As artificial intelligence (AI) becomes embedded in virtually every commercial product and service, businesses face unprecedented uncertainty about who owns AI-generated content and how to structure agreements that protect their interests. This article examines the current legal landscape governing AI ownership, provides practical guidance for both technology providers and customers negotiating AI-related agreements, and highlights the intersection of intellectual property (IP), data privacy, and emerging regulatory frameworks that practitioners must navigate.
I. Overview of the AI Ownership Landscape
The rapid integration of AI into commercial products and services has created significant uncertainty regarding ownership of AI-generated outputs. Under current U.S. law, copyright protection requires human authorship – a principle the U.S. Copyright Office has reaffirmed in both its March 2023 registration guidance and its January 2025 Copyrightability Report. Material generated solely by AI, without sufficient human creative contribution, is not eligible for copyright protection. The Copyright Office has made clear that "prompts" alone do not constitute the requisite human authorship; rather, protection extends only to human-authored expression, creative selection and arrangement, or substantial modifications of AI-generated content.
On the patent side, U.S. law similarly requires human inventorship. Under 35 U.S.C. § 115, each "individual" who is an inventor must execute an oath or declaration, and the United States Patent and Trademark Office (USPTO) has consistently held, most notably in Thaler v. Vidal, 43 F.4th 1207 (Fed. Cir. 2022), that AI systems cannot be listed as inventors. The USPTO's guidance on AI-assisted inventions confirms that such inventions may be patentable when a natural person makes the requisite contribution to conception, but the ordinary inventorship analysis still applies: the human must contribute significantly to each claim, and merely prompting an AI system or presenting it with a general goal does not establish inventorship. These developments leave significant open questions for parties contracting around AI-related IP.
II. Key IP Considerations in AI-Related License Agreements
Commercial agreements involving AI technology must address several core IP issues that differ substantially from traditional software licensing. First, parties must allocate ownership of AI outputs, a complex question given that purely AI-generated content may lack copyright protection. Some vendors, such as Anthropic, expressly assign output ownership to customers, while others retain rights or condition ownership on specific terms of use. Agreements should include explicit ownership clauses specifying which party owns outputs, including any derivative works. Importantly, contractual allocation of ownership or license rights remains enforceable between the parties even where the underlying output may not qualify for copyright protection—though such contractual rights may not create enforceable copyright claims against third parties.
Second, training data rights present both upstream and downstream risks. AI models trained on copyrighted materials raise questions about whether such use constitutes fair use or requires licensing, issues that remain unsettled as courts continue to adjudicate cases such as Andersen v. Stability AI Ltd., No. 3:23-cv-00201 (N.D. Cal.), where the court has allowed direct copyright infringement claims to proceed to discovery. Customers should carefully evaluate vendor representations regarding training data provenance and compliance with intellectual property laws. Third, model ownership and improvements must be addressed: when customer data is used to fine-tune or improve a vendor's model, parties must determine whether the vendor may use those improvements for other customers or whether the customer retains proprietary rights.
III. Drafting Considerations for Tech Providers
Tech providers should structure AI agreements to manage the unique risks of generative technologies. Key provisions include:
IP Retention and License Grants: Providers should clearly retain ownership of underlying models, algorithms, and training methodologies while granting customers appropriate usage licenses. Agreements should specify that any output ownership granted to customers does not extend to the model itself or its improvements.
Usage Restrictions and Acceptable Use Policies: Given regulatory uncertainty, providers should implement clear restrictions on prohibited uses (e.g., discriminatory decision-making, generating illegal content) and reserve the right to update acceptable use policies as laws evolve.
Limited Representations and Warranties: Providers often disclaim warranties regarding output accuracy, non-infringement of third-party IP, or fitness for particular purposes. However, larger AI vendors increasingly offer limited IP indemnities subject to specific exclusions (such as customer modifications or combination with other products). Where representations are made, they should be qualified by knowledge or materiality limitations.
Indemnification Scope: Providers should carefully scope indemnification obligations, particularly for IP claims. Many vendors decline to indemnify for customer use of outputs, arguing customers control deployment. Where indemnification is provided, it should be subject to reasonable caps and exclusions for misuse or modification of outputs.
IV. Drafting Considerations for Customers
Customers integrating AI tools face distinct risks and should negotiate protective provisions accordingly:
Data Ownership and Use Restrictions: Customers should seek clear restrictions on the vendor's use of customer data for training purposes. While an outright prohibition on using customer data to train models for other customers is ideal, vendors may negotiate alternatives such as permitting use of aggregated or de-identified data. The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), broadly defines "personal information" and may apply to AI inputs, outputs, profiles, inferences, or other data associated with an identifiable consumer. This makes clear contractual restrictions on data use particularly important, although businesses should consult current regulatory guidance regarding the precise scope of these obligations.
IP Indemnification: Customers should seek robust indemnification against third-party claims that the AI's training data or outputs infringe IP rights. Contracts should expressly extend indemnification language to cover "model outputs and predictions," not merely traditional software. This is where significant exposure lies, and traditional software-as-a-service (SaaS) language may leave AI-specific risks uncovered.
Audit Rights and Transparency: Customers deploying AI in high-risk contexts, particularly those subject to emerging state AI laws, should negotiate audit rights to verify compliance with bias mitigation, accuracy standards, and regulatory requirements.
Liability Caps and Carve-Outs: Given AI's potential for significant harm, customers should seek higher "super caps" or carve-outs from liability limitations for IP indemnification, data security breaches, confidentiality violations, gross negligence, and willful misconduct.
V. Data Privacy and Cybersecurity Intersections
AI systems intersect with data privacy and cybersecurity obligations in ways that create compliance complexity for both providers and customers. Beyond the data use restrictions discussed above, California law addresses "profiling" (defined to include automated processing to evaluate personal aspects such as behavior, preferences, and predictions) and grants consumers rights to opt out of such profiling.
California's regulations further require the California Privacy Protection Agency to issue regulations governing "access and opt-out rights with respect to a business' use of automated decision-making technology, including profiling" and to require responses to access requests that include "meaningful information about the logic involved in those decision-making processes." Businesses deploying AI must therefore ensure contracts with vendors support compliance with these disclosure requirements.
From a cybersecurity perspective, AI systems present novel attack vectors, including data poisoning, model extraction, and adversarial manipulation, that traditional security frameworks may not address. Contracts should include robust notification requirements for security incidents involving model or data integrity, not just traditional data breaches. Given the threat landscape, breach notification and defense/indemnity clauses extending to AI-specific incidents are essential.
VI. Emerging Regulatory Trends
State and local AI legislation is accelerating rapidly. Since New York City enacted Local Law 144 in 2021 (effective July 2023), multiple states have followed with comprehensive AI governance frameworks. Colorado, Texas, Utah, and California have each enacted significant AI-related legislation, with other states actively considering similar measures. These laws generally share common themes: disclosure requirements when consumers interact with AI, bias auditing and impact assessments for high-risk applications, and heightened obligations in sensitive contexts such as employment, credit, housing, and healthcare. Given the pace of legislative activity, practitioners should verify current effective dates and requirements before relying on any specific provision.
At the federal level, comprehensive AI legislation remains pending, though recent executive orders have signaled federal interest in AI governance and potential preemption of certain state laws, creating regulatory uncertainty that practitioners should monitor closely. Companies with international operations must also consider the European Union's (EU) AI Act, which has extraterritorial reach and applies to any business placing AI systems on the EU market or producing AI outputs used in the EU. The result is a fragmented but rapidly evolving compliance landscape that requires careful attention in commercial agreements.
VII. Key State and Local AI Laws
The following summarizes key state and local AI laws that may affect contract drafting and risk allocation:
- New York City (NYC) Local Law 144 (Effective July 2023): Requires a bias audit before use and annually thereafter, public disclosure of results, and 10-day advance notice to candidates for automated employment decision tools. Enforced by NYC Department of Consumer and Worker Protection. Penalties range from $500 to $1,500 per violation.
- Colorado AI Act (SB 24-205, as amended; key provisions effective 2026-2027): Requires impact assessments, risk mitigation, and consumer disclosures for high-risk AI used in consequential decisions. Applies to both developers and deployers. Enforced by Colorado Attorney General.
- Texas Responsible Artificial Intelligence Governance Act (TRAIGA) (HB 149; effective 2026): Requires consumer notifications, anti-discrimination measures, and disclosure of training data and performance metrics to the Texas Attorney General upon request. Applies to developers and deployers of high-risk AI systems.
- Utah AI Policy Act (SB 149, Effective May 2024): Requires disclosure when consumers interact with generative AI rather than humans in regulated professions (healthcare, legal, financial). Extends existing consumer protection principles to AI-driven conduct.
- California AI Laws (Various, 2023–2025): Multiple laws including AB 2013 (GenAI training data documentation), SB 942 (consumer disclosure for generative AI interactions), and CCPA/CPRA provisions governing automated decision-making technology and profiling.
VIII. AI Agreement Drafting Checklist
When drafting or reviewing AI-related commercial agreements, practitioners should consider whether the agreement adequately addresses the following:
- Output Ownership: Does the agreement clearly allocate ownership of AI-generated outputs, regardless of copyright eligibility? Are license rights specified?
- Model and Training Data Rights: Who owns the underlying model? Can the vendor use customer data or outputs to improve its models? Are there restrictions on training data sources?
- IP Indemnification: Does indemnification expressly cover AI outputs and model predictions? Are there appropriate exclusions for customer modifications or misuse?
- Accuracy and Performance: What warranties (if any) does the vendor provide regarding output accuracy? Are there service levels or remedies for performance failures?
- Data Privacy Compliance: Does the agreement address data processing obligations, including CCPA/CPRA rights and automated decision-making disclosures?
- Regulatory Compliance Cooperation: Are there provisions requiring the vendor to support the customer's compliance with emerging AI regulations (impact assessments, bias audits, consumer disclosures)?
- Security Incident Response: Do breach notification provisions cover AI-specific incidents such as model compromise, data poisoning, or adversarial attacks?
- Audit and Transparency Rights: Can the customer audit the vendor's AI systems for bias, accuracy, or regulatory compliance? What documentation must the vendor provide?
- Liability Allocation: Are liability caps appropriate for AI-specific risks? Are there carve-outs for IP infringement, data breaches, or willful misconduct?
IX. Conclusion
The intersection of AI technology with IP, data privacy, and emerging regulatory frameworks demands careful attention in commercial agreements. Both providers and customers benefit from proactive contract drafting that addresses these issues explicitly rather than relying on traditional technology agreement templates that may not adequately address AI-specific risks. Looking ahead to 2026 and 2027, practitioners should anticipate continued state legislative activity, potential federal preemption battles, increased enforcement of existing AI laws such as NYC Local Law 144, and the phased implementation of the EU AI Act's high-risk system requirements. As both the technology and the legal landscape continue to evolve, parties should revisit these provisions regularly to ensure continued alignment with best practices and legal requirements.