AI IP ownership: who owns what you create with AI.
Enterprises are embedding generative AI into revenue products, yet the contracts rarely say who owns the output. This note dissects copyright eligibility, the three vendors' output and training positions, indemnity scope, and the clause language that keeps your organisation's IP defensible.
Owning AI output is not the same as being able to defend it. Copyright attaches only where a human contributes real creative direction; vendor terms diverge sharply on whether they train on your inputs; and indemnities are riddled with carve-outs. Treat output ownership and data isolation as non-negotiable, and force fine-tuned model ownership and broad-scope indemnity into every material AI contract.
01 Key findings
Ownership and copyright are different rights. A vendor can assign you "the output" while that output remains uncopyrightable — unprotectable against scraping or competitors — because it lacks human authorship.
Training rights are the quiet risk. Unless you secure data isolation, proprietary inputs and outputs can flow into a vendor's training corpus and inform models your competitors then use.
The three vendors are not interchangeable. OpenAI is the most customer-friendly on ownership and indemnity; Google retains broad training rights by default; Microsoft assigns output but carves out open-source material.
Fine-tuned models are underprotected. You may invest millions adapting a model, then find the vendor retains rights to the process and outputs — eroding the advantage you paid for.
Every indemnity has limits. Caps, modification exclusions and open-source carve-outs mean a headline indemnity can leave your true exposure uncovered.
02 Copyright eligibility
The foundational question is deceptively simple: is AI-generated output copyrightable at all? The answer from the U.S. Copyright Office and emerging case law is qualified — pure AI output without human creative contribution may not qualify. The March 2023 guidance held that copyright requires "human authorship"; material generated solely by a system does not qualify, but a human who selects, arranges, edits or significantly directs the system may qualify the resulting work.
This creates a spectrum, not a binary. Output entirely composed by a model without human editing is probably not copyrightable; a document where a human prompt-engineered, edited and made structural decisions is likely copyrightable with the human as author; a legal memo a lawyer reviewed, validated and augmented with original analysis is almost certainly protected.
Publish AI-generated content without human authorship review and it may be uncopyrightable — indefensible against competitors, unprotectable against scraping, and free for others to reuse. Vendor contracts must address this explicitly, because assignment of "output" does not create copyright where none exists.
03 Vendor output positions
The three largest vendors take markedly different positions on output ownership and training rights, each with distinct commercial consequences. Match the vendor posture to how sensitive your inputs are and whether you can pay for isolation.
| Vendor | Output ownership | Training on your data | Copyright indemnity | Key limitation |
|---|---|---|---|---|
| OpenAI | Assigned to customer | Not used unless opt-in | Broad; covers core outputs | Excludes materially modified outputs; not embeddings |
| Commercial licence to use | Retained by default; isolation at higher tier | Specific service tiers only | Data isolation typically needs >$500k annual spend | |
| Microsoft | Assigned to customer | Not used without opt-in | Copilot Copyright Commitment | Open-source training material carved out |
OpenAI: you own outputs, your data is isolated, we defend copyright claims. Google: you have a licence to use outputs, and we may train on your data unless you pay extra. Microsoft: you own outputs and we defend copyright claims — except where a Copilot output reproduces open-source material from the training corpus.
04 Fine-tuned model ownership
Output ownership is only half the story. The second battleground is the fine-tuned model. When you adapt a vendor model with proprietary training data, custom examples and domain language, who owns the resulting weights and parameters? The answer is vendor-dependent and often contractually unclear.
OpenAI's fine-tuning service grants customers ownership of the fine-tuned weights: you deploy it, run it in production and restrict access. Google Vertex AI and Microsoft Azure OpenAI Service are less transparent — weights are typically owned for deployment, but the vendor retains rights to use the fine-tuning process and outputs to improve its own services. If your model embodies proprietary customer, manufacturing or competitive-intelligence data, vendor-retained rights quietly erode the advantage you invested in.
Feed proprietary information into a training-enabled system and it can inform future models that competitors access. In 2024, organisations found proprietary code and business logic fed into enterprise Copilot influenced model behaviour in ways that leaked organisational patterns. Demand no-training commitments, regional data residency, audit rights, and permanent deletion.
05 Indemnity scope
A copyright indemnity is the vendor's commitment to defend and indemnify you against third-party infringement claims. It matters here because training data includes vast copyrighted material, and outputs can resemble or reproduce it. But scope varies dramatically — and no indemnity is unconditional.
| Indemnity tier | What it covers | Typical exclusions | Who offers it |
|---|---|---|---|
| Broad | All copyright claims related to your outputs | Customer modifications; customer-supplied training data | OpenAI |
| Narrow | Only where output matches vendor-provided training data | Open-source, user-provided or third-party material | Google (specific tiers), Microsoft (open-source carve-out) |
| None | No commitment; customer bears all risk | Everything | Many smaller vendors |
Every indemnity contains caps on liability, exclusions for customer modifications, and reasonable-security requirements. An indemnity capped at $10M against $100M of exposure provides false comfort — model the cap against your realistic worst case, not the headline promise.
06 Contract traps
The recurring failures we see in enterprise AI agreements are less about missing clauses than about clauses that read well but do nothing. Watch for these.
Vendors assign "output" while staying silent on copyright, commercial use rights, or training rights. You can own something you cannot defend. Insist the assignment names all three.
Silence on training usually means the vendor retains the right to use your inputs. Isolation is an add-on, often gated behind a spend threshold. Make no-training the default, in writing.
An indemnity that excludes open-source training material leaves code-generation outputs exposed to the very claims most likely to arise. Price that gap before you rely on the commitment.
Liability caps far below your exposure, or aggregate caps across all claims, convert an indemnity into theatre. Push for per-claim treatment and caps sized to real risk.
07 Negotiation checklist
Five clauses turn a standard AI contract into a defensible one. Work them in this order; the first two are where sensitive deployments live or die.
Exclusive output assignment
Vendor assigns all right, title and interest in output to the customer, who may use, modify, publish and commercialise it — regardless of later modification or integration.
Data isolation & training ban
Vendor shall not use input, output or derivatives to train, improve or develop any model, feature or service without explicit written consent — extended to affiliates and partners.
Broad-scope indemnity
Vendor defends and indemnifies against third-party copyright, patent or trade-secret claims on output, with a stated cap and no aggregate cap across claims.
Fine-tuned model ownership
Any model, weights or derivative created by fine-tuning on customer data is owned exclusively by the customer; vendor retains only support-and-maintenance access.
Deletion & audit rights
Vendor deletes all customer data within 30 days of request or termination, certifies deletion in writing, and grants quarterly audit access to verify isolation and compliance.
08 Our recommendation
You want the current gold standard — output assignment, training isolation and broad indemnity in one package. Confirm the indemnity's core-output scope and note the modification exclusion before relying on it.
You have the scale to reach the data-isolation tier and the discipline to negotiate it. Without that tier, assume your inputs train Google's models — unacceptable for sensitive IP.
You value output assignment plus the Copilot Copyright Commitment across users and enterprise. Price the open-source carve-out carefully if you generate code at scale.
09 Negotiation priorities
Not every buyer can move a hyperscaler off standard terms. Sequence your asks so the non-negotiables come first and the tail-risk protections follow.
Tier 1 Non-negotiable
Output ownership assignment and data isolation. Without these, the contract is unacceptable for any sensitive use case — walk before you sign around them.
Tiers 2–3 Push hard
Copyright indemnity with adequate caps and deletion rights (now table-stakes at enterprise scale), then fine-tuned model ownership, audit rights and no-aggregation caps. Enterprise tiers cost 30–50% more — justified by the IP you protect.
Strengthen your AI contracts
Our AI Procurement Advisory practice reviews vendor terms, identifies IP risk, and leads negotiation to secure output ownership, isolation and indemnity.
The Licensing Edge
Weekly AI and licensing intelligence for enterprise IT leaders. 3,000+ subscribers.