Copyright of AI-generated outputs

The central question: if AI generates a text, an image, or a piece of code, who is the author? The answer in the EU is clear and definitive: nobody, unless there is an original creative human contribution.

European copyright law requires that a work be an "author's own intellectual creation." This implies two cumulative requirements:

• Human author: only natural persons can be authors. An AI is not a person. A company is also not an author (although it may hold rights)
• Originality: the work must reflect free creative choices by the author. Pressing "generate" is not a creative choice. Writing a detailed prompt is not either, according to the current prevailing doctrine

The Zarya of the Dawn case (2023, USCO)

Kristina Kashtanova registered a comic called "Zarya of the Dawn" with the US Copyright Office. The images were generated with Midjourney. The office granted copyright over the text written by the author and over the selection and arrangement of images, but denied copyright over the individual AI-generated images.

The logic: Kashtanova did not control the Midjourney output with precision. Although she wrote detailed prompts, the specific result was unpredictable. There was insufficient "human creative expression" in each individual image.

EU position

The CJEU has confirmed in multiple rulings (Infopaq, Painer, SAS Institute) that originality requires "free and creative choices" by the author. The European Commission in its 2024 study on AI and IP concluded that purely AI-generated outputs do not reach the originality threshold.

Practical consequence: if you generate a report with ChatGPT without substantial modifications, that report has no copyright. Anyone can legally copy it. You cannot pursue a competitor who reproduces it.

Training data and copyright

AI models are trained on enormous amounts of text, images, and code. Much of that material is protected by copyright. The legal question: is it lawful to use protected works for model training without the rights holder's permission?

The Text and Data Mining (TDM) exception

Directive 2019/790 on copyright in the Digital Single Market introduced two relevant exceptions:

• Art. 3: TDM for research purposes. Research organizations and cultural heritage institutions may perform text and data mining on works to which they have lawful access. No restrictions. No rights holder permission required
• Art. 4: General TDM. Any person may perform TDM on works to which they have lawful access, UNLESS the rights holder has expressly reserved their rights (opt-out). For online content, the reservation must be "machine-readable" (robots.txt, metadata)

How the Art. 4 opt-out works

Rights holders can prevent the use of their works for TDM through:

1. robots.txt: directives instructing crawlers not to access the content for training
2. Metadata: tags in HTML or files that declare the TDM rights reservation
3. Contractual terms: clauses in terms of service that prohibit TDM

The practical problem: many publishers did not implement the opt-out before their works were scraped. And the directive has no clear retroactive effect. Training of GPT-3, GPT-4, Llama, and others was conducted before most activated protections.

Active litigation in the EU

Several relevant cases are underway:

• GEMA vs OpenAI (Germany, 2024): the German music rights society sued OpenAI for training on protected lyrics
• ANB vs OpenAI (France, 2024): French authors sued for use of their novels in training
• Getty Images vs Stability AI (UK, 2023): use of millions of watermarked images to train Stable Diffusion

Case law is being formed. There is no final ruling in the EU establishing whether training with protected works (with lawful access and no opt-out) is legal under Art. 4. This is an active grey area.

License risks in AI-generated code

Code assistants (GitHub Copilot, Cursor, Claude Code) generate snippets that may partially or fully reproduce code from training repositories. This creates real risks of license contamination.

The copyleft problem

If the model was trained on code under GPL, AGPL, or similar licenses, and generates a substantially similar fragment, your project could become subject to copyleft obligations:

• GPL: if you distribute software containing GPL code, you must distribute all source code under GPL
• AGPL: even more restrictive. If you offer the software as a service (SaaS), you must publish the source code
• LGPL: allows dynamic linking without contamination, but directly copied code does contaminate

Real risk scenario

A developer asks Copilot to generate a JSON parsing function. The model produces 30 lines identical to a fragment from an AGPL library. The developer does not know this, integrates it into their proprietary SaaS product. A competitor detects the similarity (tools like ScanCode or FOSSA do this automatically). Result: lawsuit for AGPL violation, obligation to publish all source code, or costly litigation.

Mitigation measures

• Duplication filters: GitHub Copilot has a filter that blocks suggestions matching public code. Always enable it
• License scanning: integrate tools like FOSSA, Snyk, ScanCode, or licensee in CI/CD to detect fragments with incompatible licenses
• Human review: do not accept AI-generated code without review. Especially complex functions the model may have memorized
• Internal policy: define which licenses are acceptable (permissive: MIT, Apache 2.0, BSD) and which are not (copyleft: GPL, AGPL) in your project context

Plagiarism detection and similarity risk

Generative models do not directly copy (in theory), but they can produce outputs substantially similar to their training data. This creates risk of unintentional plagiarism in text, images, and code.

Types of problematic similarity

• Literal reproduction: fragments identical to existing works. Rare but possible, especially with highly popular or repeated texts in the training dataset
• Substantial similarity: the structure, argumentation, and expression are similar enough to constitute copyright infringement, even without word-for-word copying
• Replicated style: imitating a specific author's style. In the EU, style is not protected by copyright, but it can create issues of unfair competition or moral rights in specific jurisdictions

Detection tools

For text: Turnitin, Copyleaks, GPTZero (detect both plagiarism and AI-generated text). For code: ScanCode, Black Duck, FOSSA. For images: TinEye, Google Reverse Image Search, Hive Moderation.

Practical recommendation: run critical AI outputs (publications, legal documents, production code) through detection tools before publishing or distributing. It is not infallible, but it significantly reduces risk.

Patentability of AI-generated inventions

If AI "invents" something, can it be patented? The current answer from major patent offices is unanimous: no, if the designated inventor is an AI.

The DABUS case

Stephen Thaler filed patent applications in multiple jurisdictions designating DABUS (his AI system) as inventor. Results:

• EPO (European Patent Office): rejected. The EPC requires the inventor to be a natural person. An AI cannot be designated as inventor (Decisions J 0008/20 and J 0009/20)
• USPTO (USA): rejected. The Supreme Court confirmed in Thaler v. Vidal (2023) that the inventor must be human
• UKIPO (United Kingdom): rejected for the same reasons
• South Africa: granted. Only major jurisdiction that accepted DABUS as inventor, but with a limited patent examination system
• Australia: initially granted on appeal, then reversed by the high court

Practical implications

AI-assisted invention IS patentable if a human can be legitimately designated as inventor. The key is documenting the human contribution to the inventive process:

• Defining the technical problem (human contribution)
• Selecting the data and model parameters (human contribution)
• Evaluating and selecting among the AI outputs (human contribution)
• Adapting, refining, or combining the results (human contribution)

If AI generates 1,000 candidate molecules and a chemist selects, analyzes, and refines 3 of them as viable, the chemist is the inventor. AI was a tool, like a microscope or a simulator.

Trade secrets and AI

The EU Trade Secrets Directive (2016/943) protects trade secrets in the EU. A trade secret is information that has commercial value by being secret, that has been subject to reasonable steps to keep it secret, and that is indeed secret.

Risk 1: leaking trade secrets in prompts

The most immediate risk. An employee pastes proprietary code, pricing strategies, formulas, client lists, or financial data into ChatGPT or similar. If the provider uses that data for training (or simply stores it), the information ceases to be "secret" and potentially loses trade secret protection.

Real case: Samsung (2023). Samsung engineers uploaded proprietary source code to ChatGPT for debugging. Samsung banned the use of external generative AI following the incident.

Risk 2: AI as an extraction vector

Prompt injection or model inversion attacks can extract information from the model's context. If a fine-tuned model with confidential data is accessible to third parties, the data can be partially extracted through prompts designed for that purpose.

Risk 3: loss of secrecy through inadvertent disclosure

If you share confidential information with an AI provider without an adequate NDA, the information may no longer meet the "reasonable steps for protection" requirement. This weakens your position if you later need to litigate for trade secret misappropriation.

Protective measures

• AI usage policy: define what information can and cannot be shared with external AI services
• Contractual clauses: verify that the provider does not use your data for training. OpenAI Business, Anthropic API, and Azure OpenAI offer this contractual guarantee
• Local models: for highly sensitive information, use self-hosted models that do not transmit data to third parties
• Data classification: tag information by sensitivity level and apply different rules for each level
• DLP (Data Loss Prevention): tools that detect and block the sending of sensitive data to unauthorized AI services

Practical guide for enterprises

Every company using AI needs an updated intellectual property policy. These are the essential elements:

IP policy for AI usage (template)

INTELLECTUAL PROPERTY POLICY FOR AI USAGE
Company: [name]
Version: [X.Y] | Date: [YYYY-MM-DD]

1. OUTPUT OWNERSHIP
   - Outputs generated with AI without substantial modification:
     NOT considered proprietary works of the company.
   - Outputs generated with AI + documented substantial creative human
     contribution: Company ownership (work for hire).
   - Always document: prompt used, original output,
     modifications made, responsible human author.

2. TRAINING DATA
   - PROHIBITED to use third-party protected works without verifying
     license for training internal models (fine-tuning, RAG).
   - Verify TDM opt-out before scraping web content.
   - Prefer datasets with explicit license (Creative Commons,
     public domain, commercial licenses).

3. AI-GENERATED CODE
   - Enable duplication filters in AI coding tools.
   - Mandatory license scanning (FOSSA/ScanCode) in CI/CD.
   - Mandatory human review before merge.
   - Copyleft licenses (GPL, AGPL) incompatible with proprietary
     product: reject identified fragments.

4. TRADE SECRETS
   - PROHIBITED to share with external AI: proprietary source code,
     core algorithms, customer data, pricing strategies,
     non-public financial information.
   - For sensitive data: use exclusively self-hosted models
     or providers with no-training contracts.
   - Classification level for AI usage:
     PUBLIC: any AI | INTERNAL: AI with contract |
     CONFIDENTIAL: local AI only | SECRET: do not use AI.

5. PATENTS
   - AI-assisted inventions: document human contribution
     at each phase (problem, data, selection, validation).
   - Always designate a human inventor.
   - Retain process records (prompts, intermediate outputs,
     human decisions) as evidence.

6. REVIEW
   - Mandatory annual review of this policy.
   - Immediate update if relevant legislation changes
     (AI Act, IP directives, CJEU/EPO case law).

Quick checklist before publishing AI outputs

1. Has it been verified that it does not reproduce protected content (plagiarism check)?
2. Has the creative human contribution been documented?
3. If it is code: has it been scanned for incompatible licenses?
4. If it will be registered as IP: is there an identifiable human inventor/author?
5. Has any confidential data been anonymized/removed from the output?

Ejercicio practico

Puntos clave