Is Your 2026 AI Strategy Founded on The Three Pillars of Due Diligence?

Generative AI can produce text, images, code, music, and video that appear highly polished. Commercial utility, however, does not itself establish copyright ownership.

In Thaler v. Perlmutter, 130 F.4th 1039 (D.C. Cir. 2025), the US Court of Appeals for the D.C. Circuit affirmed that the Copyright Act requires human authorship as a matter of statutory law. A work identified as having been created solely by an AI system is not eligible for US copyright registration. The court expressly declined to decide two related questions: whether the Constitution independently requires human authorship, and whether Thaler himself could qualify as the author by virtue of building and operating the system, an argument waived before the Copyright Office.

That rule has an important limitation, which the D.C. Circuit stated directly: the human authorship requirement “does not prohibit copyrighting work that was made by or with the assistance of artificial intelligence.” Copyright may extend to human-authored expression incorporated into an AI-assisted work, and to a human’s sufficiently creative selection, arrangement, editing, or modification of AI-generated material. The Copyright Office has taken the same position in its March 2023 registration guidance, 88 Fed. Reg. 16190, and its January 2025 report Copyright and Artificial Intelligence, Part 2: Copyrightability: the relevant question is whether a human, rather than the system, determined the expressive elements claimed for protection.

Prompting alone will not reliably establish that level of authorship. The Copyright Office has concluded that, “based on the functioning of current generally available technology,” prompts do not by themselves give a user sufficient control over the system’s resulting expression — a hedge worth preserving, since the Office tied its conclusion to present technical capability rather than announcing a permanent rule. The stronger case for protection generally arises where a human creator substantially revises, curates, combines, or otherwise directs the final expressive work.

For companies, the practical consequence is straightforward: do not describe AI-produced assets as categorically “owned” merely because the company commissioned, prompted, or paid for their creation. Instead, distinguish among the types of source material and work product:

• Pure AI outputs, which may lack copyright protection
• Human-authored inputs, edits, and compilations, which may be protected
• Contractual rights between platform, customer, and vendor, which can allocate use rights but cannot create copyright where the law does not recognize it
• Trade-secret, confidentiality, trademark, or first-mover advantages that may still create commercial value even when copyright does not

Fair Use in the Age of Large Language Models

The legal status of training generative models on copyrighted material remains unsettled. Courts have not held that AI training is always fair use or always infringement, and it is worth being precise about how little has actually been decided: every US ruling on the question to date has come from a federal district court. The first appeal, Thomson Reuters Enterprise Centre GmbH v. Ross Intelligence, Inc., was argued before the Third Circuit on June 11, 2026 and remains pending. No federal appellate court has decided whether training an AI model on copyrighted works is fair use.

The Supreme Court’s decision in Andy Warhol Foundation for the Visual Arts, Inc. v. Goldsmith, 598 U.S. 508 (2023), remains relevant because it reinforces that a claimed “transformative” purpose does not end the inquiry. Courts must consider the specific use at issue, including commercial purpose and the effect on actual or likely markets for the original work. But Warhol was not an AI case — it concerned the licensing of a silkscreen portrait derived from a photograph — and it did not establish a rule that any AI product competing with creators or source materials necessarily loses fair-use protection.

The 2025 training decisions illustrate the doctrine’s fact-specific nature. In Bartz v. Anthropic PBC, 787 F. Supp. 3d 1007 (N.D. Cal. 2025), Judge Alsup held on summary judgment that training an LLM on lawfully acquired books was “spectacularly” transformative fair use on the facts before him, and that converting purchased print books into digital form for an internal library was also fair use. He reached the opposite conclusion on copies downloaded from pirate sources to build a general-purpose central library, finding that all four statutory factors weighed against fair use and ordering a trial on actual and statutory damages, including willfulness. That claim did not reach trial: the parties settled, and the court granted final approval of a $1.5 billion settlement on July 20, 2026 — the largest copyright settlement in US history — covering roughly half a million works obtained from pirate libraries.

That distinction matters, and the settlement figure makes the point more forcefully than the opinion did. A company’s legal risk may turn not only on what data was used, but on how that data was acquired, copied, retained, and deployed. Relevant considerations include the manner of acquisition, the commercial purpose of the use, evidence of actual or likely market harm, available licensing arrangements, applicable contractual restrictions, and the model’s resulting outputs.

Nor is the government’s position static. On September 1, 2026, the United States filed a statement of interest in the consolidated OpenAI copyright litigation arguing that training large language models on copyrighted works is fair use, describing the use as highly transformative and warning that a broad licensing requirement would entrench incumbents. A statement of interest is advocacy, not authority, and it has drawn criticism given the government’s concurrent commercial dealings with OpenAI — but it is a material development for any company assessing litigation risk in this area.

Claims that “direct competition is a fair-use killer” overstate the doctrine. Direct market substitution may weigh heavily against fair use, but it is one factor in a context-dependent analysis rather than an automatic rule, and companies should be wary of both vendors who cite it as a reason their licensed corpus is essential and counterparties who invoke it to extract concessions.

Output, Regurgitation, and Liability

Training-data claims and output-infringement claims should not be collapsed into one issue.

A training claim asks whether copying works to develop or improve a model is legally permissible. An output claim asks whether a particular result reproduces protected expression, is substantially similar to a copyrighted work, or causes or facilitates infringement by a user. The same AI system may present materially different risks on each question.

The New York Times litigation against OpenAI and Microsoft remains significant because it includes allegations concerning both training on Times content and outputs that allegedly reproduce or substitute for protected articles. In New York Times Co. v. Microsoft Corp., 777 F. Supp. 3d 283 (S.D.N.Y. 2025), the court allowed the direct and contributory copyright infringement claims to proceed, while dismissing the common-law unfair competition by misappropriation claim with prejudice and most of the DMCA § 1202 claims. Those rulings did not resolve the merits or establish a general rule governing AI training. Proceedings since have narrowed the case further: in August 2026, the news plaintiffs dismissed their remaining “material contribution” contributory infringement and trademark dilution claims with prejudice, and the court denied leave to add new contributory theories against Microsoft. Secondary liability across the AI docket has since been reshaped by Cox Communications, Inc. v. Sony Music Entertainment, No. 24-171 (U.S. Mar. 25, 2026), in which the Supreme Court reversed a $1 billion contributory infringement judgment and held that a service provider is contributorily liable only where it intended the service to be used for infringement — shown either by affirmative inducement or by a service tailored to infringement. Cox narrows exposure for user-generated infringement rather than expanding it, and it is why the news plaintiffs abandoned their material-contribution theories. Companies assessing secondary-liability risk should read it as a defense-side development, not a warning.

Companies should treat reproducibility and regurgitation as concrete operational risks. That does not mean a model must never produce overlapping language, facts, common phrases, or unprotectable ideas. It does mean that systems should be designed and tested to reduce the likelihood that they return near-verbatim or substantially similar protected material, particularly in response to prompts seeking particular articles, books, code repositories, lyrics, images, or other identifiable works.

Useful controls may include:

• Red-team testing for memorization and near-verbatim reproduction
• Prompt and output policies for requests targeting particular copyrighted works
• Escalation procedures for credible infringement complaints
• Model, dataset, and vendor documentation proportionate to the system’s risk profile
• Restrictions on high-risk use cases, such as automated publication of outputs without meaningful review
• Review workflows for material intended for commercial publication, customer delivery, or production deployment

These controls reduce risk; they do not guarantee non-infringement or independently establish fair use.

Data Provenance and Governance

Organizations should move from reactive remediation toward proactive AI governance.

No general federal law requires every AI developer to license all training materials, maintain a universal data bill of materials, or disclose a complete chain of custody for every dataset. Fair use may remain available in appropriate circumstances. That federal position, however, no longer describes the whole landscape. California’s Generative AI Training Data Transparency Act, AB 2013, took effect on January 1, 2026 and requires developers of generative AI systems made publicly available to Californians to publish a high-level summary of each training dataset — its sources, whether it includes copyrighted or licensed material or personal information, the number of data points, collection periods, and whether synthetic data was used. A challenge to the statute failed at the preliminary injunction stage in X.AI LLC v. Bonta, No. CV 25-12295 (C.D. Cal. Mar. 4, 2026), and the statute remains in force. It contains no express penalty provision or private right of action, and California has not yet identified an enforcement mechanism or brought an action under it — but companies serving California users should not treat the absence of a federal mandate, or of a first enforcement action, as the absence of an obligation.

Licensing, provenance records, source restrictions, and contractual compliance can substantially reduce legal uncertainty in any event, particularly for high-value, proprietary, paywalled, or otherwise restricted content. The strongest practices are proportionate rather than absolute:

• Identify major training-data categories and their sources
• Record known licenses, permissions, restrictions, opt-outs, and contractual limitations
• Separate lawfully sourced material from material of uncertain or prohibited provenance
• Conduct enhanced review for proprietary code, paywalled content, personal data, trade secrets, and materials obtained from piracy-related sources
• Document vendor representations, indemnities, technical safeguards, and data-use policies
• Maintain a process for responding to rights-holder complaints, takedown demands, and evidence of memorized outputs

Businesses should not treat “open source” software as unrestricted. License obligations vary, and some licenses impose notice, attribution, source-disclosure, patent, or distribution-related conditions. Whether those obligations apply to a particular AI workflow depends on the license, the code, how it was used, and whether protected code appears in a distributed output. Public statements about source availability can also create independent contractual obligations regardless of the underlying license.

Licensing is often the most predictable path for content that is commercially important, difficult to replace, or likely to create market-substitution concerns. It is not, however, a universal legal prerequisite for all generative-AI development.

Organizations operating in or serving the European Union should also assess the EU AI Act, Regulation (EU) 2024/1689, and related copyright rules. Article 53(1)(c) requires every provider of a general-purpose AI model to maintain a policy for complying with EU copyright law, including identifying and honoring text-and-data-mining reservations of rights under Article 4(3) of Directive (EU) 2019/790. Article 53(1)(d) requires a publicly available “sufficiently detailed summary” of the content used for training, following a template the AI Office published on July 24, 2025. Both obligations have applied since August 2, 2025 and, unlike the technical documentation duties, apply to open-source model providers as well. They are not a requirement to disclose every item in a dataset or produce a complete data bill of materials.

A Strategy Guide for 2026 and Beyond

Companies should not assume that copyright law has already produced a complete AI rulebook. It has not. The legal landscape remains divided among questions of authorship, training, source acquisition, output behavior, contracts, privacy, trade secrets, and jurisdiction-specific regulation, and the first appellate word on training and fair use has yet to be spoken. A defensible AI content strategy should therefore rest on the three pillars identified at the outset — authorship, provenance, and output risk — implemented through five practical objectives:

1. Preserve human authorship. Document meaningful human creative contribution where copyright ownership matters.
2. Know the source profile. Maintain records sufficient to identify major data sources, applicable restrictions, licenses, and known provenance gaps — and sufficient to satisfy the California and EU disclosure regimes where they apply.
3. Separate training and output analysis. Assess both the legality of inputs and the likelihood of infringing, memorized, or substantially similar outputs.
4. Use contracts realistically. Terms of service, licenses, warranties, and indemnities can allocate risk between parties, but they do not manufacture copyright ownership or eliminate third-party claims.
5. Build controls before deployment. Use model testing, output guardrails, review policies, complaint handling, and governance records to make risk management operational rather than aspirational.

AI development does not require perfect data provenance or universal licensing, but organizations should be able to explain — credibly and with evidence — what data they used, what rights or defenses they rely on, how their systems are designed to reduce harmful outputs, and where the remaining risks sit.

Organizations that treat those questions as core product-design issues will be better positioned to manage the evolving litigation and regulatory environment than those that wait to solve them after a dispute arises.

Gamma Law is a premier specialty law firm supporting select clients in complex and cutting-edge business sectors. We provide our clients with the legal counsel and representation they need to succeed in dynamic business environments, push the boundaries of innovation, and achieve their business objectives, both in the U.S. and internationally. Email us at info@gammalaw.com today to discuss your business needs, or click here for full contact information.

Legally Sound AI Content Strategy