AI Trained on Copyrighted Data: Who Owns the Model and the Output — and What Legal Risks Exist?

Copyright and AI talk gets loud fast. One post says training is theft. Another says it’s all fair game.

If you’re stuck between those takes, you’re not alone. Most people feel the same mix of confusion and worry. They don’t want a lawsuit, a takedown, or a costly mistake.

We’ll keep this plain. We’ll separate what people think the law says from what it often does. We’ll also flag where the answer changes by country.

What “training on copyrighted data” means in plain English

Training starts with copying. That’s the part many people miss. A system can’t learn from a work without taking in a copy of it somewhere in the pipeline.

Copyright is the legal right that controls copying, sharing, and certain re-uses of creative works. A copyright infringement claim says someone used those rights without permission or a legal exception.

In practice, training often uses a dataset (also called a corpus) built from many sources. That can include licensed archives, public domain material, and scraped web pages. It can also include content gathered through web crawling and data scraping.

Training vs inference (why the model can run “without the training data”)

Training is the learning phase. Inference is the use phase. Inference is when the model generates text or images from your prompt.

Many systems don’t ship the full dataset to users. Instead, they store what they learned as model weights (also called parameters). Those weights guide outputs without needing to fetch the original files each time.

Pre-training vs fine-tuning

Pre-training is broad learning from huge mixed data. Fine-tuning is narrower training on a smaller, curated set. Fine-tuning often targets a domain like law, medicine, or customer support.

Who owns what: the data, the model, and the output

Ownership is not one question. It’s three separate questions. Mixing them causes most of the confusion.

The training data

Copyright stays with the rightsholder. Training on a work does not transfer copyright to the AI company or the user. A licence can grant permission, but it doesn’t rewrite ownership by itself.

The model (code + weights)

The model developer often owns the software code. They also protect parts of the system as trade secrets (confidential business information). Contracts and terms of service then control who can use the model and how.

This is where “who owns the model” can change. If you build on a base model, the licence may limit commercial use, re-training, or redistribution. If you hire a vendor to train, your contract may decide who owns the weights.

The output

Output ownership depends on two things. First, whether the output qualifies for copyright at all. Second, what your contract with the tool says.

In the US, the Copyright Office says outputs can be protected only when a human determines enough expressive elements. It gives examples like human creative arrangement or human edits, but says prompts alone are not enough.

The key legal split: training copies vs infringing outputs

There are two legal risks. They look similar, but they behave differently. Treat them as separate boxes.

Box 1: copying during training. This focuses on rights like the reproduction right (the right to make copies). It also raises questions about exceptions and licences.

Box 2: outputs that look too close. This focuses on whether an output is too similar to a protected work. Lawyers often discuss substantial similarity and derivative works (new works based on earlier ones).

Copying to train is one issue. Producing near-matching outputs is another.

United States: fair use and where the fights land

In the US, a common defence is fair use. Fair use is a flexible test with four factors. Courts weigh them case by case.

The four factors look at purpose, the nature of the work, how much was taken, and market harm. That last part matters a lot when outputs compete with the originals.

US legal writing often points to search and indexing cases. Examples include Google Books and Perfect 10. They involve large-scale copying tied to a different function than the original.

Still, nothing is automatic. If a model outputs text or images that can replace a creator’s work in the market, that can cut against a fair use argument. That’s why output filters and testing matter in practice.

European Union: TDM rules plus EU AI Act duties

EU law has a specific frame for this topic. It’s built around text and data mining (TDM) exceptions. TDM covers automated analysis of text and data to generate information.

The EU Copyright Directive (Directive 2019/790) adds two TDM exceptions in Articles 3 and 4. Article 4 is the wider one, but it includes an opt-out for rightsholders.

The opt-out reality check (why it’s messy)

Article 4 says TDM is allowed only if rights have not been “expressly reserved.” The Directive points to machine-readable methods for online content.

In the real world, opt-outs can fail. One simple reason is that many creators don’t control the site settings, so they can’t post the opt-out themselves.

Temporary copies

EU law also includes an exception for certain temporary technical copies. This sits in the Information Society Directive (Directive 2001/29) Article 5(1). It covers temporary acts of reproduction that form part of a technological process.

EU AI Act: extra steps for general-purpose AI models

The EU AI Act adds a compliance layer for general-purpose AI (GPAI) providers. Two key duties tied to copyright are: comply with EU copyright rules (including the opt-out system) and publish a sufficiently detailed training-data summary.

The AI Act also signals reach. The rules apply to providers placing GPAI on the EU market, even if training acts happened elsewhere.

A practical takeaway: EU compliance pushes companies toward documentation. That’s where training-data summaries, policies, and audit trails show up in internal playbooks.

United Kingdom: fair dealing and the practical gap

The UK does not copy-paste the EU approach. It uses fair dealing exceptions (more specific than US fair use). So the analysis can change quickly based on the use case.

The UK also has a text and data analysis exception in section 29A of the Copyright, Designs and Patents Act 1988. It is linked to lawful access and research use, and it has limits that many commercial AI training projects may not fit.

On litigation risk, the Getty v Stability AI case shows the shape of claims UK courts now manage at scale. The judgment describes allegations of scraping millions of images and disputes about outputs made available to UK users.

The real legal risks (two-layer matrix)

Here’s a simple way to see it.

Two extra risks often ride along. Trademark or brand elements can appear in images. And contracts can impose limits even when copyright risk looks low.

How to reduce risk (a practical playbook)

Risk control is boring. That’s the point. Boring controls stop expensive surprises.

For builders (training and releasing models)

Keep a data provenance file. That’s a record of where data came from and what rights you think you have. Store licences, permissions, and key source decisions.

Use documentation that non-engineers can read. Teams often use datasheets for datasets, dataset nutrition labels, and model cards. These don’t solve legal questions, but they support compliance and audits.

Reduce “near-duplicate” training content. Use deduplication and “decontamination” steps to lower the chance of memorised outputs. Then test for memorisation with red-team prompts before release.

Plan for opt-outs. In the EU, the opt-out mechanism is part of the story. A process to honour it is easier to defend than no process at all.

For deployers and everyday users (SaaS tools)

Read the terms before you publish. Some tools claim rights over outputs. Others push responsibility back to you for clearance.

Treat outputs like a draft. Run a human review step for anything commercial. If it looks like a known work, don’t ship it as-is.

Set a takedown process now. Have an inbox, a tracker, and a response timeline. A calm, documented response often beats a rushed argument.

Bottom line decision tree (quick, practical)

If you’re training a model

Start with rights. List sources, licences, and access limits. Assume you may need to show your steps later.

If you’re using a model

Focus on outputs. Check for closeness to known works. Keep records of prompts, edits, and approvals.

If you’re publishing outputs commercially

Add a clearance layer. Use human edits, add original structure, and keep version history. If you need certainty, get legal review before launch.

FAQs

Is it legal to train AI on copyrighted data?

It depends on where you are, what you copied, and what rule you rely on. In the US, teams often argue fair use. In the EU, TDM exceptions can apply unless rights are reserved. In the UK, rules differ and can be narrower.

Training nearly always involves copying. That’s why licences, exceptions, and opt-outs matter. Outputs then create a second set of risks, separate from training.

Do I own the outputs I generate with an AI tool?

Often, you can use the output, but “owning” it is more complex. Your contract may grant broad usage rights, yet copyright may not apply if the expressive elements come from the system. Where your edits, selection, or arrangement add human creativity, protection is more likely.

Start by checking the tool’s terms. Then ask a simpler question: what did a human actually create here. Keep notes of edits, drafts, and choices.

Can AI-generated outputs be copyrighted?

In the US, protection can exist when a human determines enough expressive elements. The Copyright Office points to human-authored material inside the output, or meaningful human arrangement or modifications. It does not treat prompts alone as enough. Other countries can apply different tests.

If you want protection, build human authorship into the workflow. Edit, rewrite, and shape the result. Document what you changed and why.

Can AI outputs infringe copyright even if training was lawful?

Yes. Training rules and output rules are different. Even where a training defence exists, an output can still be too similar to a protected work. That’s why substantial similarity tests and output controls matter, especially for commercial publishing and image generation.

This is the risk many teams under-price. They focus on datasets, then skip output review. Courts and claimants often focus on the output examples.

Mandatory disclaimer

This article is general information, not legal advice. It doesn’t create a lawyer-client relationship. Laws can change, and details matter, so consider getting advice from a qualified lawyer for your situation.