In most generative AI products, the user does not automatically own what the model produced — and your platform may not either. Ownership turns on jurisdiction, how much human creative judgment shaped the result, and what your terms of service actually say, while liability for infringing output usually lands on whoever publishes it, not whoever built the tool.
Quick answer: U.S. law generally withholds copyright from purely AI-generated content, and most vendor terms assign whatever rights do exist to the user — but that assignment doesn't erase infringement risk from training data or memorized output. If your product doesn't surface provenance and gate publication, your users inherit that risk unknowingly, and so does your company.
This isn't a hypothetical for legal to sort out later. Every generative feature ships with a set of implicit answers to "who owns this" and "who's exposed if it's wrong" baked into the UX — whether a product team decided that on purpose or not.
Why Copyright Risk in Generative AI Products Cuts Both Ways
Generative AI creates two distinct copyright exposures: whether the training data was lawfully used to build the model, and whether the model's output is either ownable or infringing on someone else's work. Product teams tend to treat both as legal-team problems, but they surface as decisions embedded in the product itself.
The input side is about the model's education. Getty Images sued Stability AI in both the UK and US alleging that Stable Diffusion was trained on millions of Getty's copyrighted images without a license — and pointed to outputs that reproduced Getty's own watermark as evidence. The New York Times sued Microsoft and OpenAI in December 2023, with complaint exhibits showing ChatGPT reproducing lengthy passages of Times articles nearly verbatim. Artists brought a parallel case, Andersen v. Stability AI, over Stable Diffusion training on copyrighted artwork without consent or compensation.
The output side is about what the model hands back to your user, and whether they can actually claim it, publish it commercially, or trademark it without a fight. These two exposures don't cancel out — a model can be trained entirely on licensed data and still generate an output that happens to closely resemble a third party's copyrighted work, and a model trained on scraped web data can still generate output a court would call original enough to be infringement-free. Each needs its own mitigation.
Product leaders who've mapped adjacent AI risk categories — fairness, transparency, uncertainty communication — already have the muscle for this. Our complete guide to responsible AI for product teams covers how these risk categories interlock; copyright is the one most PMs assume is purely contractual, and it isn't.
Who Owns AI-Generated Output, Legally?
In the U.S., the Copyright Office holds that copyright requires human authorship, so output generated with minimal human input generally isn't copyrightable at all — meaning no one owns it outright, and your user's claim to it may be no stronger than anyone else's ability to copy it freely.
This isn't an edge-case reading. In Thaler v. Perlmutter, the D.C. Circuit upheld the Copyright Office's refusal to register a work whose applicant listed an AI system, not a human, as sole author. In 2023, the Office also partially cancelled the registration for the comic Zarya of the Dawn after learning its images were AI-generated (Midjourney), while letting the human-written text and the human-selected arrangement of panels keep their registration. The line the Office draws:
- Prompting alone, however detailed, is not authorship. Typing a rich, iterative prompt doesn't make the resulting image or text a human creative expression in the Office's view.
- Selection, arrangement, and substantial editing can be. A human choosing, sequencing, and modifying AI outputs into a larger work may earn copyright over that arrangement — not the underlying AI-generated elements themselves.
- Human-authored inputs stay protected. A photograph or drawing a person feeds into an AI tool as a starting point retains its own separate copyright status.
Two consequences follow directly into product design. First, if nothing is copyrightable, there's technically nothing to "steal" from your user by using their AI output elsewhere — a real business risk for products that promise creative ownership as a selling point. Second, contract terms still matter even when copyright doesn't attach: your terms of service can assign whatever rights do exist (in edited, human-touched output) to the user, and most major vendors now do exactly that. But an assignment of rights you don't actually hold is a promise with a hollow center — it settles nothing about whether the output infringes someone else's existing work.
Work-for-hire and employment agreements add another layer inside B2B products: if an employee generates a marketing asset using your tool, their employer typically owns whatever rights exist in the result under standard work-for-hire terms — a detail worth surfacing explicitly if your product serves teams, not just individuals.
Indemnification and Provenance: What Vendors Actually Cover
Indemnification promises differ sharply by vendor and almost always exclude the exact scenario product teams worry about most: a user's own creative prompt engineering, third-party assets pasted into the input, or generation outside a paid enterprise tier.
Most major AI vendors added some form of IP indemnification through 2023 and 2024, but the shape of the promise — and its exclusions — varies enough that "the vendor covers it" is rarely a complete answer on its own.
| Vendor / product | Output rights stance | Indemnification | Common conditions |
|---|---|---|---|
| OpenAI (ChatGPT Enterprise/Team, API) | Assigns output rights to the user | Copyright Shield covers eligible enterprise/API customers | Excludes free tier; requires use of default safety systems |
| Microsoft 365 Copilot | Assigns output rights to the user | Copyright Commitment for commercial Copilot services | Requires built-in content filters and guardrails to remain enabled |
| Adobe Firefly | Assigns output rights to the user | Indemnification for Firefly-generated content on paid plans | Training set is licensed/Adobe Stock/public domain, narrowing exposure |
| Google (Vertex AI / Workspace generative features) | Assigns output rights to the user | Generated-output indemnification on qualifying paid services | Conditioned on default safety filters remaining active |
| Getty Images (generative AI) | Assigns output rights to the user | Broad indemnification, marketed as a differentiator | Training data is Getty's own licensed library only |
Two takeaways sit underneath that table. Indemnification is a tier feature, not a platform guarantee — it's routinely stripped out below the enterprise tier, exactly where consumer-facing and prosumer products tend to sit. And every policy assumes default guardrails stay on — a product that lets users disable safety filters, or pipes model output through a custom fine-tune, can quietly void the very protection it's advertising.
Provenance signals are the other half of this. The C2PA (Coalition for Content Provenance and Authenticity) standard — backed by Adobe, Microsoft, the BBC, and others — embeds "Content Credentials" metadata recording that an asset was AI-generated, by which tool, and from what edit history. Surfacing that metadata honestly, rather than hiding it, mirrors the same instinct behind good AI uncertainty communication in the interface: tell the user what the system actually knows about itself, don't let silence imply more certainty — or more originality — than exists.
The Regurgitation Problem: When Output Memorizes Training Data
Regurgitation happens when a model reproduces training examples closely enough to count as copying rather than transformation, and it's measurable — researchers have repeatedly shown that large language and diffusion models can output near-verbatim passages or images under the right prompts, not just novel synthesis.
The foundational research here is Nicholas Carlini and colleagues' 2021 paper "Extracting Training Data from Large Language Models," which showed that targeted prompting could pull verbatim memorized training sequences — personal data, code, exact text — out of GPT-2-scale models, with hundreds of distinct examples successfully extracted. Follow-on work found memorization scales with model size and with how many times a given example appeared in training data. On the image side, Gowthami Somepalli and colleagues' 2023 study "Diffusion Art or Digital Forgery?" found diffusion models reproducing near-duplicates of specific training images for a meaningful share of generations, particularly under prompts that closely matched captions from the training set.
Regurgitation risk isn't evenly distributed. It concentrates around a few conditions:
- Duplicated training examples. Content that appeared many times in training data (viral images, widely syndicated articles, oft-copied code snippets) memorizes more reliably than content the model saw once.
- Narrow, specific prompts. Asking for "a superhero in the style of [named franchise]" or quoting a distinctive phrase pushes the model toward its nearest memorized neighbor rather than a genuinely novel blend.
- Small output spaces. Code generation and short-form text have fewer plausible continuations than open-ended image generation, which raises the odds of an exact or near-exact match.
- Under-diverse fine-tuning data. A narrow fine-tuning set (a company's own past marketing copy, say) reduces the model's effective vocabulary and increases repetition of source material.
None of this shows up in a demo. It shows up at scale, in production, on the prompt nobody tested — which is exactly why regurgitation testing belongs in an ongoing audit cadence, not a one-time launch check. The same audit discipline product teams already apply to an AI fairness audit — sampling outputs against known problem patterns on a schedule, not just at ship time — applies directly to memorization testing: periodically probe with prompts known to trigger duplication in your training or fine-tuning data, and track the match rate over time as the model updates underneath you.
Designing the Mitigations: Attribution, Filters, and Human Review Gates
The reliable mitigations here are structural, not legal disclaimers: provenance disclosure at the point of generation, similarity filtering before publish, and a human review gate for anything headed somewhere public, commercial, or trademarked.
Here's how the risk actually plays out. A small-business owner uses your tool to generate a hero image for their storefront website — a friendly illustrated mascot, prompted with a few adjectives and a product category. They publish it immediately; your product's "generate → publish" flow has no step in between. Months later, an illustrator recognizes the mascot as a near-copy of a piece from their portfolio, sends a takedown notice, and asks the business owner to prove they had rights to use it. The owner didn't know the underlying model had ever seen that illustrator's work — they just typed a prompt and trusted the output. Now they're exposed, and depending on your terms of service, so are you.
That gap — between "generated" and "published" — is where every mitigation below actually earns its keep:
- Provenance metadata at generation time. Tag every output with the prompt, model version, and generation timestamp, ideally in a
C2PA-compatible format, so the record exists before a dispute forces you to reconstruct it. - Similarity screening before publish. Run a perceptual-hash or embedding-similarity check against known-work databases for anything crossing from private draft into a public or commercial path — flagging close matches rather than silently blocking them.
- A human review gate on public/commercial paths. Draft-and-preview generation can stay frictionless; the step that pushes content to a live storefront, ad, or trademark filing is where a person should explicitly confirm they're taking ownership of the result.
- In-product IP terms at the moment of publish, not buried three clicks deep in a ToS page nobody reads — a one-line reminder ("You're responsible for confirming rights to publish this") at the actual decision point changes behavior more than any clause does.
- An audit trail for takedown response. When a claim does arrive, being able to show generation metadata, the review step, and who approved it is the difference between a fast resolution and a drawn-out dispute.
Mapping where in the workflow that review gate belongs benefits from the same lens as a customer journey mapping exercise: trace the moment a user's confidence peaks — "this is mine, I can publish it" — and place the friction just before that peak, not after, when it's cheap to absorb and easy to justify. Users didn't hire your generative feature to produce provenance metadata; in Jobs to Be Done terms, they hired it to finish a creative task fast, so any IP-safety friction has to respect that job or they'll route around it — exporting and republishing elsewhere, outside any of your guardrails.
Key Takeaways
- Ownership and infringement are separate questions. Output can be unownable (no copyright attaches) and still infringing (it copies someone else's protected work) at the same time — mitigating one doesn't mitigate the other.
- U.S. copyright requires human authorship, so prompting alone rarely creates an ownable asset; substantial human selection, arrangement, or editing is what earns protection, per Copyright Office guidance and Thaler v. Perlmutter.
- Vendor indemnification is conditional, not universal — it typically requires a paid enterprise tier and default safety filters to stay enabled, and excludes user-introduced third-party content.
- Regurgitation is measurable and concentrated, not a rare fluke — duplicated training examples, narrow prompts, and small output spaces (like code) raise memorization risk and warrant periodic audit testing.
- The best mitigations sit in the workflow, not the ToS: provenance tagging, similarity screening, and a human review gate before anything public or commercial ships.
- Place the review gate at the point of publish, not generation — keep drafting frictionless, and concentrate accountability where content actually leaves your product's boundary.
Frequently Asked Questions
Can I copyright something an AI tool like ChatGPT or Midjourney generated for me?
Generally not on its own. The U.S. Copyright Office requires human authorship, so output produced mostly by prompting — without substantial human editing, selection, or arrangement — typically doesn't qualify for copyright protection, following its 2023 guidance and the Thaler v. Perlmutter ruling.
Who is liable if AI-generated content turns out to infringe copyright?
Usually whoever publishes or commercializes the content, not the AI vendor, unless a vendor's indemnification terms specifically apply and your usage stayed within their conditions. Most terms of service push liability for published output onto the user or the company that shipped the product built on top of the model.
Does AI vendor indemnification (like OpenAI's Copyright Shield) actually protect my company?
Only within its stated conditions — typically a paid enterprise or API tier, default safety filters left enabled, and no user-introduced third-party content in the prompt. It doesn't cover consumer-tier usage, disabled guardrails, or claims arising from content a user pasted in themselves.
What is "regurgitation" in AI-generated content, and how common is it?
Regurgitation is when a model reproduces training data closely enough to count as copying rather than original synthesis. Research from Carlini et al. and others shows it's a real, measurable phenomenon concentrated in duplicated training examples and narrow prompts — not universal, but common enough to warrant testing, especially in code and image generation.
Is it legal to train AI models on copyrighted data without a license?
It's actively contested and unresolved as a general matter — lawsuits like Getty Images v. Stability AI and The New York Times v. OpenAI and Microsoft are testing exactly this question in court, and outcomes vary by jurisdiction and fair-use analysis. The EU AI Act's general-purpose-model obligations already require providers to publish a training-content summary and maintain a copyright-compliance policy, regardless of how the underlying legality is eventually settled — a regulatory angle worth tracking alongside the litigation; see our EU AI Act map for product managers for how those obligations reach product teams directly.