Protecting your commercial data and IP when using AI

Copyright is one of the most ubiquitous and long-established forms of intellectual property and can exist in anything from artistic works to software and web content, and digital media assets and publications. The right extends to business materials such as written strategy, internal policies, company and product data, contracts and marketing materials. The rights arise automatically on creation of the relevant material and give the rights holder the right to stop others from copying, publishing or monetising that material (or part of it) without permission.

How these rights can co-exist in the world of AI models is a core legal and commercial issue in the AI revolution. Should training of AI, which relies on large volumes of data and materials to power the ‘intelligence’ behind the model’s outputs, be exempt from copyright law as a form of ‘fair dealing’? For businesses, leveraging the efficiencies AI can offer whilst protecting your know-how and avoiding infringements can be a minefield.

When can we expect clear laws on the use of copyright in AI?

Since Getty withdrew its claim against Stability AI and as the Data (Use and Access) Act 2025 was passed without addressing the questions of AI and copyright*, ambiguity as to the legal position regarding use of copyrighted materials in training AI continues. The government launched a Consultation on Copyright and Artificial Intelligence in February 2025 and is required to publish a technical report on its copyright and AI proposals and an economic impact assessment of the four policy options proposed in that consultation by February 2026. Formal reform of UK copyright law is unlikely to be advanced before these documents are released, much to the chagrin of the creative industries.

The key tension for the government to navigate is how to support AI innovation while recognising the value of original effort. The government’s favoured policy option appears to be to permit data mining for AI development unless the copyright owners have explicitly reserved their rights. This is consistent with the approach currently being developed in the EU, however, in the US and Singapore, broader data mining exceptions to copyright law have been introduced. The international landscape is important as how materials may be used may vary according to where they were created and where the AI is used. In the meantime, businesses using and/or developing AI should consider carefully whether materials inputted into AI models are subject to copyright. 

How can businesses navigate this in the meantime?

Until a formal legal framework is in place, business owners should be alert to the risks inherent in the use of AI, both to their own data and of infringing another party’s rights. Businesses should implement governance measures and cascade a clear policy on use of AI to safeguard against know-how loss and infringements. This might include:

• Labelling and rights reservation: Ensure all materials created in the business are copyrighted to your business and rights reserved.
• Review platform terms and security: Establish how any data that you input into or use to train an AI model will be stored and used after the point of input. Does your business  retain all rights? Is the platform secure? Will your data be kept confidential? This is particularly important if the source data is commercially sensitive and/or includes personal data.
• Ensure rights to input: If training or interrogating an AI model, ensure that you have appropriate rights to submit content and materials for that purpose.
• Verify rights in output: Check how outputs generated on the platform will be owned. Are they subject to third party rights? Is verifying prior rights in source data something for which the platform assumes or disclaims responsibility? Be aware that giving credit to the original owner(s) may not be sufficient to prevent infringement.
• Check outputs: AI outputs do not come with any guarantee of accuracy or currency. Information may be out of date, derived from incorrect input material and even contain ‘hallucinations’ created by the AI model. Keeping a human in the loop to quality check materials created is essential.
• Consider context: The risk profile will vary accordingly to the type of output being created and how it will be used within your business (internally or externally). 
• Educate: Ensure teams are aware what AI-tools and use cases are and are not permitted, and the risks of non-compliance.

For previous tips on AI governance, please see our earlier article Generative AI: The legal risks for businesses worldwide.

If you need advice on use of AI in your business and how it impacts your intellectual property rights, please get in touch with our Commercial and Technology lawyers at [email protected].

*The House of Lords’ had sought to escalate the issue in the parliamentary agenda via the Data Use and Access Act while it was in parliamentary ping-pong. The Lords’ proposed that AI companies should be required to disclose the materials used to train their models and to obtain copyright holders’ permission for that use. The proposed amendments did not, however, make it into the final form of the Act.