it can still occasionally produce a near-exact copy is repetition. Material that appeared many times in the training data, in near-identical form, gets learned closely enough to be reconstructed. Material that appeared once or twice does not.

The effect is steep rather than gradual. Research on this found that a passage appearing 10 times in a training set is produced roughly 1,000 times more often than one appearing once, which is why labs strip duplicates out of training data partly to suppress it.

That gives a rule anyone can apply to their own output without asking a lawyer. The realistic cases are the things the internet copied endlessly: famous characters, stock-photo watermarks, song lyrics, boilerplate code that appears in ten thousand repositories. An ordinary sentence and an ordinary image are not going to come back out as copies, because they were never in there enough times to be learned that closely.

Images, video and audio

Image, video and music models can occasionally produce output that recognisably resembles a specific character, a living artist’s signature style or a trademarked mark. The model has seen all of those, many times over. Most of the time it generalises. Sometimes it reconstructs.

The risk scales with two things: how widely the output is published, and how distinctive it is. An internal mockup is low-stakes. A national ad campaign is not.

Code

Coding assistants can reproduce chunks of their training data for the same reason. For short snippets it rarely matters, because a function signature is not creative work. For longer stretches of distinctive logic it matters more. GitHub’s assistant carries a filter that suppresses suggestions matching public code on GitHub at roughly 150 characters or more; enterprise administrators control it and it is off by default at that level. A self-hosted code model has whatever signals its trainers built in, which is usually less.

Text

Text is the lowest-risk of the 3, because models generally synthesise across many sources rather than reproduce any one. “Lowest” is not “none”: the most consequential dispute currently running is a text case built substantially on examples of a model reproducing news articles, which is exactly where that tendency breaks down.

The bigger day-to-day risk with AI text is not copyright at all. It is claims that are wrong, attributions that do not exist and citations that were invented. That is covered in Building trust.

What happens when a claim actually arrives

A letter naming one published asset and saying it infringes is mostly an evidence problem rather than a legal one. Someone has to establish how that asset was made: which tool, which inputs, who edited it and what they changed, which version actually went out. If the tool came with cover, whether that cover applies turns on which plan the company was on and whether the settings the vendor requires were switched on. GitHub’s IP cover for its coding assistant, for instance, applies only where the duplicate-suppression filter was enabled.

With records, that is an afternoon. Without them, it is weeks of asking people what they remember, and the answer often turns out to be that nobody can say which tool produced the file.

Indemnity, and where it stops

Indemnity is a promise in a contract that the vendor will defend the customer and pay the damages if someone sues over what its tool produced. Several of the large vendors offer it on enterprise plans.

The shape matters more than the details, which vary by vendor and change. It covers outputs, not training: nobody indemnifies a customer against the underlying training-data disputes, because those are the vendor’s own fight. It is conditional on using the tool the way the contract describes. And it lives in the enterprise-contract lane and almost nowhere else.

That last part is the asymmetry worth carrying. Output from an employee’s personal chatbot account comes with none. Output from an internal tool built on an API comes with whatever the developer agreement says, which is usually thinner. Output from a self-hosted open-weights model comes with none from anyone, because there is no counterparty to ask. The same image, produced two different ways, gives two different answers to the question of who pays.

Provenance, the cheapest control

The single most useful thing in the IP picture is a record of what produced what. This is provenance, and it does several jobs at once. It is the evidence behind the human-contribution claim in question one. It is what an infringement letter gets answered with. And it lets someone reconstruct, months later, how a thing was made.

It costs very little, because it sits on top of files the business is already storing. Most teams skip it because nobody asks for it, right up until somebody does.

Copyright is not the only IP here

A process, a pricing model, a customer list or an unreleased design is not protected by copyright. It is protected as a trade secret, and that protection depends on the owner taking reasonable steps to keep it secret.

That turns it into a question about where data goes rather than a question about who owns an output. Material pasted into a tool that retains it, or that a vendor’s staff can read, may stop being secret in the way the protection requires. It is the same paste that the data-exposure chapter is about, seen from the IP side.

What holds still and what moves

The factual layer of this chapter ages faster than anything else in the hub, so it is worth separating the two.

Stable: the 3 questions and the fact that they are different questions. The requirement for human contribution. The mechanism behind reproduction, which is repetition in training data and will not change. Provenance being cheap and skipped. Exposure following the surface that produced the asset.

Moving: which case is at which stage, which vendor covers what and on which plan, which country has ruled which way, and what “enough human contribution” means in practice.

Anything read about AI and copyright that turns on a specific case or a specific contract term is a snapshot, including the specifics above. The shape of the questions is not.

Where the risk actually sits

Work meaningfully shaped by a person, made on a tool the business chose deliberately, with a record of what produced it, going through the review anything else would go through, carries about the same risk as any other creative or technical output a company publishes.

Output from a tool nobody in the business has any record of, with no human shaping, no record and no review, going straight into a customer-facing channel, is where most of the incidents that make the news come from.

Most work sits nowhere near either. Internal drafts, working documents and low-stakes output are the bulk of it, and none of this changes them. The slice that matters is the work that is customer-facing, distinctive and external. Companies that handle that slice well do not have the longest legal review. They have two or three habits sitting in the default path: a person meaningfully involved in anything that goes out, the tool that produced it recorded beside it, and the choice of tool made on purpose rather than by whoever had a tab open. This is the second of the 4 risks, and the one where the cheap control is furthest ahead of the expensive one.