IP and Copyright in AI Outputs: What CEOs and Legal Teams Need to Know in 2026

Your marketing team generates 200 pieces of content per month with AI assistance. Your developers use GitHub Copilot to write production code. Your legal team drafts contract clauses using Claude. Your product team generates UI copy with a custom AI workflow.

Your IP policy was written in 2019. It says nothing about AI.

This gap exists in most organizations, and it creates three categories of exposure that general counsel and CEOs need to understand. The ACE Framework (Ingest, Analyze, Predict, Generate, Execute) is useful context here: Generate capability creates the highest volume of IP questions because it produces artifacts at scale, while Execute capability creates the most consequential ones because AI actions can trigger third-party rights without human review.

You may not own what your AI produces. You may unknowingly reproduce content you don't have the right to reproduce. And when your customers upload data to your AI systems, the question of who owns the derived outputs may not be answered in your favor.

None of these risks are fully resolved by existing law. The legal landscape for AI and intellectual property (IP) is actively contested in 2026, with multiple major cases in discovery or appeal in the US, EU, and UK. But defensible positions exist, and the organizations that establish those positions clearly in their contracts and policies now will be better positioned than those who wait for the law to settle.

This article is not legal advice. It's a framework for CEOs, general counsel (GC), and CIOs to understand the exposure dimensions, evaluate their current posture, and identify the policy and contract gaps worth addressing.

The Ownership Question: Current Legal Status

Key Facts: AI Copyright and IP

• Over 70 infringement lawsuits have been filed by copyright owners against AI companies, with the Bartz v. Anthropic settlement in 2025 producing a $1.5 billion payout, the largest in US copyright history. (Copyright Alliance)
• The US Supreme Court denied certiorari in March 2026, reaffirming human authorship as a foundational requirement of US copyright law and closing the argument that AI outputs can receive independent copyright protection.
• 72% of S&P 500 companies disclosed at least one material AI risk in 2025, up from 12% in 2023, with IP and copyright exposure among the most frequently disclosed categories. (Harvard Law School Forum)

The foundational question is simple: if an AI generates a piece of content, who owns it?

In the United States, the Copyright Office has stated clearly that works generated entirely by AI without human authorship are not eligible for copyright protection under existing law. The Copyright Act protects original works of authorship created by human authors. AI is not a legal author.

The US Copyright Office's AI guidance and its Part 2 Copyrightability Report (January 2025) clarify this position: AI-generated content with "sufficient human authorship" can receive copyright protection, but the Copyright Office evaluates human authorship claims case by case. The more a human crafted the specific expression (not just provided a general prompt), the stronger the claim. The Office also requires applicants to disclose AI-generated content in registration applications and explain the human author's specific contributions.

What this means practically: if your employee writes a prompt that says "write a blog post about supply chain disruption," the resulting content may not be copyrightable. If your employee writes a detailed creative brief, edits the AI draft substantially, adds original analysis, and makes specific expressive choices throughout the revision process, the resulting work has a stronger human authorship claim. The law doesn't draw a clean line, and different courts may draw it differently.

The Thaler v. Perlmutter case (2023) confirmed that fully AI-generated works without human authorship cannot receive copyright. The court found that the Register of Copyrights was correct to refuse copyright for an image generated by an AI system without meaningful human creative contribution. That case addressed the AI-only scenario. The partially-human-authored scenario is still being developed.

In the European Union, the situation is similar in principle but complicated by the EU AI Act. The EU copyright framework requires human authorship for protection. The EU AI Act does not resolve copyright ownership directly but imposes transparency requirements on AI-generated content, particularly requiring disclosure when AI generates content that could deceive consumers about its human origin.

EU law does provide a neighboring right for database makers and some additional related rights that may apply to AI-assisted compilations, but the ownership question for AI-generated expressive content is substantially the same as in the US.

In the United Kingdom, the Copyright, Designs and Patents Act 1988 includes a provision for "computer-generated works" that may allow copyright for AI outputs where there is no human author, with the protection vesting in the person "by whom the arrangements necessary for the creation of the work are undertaken." Whether this provision extends to modern generative AI outputs is untested, and UK courts have not ruled on it as of 2026.

The practical implication for your business: If your AI generates content that is entirely or substantially AI-generated with minimal human creative contribution, you may not own it in the traditional copyright sense. Competitors could reproduce your AI-generated blog posts, marketing copy, or product descriptions without infringing your copyright.

This doesn't mean AI-generated content is worthless or unprotectable. Trade secret protection may apply to your prompts and workflows. Database rights may apply to compilations. Contract protections can restrict reproduction regardless of copyright. But the simple assumption that "we made it, we own it" may not hold for fully AI-generated outputs.

Documentation as Risk Mitigation

The strongest single action organizations can take to protect AI-assisted work is documenting human creative contribution to that work.

This means:

• Keeping records of human editorial decisions, not just the final output
• Documenting the prompts, revisions, and human selection choices that shaped the final work
• Ensuring that AI-assisted content creation involves meaningful human review and modification, not just acceptance of AI output
• Keeping version history that shows where humans made expressive choices distinct from the AI's original generation

This documentation serves two purposes. It strengthens copyright claims in jurisdictions that require human authorship. And it establishes a record of human involvement that may become relevant in contractual or regulatory contexts.

The documentation burden is not large. A simple log of: prompt used, human edits made, reviewer who approved, and date creates a record trail that's meaningfully stronger than no documentation at all. The Building Your AI Use Policy gives you the policy framework that makes this documentation a standard part of AI-assisted workflows, rather than an ad-hoc practice that only some employees follow.

The 3 Legal Questions for AI Output

The 3 Legal Questions for AI Output is a decision framework for assessing IP and copyright exposure in any AI-generated content workflow: (1) Do we own it? (Is there sufficient documented human authorship to claim copyright in this jurisdiction?), (2) Does it infringe? (Does the AI output reproduce training data that the vendor did not have rights to use, and are we in the liability chain?), and (3) Do our contracts cover it? (Do both vendor contracts and customer contracts explicitly address AI output ownership, training data non-use, and indemnification scope?). Each question requires a different assessment and a different set of mitigations.

Quotable: "The US Supreme Court denied certiorari in March 2026, reaffirming human authorship as a foundational requirement of US copyright law. If your AI generates content with minimal human creative contribution, you may not own it in the traditional copyright sense, and competitors could reproduce it without infringing your copyright."

Quotable: "The Bartz v. Anthropic settlement produced a $1.5 billion payout in 2025, the largest in US copyright history. IP indemnification clauses in enterprise AI contracts have real but untested value. 'The vendor did it' is not a complete defense." (Copyright Alliance)

Quotable: "Most enterprise IP policies were written for a pre-AI world. If your policy says nothing about AI, it does not answer who owns the AI-derived report generated from customer data, whether the blog post your marketing team produced this month is copyrightable, or what your employees are allowed to paste into external AI tools."

Rework Analysis: Based on legal exposure patterns in 2025-2026, the organizations with the most defensible AI IP positions share three characteristics: they maintain version histories that document where human editorial decisions were made distinct from AI generation, they have current enterprise agreements reviewed by legal (not just accepted through standard click-through terms), and their IP policy explicitly names AI-generated content as a category requiring documentation and review before publication.

Training Data Contamination Risk

The second exposure dimension is about what went into the AI models you're using. If a foundation model was trained on copyrighted material, and the model outputs closely reproduce that material, you (as the user) may be in the chain of liability for that reproduction.

This is the heart of the major litigation cases currently in progress.

The New York Times v. Microsoft Corporation (1:23-cv-11195), filed December 2023, alleges that GPT models were trained on millions of Times articles without permission and that the models can reproduce Times content verbatim in response to prompts. The case is in active litigation as of 2026, with OpenAI's motion to dismiss partially denied in April 2025.

Getty Images filed suit against Stability AI in multiple jurisdictions, alleging that Stable Diffusion was trained on Getty's licensed image library without permission and that the model can generate images that closely resemble Getty originals, including their watermarks.

The Authors Guild has filed a class action on behalf of authors whose books were allegedly used in LLM (large language model) training data without consent.

These cases have not yet produced definitive outcomes, but they're creating four types of business risk:

Direct infringement exposure: If the AI models you use output content that closely reproduces copyrighted works, you're potentially in the reproduction chain. The question of whether you or your vendor is the primary liable party is being contested, but "the vendor did it" is not a complete defense. The Vendor Evaluation Framework for AI Tools includes IP indemnification as a scored dimension in the data practices evaluation, which is where you should surface this exposure before signing any enterprise AI contract.

Indemnification value uncertainty: Most AI vendors offer some form of IP indemnification in their enterprise agreements. But the scope, limits, and enforceability of these indemnification clauses are untested in the major cases. Until the cases resolve, the indemnification value is speculative.

Training data transparency obligations: The EU AI Act (effective for many provisions in 2025 and 2026) requires providers of general-purpose AI models to publish summaries of the training data used. This is primarily an obligation on the AI providers, not deployers. But it creates pressure for visibility into what went into the models you're deploying.

Sector-specific exposure: The training data risk is higher in some content categories than others. AI systems generating code (GitHub Copilot litigation), visual art (Midjourney, Stability AI litigation), and journalism-adjacent content (NYT v. OpenAI) are the most actively contested. If your AI outputs fall into these categories, the training data risk is more acute.

What Vendor Contracts Actually Say

Enterprise AI vendor contracts vary substantially on IP provisions. Reviewing the actual contract language is essential; vendor marketing materials on IP are not reliable.

Key clauses to look for and negotiate:

IP ownership grant: Does the vendor explicitly grant you ownership of outputs generated using the service? OpenAI's enterprise terms state that the customer owns the inputs and outputs. Anthropic's commercial terms similarly grant output ownership to the customer. But "ownership" in a jurisdiction that may not recognize AI-generated copyright is ownership of less than you think.

Training data non-use: Enterprise agreements from major providers typically prohibit using your inputs for model training. Confirm this is in your specific contract, and that it applies to both your prompts and any user data those prompts include.

IP indemnification: Does the vendor indemnify you against third-party IP claims arising from the AI outputs? What are the limits, exclusions, and conditions? OpenAI and Microsoft have offered IP indemnification programs; Anthropic has similar provisions in enterprise terms. But "indemnification" clauses have carve-outs, limits on covered claims, and conditions that make them less comprehensive than they appear. Have legal review the specific language.

Transparency on training data: Does the enterprise contract give you information about what the model was trained on? This is rarely available in standard terms, but it's relevant for due diligence, especially for regulated industries.

Contract provisions you should negotiate if not already present:

• Explicit output ownership grant
• Training data non-use with audit rights
• IP indemnification with minimum coverage limit
• Obligation to notify you if the vendor receives a claim that would affect your use of the outputs

The Customer IP Question

If your product uses AI and your customers upload data to your AI system, you have a third exposure dimension: who owns the insights derived from customer data?

This question applies to:

• SaaS (software-as-a-service) products that use AI to analyze customer-uploaded data
• AI features that generate reports, summaries, or recommendations from customer data
• Automation workflows that process customer information to produce AI-assisted outputs

The answers need to be in your customer contracts, not discovered through litigation.

Your customer contracts should address:

• Who owns the AI-derived outputs that are generated from customer data
• Whether you can use customer data to improve your AI systems (most enterprise customers will say no)
• How AI outputs from customer data will be handled upon contract termination
• What customers can and cannot do with AI-generated insights from your platform

The Data Classification for AI Access framework helps you map which customer data categories flow into which AI systems, so your contracts can be specific about data types rather than using generic catch-all language.

If your current SaaS terms don't address AI-derived outputs specifically, you likely have provisions written for a pre-AI architecture that don't cleanly apply. The phrase "data you upload remains your data" doesn't answer who owns the insight report your AI generated from that data.

What Your IP Policy Needs to Say About AI

Most corporate IP policies were written for a world where IP creation was human-driven. An updated policy needs to address three AI-specific questions.

AI output ownership claims and documentation requirements. The policy should specify: what level of human contribution is required before your organization asserts copyright in AI-assisted work, what documentation employees must maintain to support those claims, and what review process applies before AI-generated content is published, filed, or sold.

Restrictions on uploading third-party content to AI tools. Employees using AI tools regularly copy and paste third-party content into prompts (competitor content for analysis, news articles for summarization, external documents for review). Your IP policy needs to address: what third-party content can be included in AI prompts, what the restriction is on reproducing training-data-sourced AI outputs in public-facing work, and what the escalation process is when employees are uncertain.

Customer data handling for AI-derived outputs. For organizations with AI products, the policy should align with your customer contract provisions: what customer data flows into AI systems, who owns the outputs, and what the governance process is for changes to AI data handling.

The policy also needs an owner. AI and IP policy questions will arise regularly and will need timely answers. If the policy is written but there's no named person responsible for answering policy questions and escalating novel situations, the policy doesn't function.

The Honest Position for 2026

The honest framing for this topic: we are in a period of legal uncertainty. The major cases will not resolve in the next 12 to 18 months. Different jurisdictions are moving in different directions at different speeds. Regulatory requirements on AI providers are tightening, which may provide better visibility into training data in the future, but that transparency is not available today.

In this environment, the goal is not legal certainty. It's defensible positioning and clear risk awareness.

Defensible positioning: document human contribution, negotiate vendor contracts with IP provisions reviewed by legal, and update your IP policy to address AI explicitly.

Clear risk awareness: understand which of your AI-generated outputs are in high-risk categories (code, visual art, journalism-adjacent content), know which vendor cases are in progress and what claims they make, and have your general counsel briefed on the exposure.

For the risk register entry that corresponds to IP and copyright risk, AI Risk Register: What to Track gives you the scoring and tracking format. Building Your AI Use Policy covers the broader policy framework of which this IP section is one component. And the Vendor Evaluation Framework for AI Tools data practices dimension is where IP risk surfaces in the procurement process.

The gap between organizations that have done this management work and those that haven't will become visible when the first major enforcement actions follow the pending cases to their conclusions.