AI, Copyright and the Emerging IP Liability Gap

As businesses integrate artificial intelligence into their products and operations, an important question is emerging: if AI creates an intellectual property claim, who ultimately owns the risk?

Download this article as a Whitepaper

In September 2026, the U.S. Court of Appeals for the Third Circuit upheld a significant copyright decision involving Thomson Reuters and legal technology company ROSS Intelligence.

ROSS had used thousands of copyrighted Westlaw headnotes in developing an AI-powered legal research platform that competed with Westlaw. The court concluded that ROSS’s use was not protected by the fair-use doctrine. It was the first U.S. federal appellate decision addressing fair use in the context of AI training.

The decision is important, but it should not be interpreted as establishing that training generative AI on copyrighted material is inherently unlawful. ROSS’s technology was not generative AI, and the court emphasized that ROSS used Thomson Reuters’ materials to develop a directly competing product for a highly similar purpose.

The broader significance is harder to ignore: using AI does not make traditional intellectual property laws disappear. And the resulting exposure is no longer confined to the companies developing foundation models.

AI Is Creating a Chain of Intellectual Property Risk

Consider how generative AI is increasingly delivered to businesses:

A foundation-model provider develops an AI model. A software company integrates that model into its own application. An enterprise customer purchases the software and uses the resulting AI functionality in its
business.

The relationship can look something like this:
AI Model Provider → Software Company → Enterprise Customer → End User

Now consider what happens when someone alleges that copyrighted material has been used improperly or that AI-generated content infringes their intellectual property.

The claim can move in the opposite direction:
IP Owner → Enterprise Customer → Software Company → AI Model Provider

Contracts, and particularly intellectual property indemnities, determine how much of that liability can actually move back up the chain.

“Has the software company promised its customers broader IP protection than it receives from its own AI provider?”

Consider a Software Company Integrating a Third-party AI Model

A SaaS company incorporates the OpenAI API into its platform to generate marketing copy, software code, reports or other content for its customers.

The SaaS company did not train the underlying foundation model. But that does not necessarily remove it from an IP dispute.

If a customer is sued over allegedly infringing content generated through the SaaS platform, the customer may look to its software provider for protection, particularly if its contract contains an IP indemnification provision.

The software company may then look upstream to its agreement with the AI provider.

OpenAI, for example, currently provides API customers with indemnification for certain third-party claims alleging that the customer’s use or distribution of model output infringes intellectual property rights. But that protection has conditions and exclusions, including circumstances involving customer inputs or fine-tuning data, modification of outputs, combination with other products or services, and failure to use relevant safeguards.

That creates an important contractual question:

Has the software company promised its customers broader IP protection than it receives from its own AI provider?

If so, the software company may retain the difference.

Major Technology Companies Are Already Treating This As a Real Commercial Risk

The significance of this issue can be seen in how some of the world’s largest technology companies have structured their AI offerings.

Microsoft’s Customer Copyright Commitment provides protection to qualifying commercial customers facing certain copyright claims arising from their use of Microsoft’s Copilot products or generated outputs. Microsoft has said it will defend covered customers and pay covered judgments or settlements, subject to conditions including use of required guardrails and content filters.

Google has taken a similar approach. Its generative AI terms address two distinct exposures: allegations arising from Google’s use of training data to create its pre-trained models and certain allegations that generated output infringes third-party intellectual property rights. Those protections are also subject to important conditions and exclusions.

These contractual commitments are significant. They demonstrate that copyright exposure associated with generative AI is not simply a theoretical legal issue. Major AI providers are explicitly addressing who will bear that risk when customers use their technology.

But an indemnity does not necessarily eliminate the exposure. Its value depends on its wording, exclusions, liability caps and the financial resources of the company providing it.

A contractual promise from Microsoft or Google also may be very different economically from the same promise made by an early-stage technology company.

Three Different IP Exposures

Companies developing or deploying AI should distinguish between three related but different risks.

Training and fine-tuning risk

Did the company, or its AI provider, have appropriate rights to the code, images, text, data or other material used to train, customize or fine-tune the model?

Output risk

Could AI-generated code, text, images or other content infringe somebody else’s copyright, trademark or other intellectual property rights?

Contractual risk

What IP representations and indemnities has the company provided to its customers, and how do those obligations compare with the protection it receives from its own vendors? The third issue can easily be overlooked.

A software company’s underlying AI provider might offer a relatively narrow indemnity while the software company’s enterprise customers demand a substantially broader one. The result is an indemnification gap that leaves the software company retaining an exposure it may not have intended to
assume.

“You do not have to develop an AI model to have AI-related intellectual property exposure.”

Where does insurance fit?

Many technology companies carry Technology Errors & Omissions insurance and may assume that an AI related IP claim will automatically fall within that policy. That assumption should be tested.

Technology E&O policies vary significantly in their treatment of intellectual property. Coverage can be affected by IP exclusions, contractual-liability provisions, limitations on particular categories of IP, the nature of the allegedly infringing activity and the extent to which liability exists because of an indemnification obligation assumed under contract.

There can therefore be an important difference between having some intellectual property protection embedded within a Technology E&O policy and having insurance specifically designed around intellectual property risk.

This is where standalone IP insurance deserves consideration. Depending on the policy and insurer, standalone IP coverage can provide dedicated limits for defending infringement allegations and responding to covered damages or settlements. Coverage may also be available for pursuing parties that infringe the insured’s own intellectual property.

Dedicated limits can be particularly important because IP litigation can be expensive long before a court determines who is ultimately right.

ROSS Intelligence provides a striking example. The company ceased operations in 2021, citing the cost of its litigation with Thomson Reuters, years before the appellate court issued its 2026 decision.

For a technology company, the financial threat may not simply be a multimillion-dollar judgment. The cost of defending a complex IP dispute for several years can itself become a material balance-sheet event.

Five questions businesses should be asking

As AI becomes embedded throughout technology products and business operations, companies should understand where they sit within this emerging chain of liability:

1. Do we know what AI models are incorporated into our products and what rights and indemnities we receive from those providers?
2. If we faced several years of IP litigation, do we have sufficient dedicated insurance available to fund the defence?
3. What IP representations and indemnities are we providing to our own customers, and are they broader than the protection we receive upstream?
4. How would our existing Technology E&O insurance respond to an allegation involving AI training, finetuning or generated output?
5. If we faced several years of IP litigation, do we have sufficient dedicated insurance available to fund the defence?

Closing Perspective

The Thomson Reuters decision does not resolve the broader legal debate surrounding copyright and generative AI. It does reinforce a more immediate commercial reality: You do not have to develop an AI model to have AI-related intellectual property exposure.

Companies increasingly sit somewhere in a chain connecting AI developers, software providers and enterprise users. Contracts attempt to allocate that risk among the parties, but contractual indemnities do not always align, and insurance policies do not necessarily follow the contractual allocation of liability.

As organizations increase their use of AI, understanding where that liability ultimately stops, and whether sufficient insurance stands behind it, should become part of both their AI governance and insurance strategy.

Download this article as a Whitepaper

---