AI Law: What Every Creator & Founder Needs to Know

Not automatically. The US Copyright Office confirmed in its January 2025 report that AI outputs qualify for copyright protection only where a human author has made sufficient creative contributions. Writing a text prompt does not meet that threshold. The work produced by the AI itself, based solely on a prompt, is not copyrightable. What does qualify: a human who makes substantive creative decisions about the selection, arrangement, or modification of AI-generated elements can claim copyright in those contributions. The key is that the human creative input must be identifiable and significant. A photographic composition assembled from dozens of AI outputs, where the human made deliberate selection and sequencing choices, may be protectable. The output of a single prompt run once is almost certainly not. This matters practically for creators using Midjourney, DALL-E, Suno, or any generative tool commercially. If your business depends on exclusivity, the unmodified output of a generative AI tool cannot provide it. Anyone can reproduce what you created because there is no copyright to enforce. The solution is to build human creative input into the workflow in a documented, deliberate way. In Canada and the EU, the legal analysis differs in some respects, but the core principle is similar: human authorship is required for copyright to attach.

Platform terms of service assign output ownership to users, but only to the extent the law allows. Midjourney grants paid subscribers ownership of outputs to the fullest extent possible under applicable law. OpenAI assigns outputs to the user. Adobe Firefly does the same. These assignments protect you from the platform making ownership claims, but they cannot create rights that copyright law does not recognize. If the law says the output is not copyrightable, the platform cannot override that through its terms. You can use the output commercially under the platform's license, but you cannot stop others from copying it because without copyright, you have no exclusive rights to enforce. The critical practical distinction: free tier users of most platforms face more aggressive training data rights than paid users. Many platforms claim a perpetual, royalty-free license to use inputs and outputs for model improvement in their free tiers. Midjourney, for example, grants itself this license over all content. If you are feeding proprietary work, client materials, or sensitive information into a free-tier tool, you may be contributing it to the platform's training pipeline. Enterprise agreements with platforms like OpenAI and Anthropic typically include stronger protections and IP indemnity clauses. If this matters to your business, enterprise tier is not optional.

Yes. Trademark law and copyright law answer different questions. Copyright asks who created the work. Trademark law asks whether a mark functions as a source identifier in commerce. Copyright concerns are not a barrier to trademark registration. An AI-generated logo can be registered as a trademark as long as it meets the standard requirements: it must be distinctive, it must be used in commerce, and it must not conflict with existing marks. The fact that a human did not author it in the copyright sense is irrelevant to whether it functions as your brand's identifier in the marketplace. That said, there is a disclosure consideration. The US Copyright Office requires disclosure of AI-generated content in copyright registrations, and some trademark offices are beginning to ask similar questions. The legal landscape on disclosure requirements for AI-assisted marks is still developing. The more important practical concern is clearance. An AI-generated logo is statistically likely to have visual similarities to marks already in existence, because generative models are trained on existing visual data. Before building brand equity around an AI-generated mark, a professional trademark clearance search is not optional. The risk is not just registration refusal — it is building a brand for years on a mark that someone else already owns.

Unsettled, and the answer depends on the specifics. The Bartz v. Anthropic ruling from June 23, 2025, established that training on lawfully acquired books was quintessentially transformative and therefore fair use. The same ruling drew a sharp line: training on 7 million pirated books from datasets like LibGen was not fair use. The court was explicit that no provision of the Copyright Act permits AI companies to avoid paying for material they could have lawfully obtained. The US Copyright Office's May 2025 report (Part 3) went further, concluding that AI outputs that closely resemble and compete with original works in their existing markets go beyond the scope of fair use. This is the clearest guidance yet that model outputs matter, not just training inputs, in the fair use analysis. For creators: if your work was scraped without permission and the resulting model competes with your output in your market, you have arguable claims. The wave of class action suits from independent musicians in 2025 reflects exactly this theory. For AI founders: if your model was trained on unlicensed scraped content, the legal exposure is real and growing. The direction of litigation and regulation both point toward licensed acquisition as the sustainable model. Warner Music, Universal Music, and Getty Images are all pursuing licensing arrangements alongside or following litigation.

The answer depends on your jurisdiction, and laws are changing fast. California enacted a significant package of laws in 2025. AB 1836 extended right of publicity protections to deceased personalities, prohibiting unauthorized AI-generated voice or likeness replicas in media without estate approval, with damages up to $10,000 per violation. AB 2602 voids contract clauses that grant broad digital replica rights without detailed disclosure, legal counsel, or union oversight. SB 926 made the creation and distribution of sexually explicit deepfakes a criminal offense. Tennessee's ELVIS Act, effective July 2024, prohibits unauthorized AI voice clones of performers and extends liability to tool providers and platforms. At the federal level, the NO FAKES Act was reintroduced in April 2025 and would create a nationwide property right in voice and likeness. As of mid-2026 it has not been enacted. In Quebec, right of personality claims under the Civil Code of Quebec provide some protection against unauthorized use of name, image, and likeness. Canada has no federal deepfake-specific legislation. The practical conclusion: if you are a performer, musician, creator, or any public figure, unauthorized commercial deepfakes and voice clones are increasingly legally actionable, particularly in California and Tennessee. If you have been asked to sign a digital replica agreement, get it reviewed before signing. Rights granted contractually may be difficult to reclaim.

More than most users realize. The critical clause to find in any AI tool's terms is the license grant over your inputs. Most platforms claim at minimum a broad license to use your inputs for model improvement. Midjourney grants itself a perpetual, worldwide, non-exclusive, sublicensable, royalty-free copyright license to use all inputs and outputs run through its service. Free users have no commercial rights to outputs and grant Midjourney full use of inputs for training. Paid subscribers have commercial rights to outputs but still grant training licenses unless in an enterprise agreement. OpenAI allows users to opt out of their content being used for training through API and enterprise settings. ChatGPT free and Plus users may find their conversations used for training unless manually disabled in settings. Adobe Firefly was trained exclusively on licensed and public domain content, and Adobe does not claim training rights over user inputs. This makes it a meaningfully different risk profile for professionals feeding proprietary work through an AI tool. The broader point: if you are inputting client information, confidential business data, proprietary creative work, or anything sensitive into a consumer-tier AI tool, those inputs may be retained and used. Read the data usage and training sections of the terms, not just the ownership sections. Enterprise agreements consistently offer stronger protections on both fronts.

Five clauses have become the primary risk areas as AI use in professional services has normalized. First, IP ownership of outputs: when a vendor or contractor delivers AI-generated work, who owns it? Traditional work-for-hire provisions were not written for this scenario. The contract must explicitly address whether AI-generated elements are assigned to the client or licensed, and under what terms. Second, training data representation: contracts involving AI-generated deliverables should require the vendor to represent that the underlying model was trained on licensed or otherwise lawfully acquired data. If that representation is false and a third party brings an infringement claim, indemnification provisions determine who bears the exposure. Third, disclosure obligations: is the vendor required to disclose when AI was materially used? Many professional engagements, and an increasing number of platform terms, now require this. Fourth, indemnification allocation: if AI output infringes a third party's rights, which party is liable? Without explicit language, this will be litigated. Clear indemnification clauses shift liability to the party that introduced the AI element. Fifth, no-training-on-your-data clause: if you are sharing proprietary materials with a vendor who uses AI tools, require a contractual commitment that your inputs will not be used to train any model. This is a standard red line in enterprise AI agreements and should be in vendor agreements generally.

The answer depends on where your users are located, not just where your company is incorporated. California: The CCPA/CPRA applies to any company meeting the size and data volume thresholds, regardless of where it is headquartered. The California Privacy Protection Agency finalized new automated decision-making regulations in July 2025. If your product uses automated decision-making for significant decisions — employment, credit, housing — you must provide pre-use notice and honor opt-out rights. Annual privacy risk assessments are required for high-risk processing, with submission to the CPPA beginning April 2028. Quebec: Law 25 is in full effect. Any business operating in Quebec or targeting Quebec users must comply with mandatory consent requirements and must notify individuals when decisions are made exclusively through automated processing. Privacy impact assessments are required for new systems. European Union: GDPR applies if you process data of EU residents. The EU AI Act adds additional requirements depending on how your AI system is classified. General-purpose AI model providers faced new obligations from August 2, 2025. Canada (federal): Bill C-27 and AIDA died in Parliament in January 2025 when Parliament was prorogued. Canada currently has no federal AI-specific law. PIPEDA, Canada's federal privacy law from 2000, applies to commercial activities but predates AI-era concerns.

The EU AI Act applies to any company placing an AI system on the EU market or whose AI output is used within the EU, regardless of where the company is incorporated. A US startup with European users, a Canadian AI company with an EU-facing product, and a creator selling AI-generated content in Europe are all potentially within scope. The Act has been taking effect in stages since February 2, 2025, when prohibitions on unacceptable-risk AI practices came into force. Obligations for general-purpose AI model providers began August 2, 2025. Full applicability for high-risk AI systems and transparency requirements arrives August 2, 2026. Risk classification determines your obligations. High-risk systems — those used in employment, education, critical infrastructure, biometrics, and similar domains — face the strictest requirements: conformity assessments, technical documentation, human oversight mechanisms, and registration requirements. General-purpose AI models above certain capability thresholds face transparency and copyright compliance obligations. Non-EU companies are required to appoint an EU authorized representative if they have no EU establishment. Fines reach up to EUR 35 million or 7% of global annual turnover for the most serious violations.

Liability depends on the type of harm and the jurisdiction, and the law is still developing in most categories. For intellectual property infringement: the party that used the AI to generate and publish the infringing content bears primary exposure, not the AI platform. Platform terms of service typically indemnify the platform and shift liability to the user. If a freelancer delivers AI-generated copy that infringes a third party's work, the client who published it and the freelancer who created it both face potential exposure. The AI company generally does not. For defamation from AI-generated false statements: this is actively litigated. Traditional defamation law applies to the person or organization that published the false statement. Whether AI platforms have Section 230 immunity for AI-generated content is contested in US courts as of 2026. For AI-generated deepfakes causing reputational or emotional harm: California's SB 926 creates direct criminal liability for creators of sexually explicit deepfakes. Civil liability for other unauthorized deepfakes depends on right of publicity and defamation theories. For harms from AI-assisted decisions in products — medical tools, financial advice, autonomous systems: both the AI developer and the company deploying the system face potential product liability exposure. The EU AI Act explicitly addresses liability allocation in high-risk AI systems.

When the stakes attached to an AI question are real enough that getting it wrong has material consequences. You are building a product that generates, uses, or distributes AI-generated content commercially. You are negotiating or reviewing a contract that includes AI clauses, digital replica rights, or training data representations — and these appear in contracts across creative, tech, and entertainment industries now. You have received a cease and desist or a copyright claim related to AI-generated work. You trained a model on third-party content and need to understand your exposure. Your business is subject to the CCPA automated decision-making rules, Quebec's Law 25, or the EU AI Act. You have been asked to sign a voice cloning or digital replica agreement. You are a creator who believes your work was used to train an AI model without your consent. The common thread is that these are not situations where general legal advice is adequate. The intersection of copyright, privacy, contract, and the rapidly evolving regulatory landscape requires someone who follows this area closely — not someone who reads a summary of it once a year.

2025 produced the first major court decisions on AI training and copyright, shifting the conversation from speculation to precedent. Bartz v. Anthropic (June 23, 2025, Northern District of California): The court found that training on lawfully acquired books was fair use. Crucially, it also found that training on 7 million pirated books from LibGen was not fair use and that no provision of the Copyright Act creates an exception for AI companies. The case certified as a class action and settled in August 2025. Kadrey v. Meta reached a similar conclusion on the same date — legally acquired training data can constitute fair use. What these cases mean: legal acquisition is now the threshold. The argument that scraping publicly available content is categorically fair use received no support from these rulings. AI companies training on pirated or unlicensed data face material litigation risk. Music industry: Warner Music Group settled with Suno and signed a licensing deal. Universal Music settled with Udio. Sony's case against Udio is ongoing. The music industry's movement toward licensing signals that unlicensed training on commercially released recordings is not expected to survive sustained litigation. Getty Images v. Stability AI (UK, November 2025): The UK High Court rejected Getty's secondary copyright infringement claim for scraping, but the ruling was narrowly decided and left open significant questions. US Copyright Office Part 3 (May 2025): AI outputs that compete with the original works they were trained on do not qualify as fair use. This is the clearest guidance yet that model outputs matter, not just training inputs, in the fair use analysis.