Artificial intelligence and the law now intersect in almost every area of civil and commercial life, but no single statute governs it. Courts and regulators are working through AI questions with the tools they already have: copyright and patent doctrine, product liability, privacy statutes, antidiscrimination law, evidence rules, and, in the European Union, a purpose-built regulation. The result is a fast-moving and often inconsistent set of rules that can shift while a dispute is still in progress.
Who Owns What AI Creates
Copyright Requires a Human Author
Under U.S. law, only a human being can author a copyrighted work. The D.C. Circuit affirmed that rule in Thaler v. Perlmutter, holding that “the Copyright Act of 1976 requires all eligible work to be authored in the first instance by a human being.”1United States Court of Appeals for the District of Columbia Circuit. Thaler v Perlmutter The Supreme Court declined to review the case in March 2026.2Supreme Court of the United States. Stephen Thaler, Petitioner v Shira Perlmutter, Register of Copyrights
The practical consequence is straightforward. Output generated purely by AI, with no meaningful human creative input, cannot be copyrighted and can be used by anyone. Protection reappears when a person exercises genuine creative control. The Copyright Office’s 2023 guidance draws the line based on whether “the human had creative control over the work’s expression and actually formed the traditional elements of authorship.”3Federal Register. Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence Selecting and arranging AI output creatively, or heavily editing it, can qualify. An applicant must disclose which portions were AI-generated and exclude those from the claim.
Patents Follow the Same Rule
Federal law defines an inventor as “the individual… who invented or discovered the subject matter of the invention,” and the Federal Circuit held in Thaler v. Vidal that “Congress has determined that only a natural person can be an inventor, so AI cannot be.”4Office of the Law Revision Counsel. 35 USC 100 – Definitions5United States Court of Appeals for the Federal Circuit. Thaler v Vidal AI-assisted inventions are still patentable if a human contributes the inventive concept. USPTO guidance treats AI systems as tools that “do not qualify for or elevate such assistance to inventor status.”6United States Patent and Trademark Office. Revised Inventorship Guidance for AI-Assisted Inventions Pressing “generate” is not enough.
Training Data and Fair Use
Whether copyrighted works can be used to train AI models without a license is unresolved. Early rulings have split. In Thomson Reuters v. Ross Intelligence, a court found in 2025 that copying Westlaw headnotes to train a competing legal AI was not fair use. In Kadrey v. Meta, a different court held that training a large language model on copyrighted books was transformative and qualified as fair use, even where the copies came from pirated sources.
Bartz v. Anthropic settled in 2025 for $1.5 billion after a court concluded that training itself was fair use but that storing pirated copies for the purpose of training was not. Litigation against OpenAI continues, with a court ordering disclosure of tens of millions of internal logs in early 2026. No appellate court has issued a definitive ruling, so the ground under AI training is genuinely unsettled.
Who Pays When AI Causes Harm
Negligence and Product Liability
When an AI system injures someone or causes financial loss, the first challenge is identifying the defendant. Responsibility can run from the company that built the model, to a firm that fine-tuned it, to the business that deployed it, to the user who relied on the output. Traditional negligence requires proof that a particular actor failed to use reasonable care and that failure caused the harm, and locating that actor in the AI chain is often the hardest part of a case.
Strict product liability offers a simpler path for physical injuries. If a court classifies the AI system as a product, the manufacturer can be held responsible for design defects or inadequate warnings regardless of care taken. Whether AI software counts as a “product” the way a brake pad does has not been settled uniformly, and the answer determines whether a plaintiff must prove negligence or only a defect.
The Black Box Problem
Modern neural networks make decisions through processes their own creators cannot fully explain. When a model denies a loan, flags a person as a risk, or steers a vehicle into an obstacle, the reasoning is buried in millions of parameters. Plaintiffs need to show causation and defendants need to show their systems worked properly, and neither side can easily point to the decision that went wrong. Courts are still working out how much transparency AI developers must provide in discovery, particularly when the developer asserts trade secret protection.
Section 230 and Generative Output
Section 230 of the Communications Decency Act has long shielded online platforms from liability for user-generated content. Generative AI blurs that framework, because chatbot output blends user prompts with the platform’s own trained model. When a system produces defamation, fabricates citations, or generates harmful instructions, identifying the “speaker” is not simple. As of early 2026, no court has ruled on whether Section 230 protects AI developers from liability for their models’ outputs.7Library of Congress Congressional Research Service. Section 230 Immunity and Generative Artificial Intelligence The first decisions will shape liability across the industry.
Privacy and the Data That Trains the Models
Training a large model requires enormous volumes of data, and much of it contains personal information. The EU’s General Data Protection Regulation and the California Consumer Privacy Act both require a legal basis for collecting and processing personal data. Scraping personal information from the internet without authorization risks violating those rules even where the scraping is technically simple.
Both frameworks give people the right to have their data deleted or corrected. The GDPR’s “right to erasure” is particularly difficult to honor once personal data has been absorbed into a model’s parameters. A trained model does not store data the way a database does; it captures statistical patterns. Techniques like machine unlearning exist, but there is no reliable standard yet.
Penalties are substantial. GDPR fines can reach 4% of a company’s total worldwide annual revenue or €20 million, whichever is higher. CCPA penalties are assessed per violation and adjusted annually for inflation. A single compliance failure affecting thousands of people can generate cumulative fines in the hundreds of millions.
Employment Discrimination by Algorithm
AI-powered hiring tools now handle résumé screening, video interview analysis, and candidate ranking at many employers. Title VII of the Civil Rights Act applies to those tools the same way it applies to a human manager. The EEOC has confirmed that unjustified disparate impact based on race, sex, age, or other protected characteristics can arise from decisions made or influenced by AI.8U.S. Equal Employment Opportunity Commission. What Is the EEOCs Role in AI
In Mobley v. Workday, a federal court in California allowed disparate impact claims to proceed against Workday’s AI screening tools, accepting the argument that Workday acted as an agent of the employers who delegated hiring decisions to its software. The ruling opens the door to holding AI vendors, not just employers, liable for discriminatory outcomes.
State and local regulation is moving faster than federal law. Colorado’s AI Act, effective February 1, 2026, requires any company deploying a “high-risk” AI system to use reasonable care to prevent algorithmic discrimination and mandates impact assessments, annual reviews, consumer notifications, and the opportunity to appeal adverse decisions through human review. Other jurisdictions have adopted or proposed bias audit requirements for automated hiring tools. The trend is toward requiring companies to prove their systems do not discriminate.
Where Regulation Stands
The EU AI Act
The European Union’s AI Act is the most comprehensive AI regulation in force anywhere. Formally Regulation 2024/1689, it classifies AI applications by risk level and scales requirements to danger.9EUR-Lex. Regulation (EU) 2024/1689 – Artificial Intelligence Act Prohibitions on the most dangerous uses took effect in February 2025. Rules for general-purpose AI models followed in August 2025. The bulk of the law, including requirements for high-risk systems and full enforcement, takes effect August 2, 2026.10European Commission AI Act Service Desk. Timeline for the Implementation of the EU AI Act
Prohibited practices include subliminal manipulation, exploitation of age or disability-based vulnerabilities, certain social scoring, and building facial recognition databases by scraping images from the internet.11European Commission AI Act Service Desk. Article 5 – Prohibited AI Practices High-risk systems, including those used in hiring, credit scoring, education, and law enforcement, must undergo conformity assessments, maintain detailed technical documentation, and provide human oversight throughout their lifecycle. Any company selling AI products or services to EU customers must comply, regardless of where the company is based.
U.S. Federal Policy
The U.S. approach looks very different. Executive Order 14110, issued in October 2023, had directed agencies to set safety standards and required developers of powerful models to share safety test results with the government. That order was revoked on January 20, 2025, with the stated goal of “removing barriers to American leadership in artificial intelligence.”12The White House. Removing Barriers to American Leadership in Artificial Intelligence The replacement order directed agencies to review and rescind regulations adopted under the prior framework.
As of mid-2026, no comparable federal structure has taken its place. There is no general federal AI safety law, no federal requirement for algorithmic impact assessments, and no federal mandate for transparency in AI decision-making. The one significant federal statute directly aimed at AI-generated content is the TAKE IT DOWN Act, signed in May 2025, which criminalizes the nonconsensual publication of intimate images, including AI-generated deepfakes, and requires platforms to remove such content within 48 hours of notification.13U.S. Congress. S.146 – TAKE IT DOWN Act
State Laws
With the federal government largely on the sidelines, states are filling the gap. More than two dozen have enacted laws addressing specific AI applications, including deepfakes in elections, algorithmic discrimination in hiring, and AI-generated child exploitation material. Colorado’s AI Act is the most comprehensive state-level effort, imposing affirmative duties on developers and deployers of high-risk systems. A company deploying AI nationally may need to comply with dozens of different state requirements at once.
Deepfakes and Voice Cloning
Realistic fake video, audio, and images of real people have outpaced the law. The TAKE IT DOWN Act creates a federal criminal penalty for publishing nonconsensual intimate deepfakes and requires platforms to remove them within 48 hours of notice.13U.S. Congress. S.146 – TAKE IT DOWN Act Its scope is limited to intimate imagery. For deepfakes used in political advertising, fraud, or harassment, there is no federal law. At least 28 states have enacted their own laws addressing deepfakes in political communications, with coverage and penalties varying widely.
Voice cloning raises distinct questions because the right of publicity, which protects a person’s name, image, and likeness from commercial exploitation, remains a matter of state law. No federal right of publicity exists. Several bipartisan federal proposals have circulated to create national protections against unauthorized AI replicas, but none have been enacted. Protection currently depends on which state you are in and whether that state’s statute is broad enough to cover synthetic voice and likeness.
AI in the Courtroom
Evidence Authentication
AI tools are now standard in large litigation for reviewing and categorizing discovery documents. Any AI-derived evidence must still meet the same authentication requirements as any other evidence. Federal Rule of Evidence 901 requires the proponent to show that the item “is what the proponent claims it is,” including, for evidence produced by a process or system, a showing that the system “produces an accurate result.”14Legal Information Institute. Federal Rules of Evidence Rule 901 – Authenticating or Identifying Evidence Submitting AI-processed evidence without understanding how the tool selected it risks exclusion.
Attorney Sanctions and Privilege
The most visible ethics issue involves lawyers who submit briefs containing AI-fabricated citations. Federal judges across the country have issued standing orders requiring attorneys to certify that they have personally verified any AI-assisted research. Rule 11 of the Federal Rules of Civil Procedure authorizes sanctions against attorneys who file papers that are not well-grounded in fact and law, including “nonmonetary directives” and “an order to pay a penalty into court.”15Legal Information Institute. Federal Rules of Civil Procedure Rule 11 – Signing Pleadings, Motions, and Other Papers Courts have confirmed that AI use “does not alleviate a party’s responsibility for making sure that all facts and legal authorities cited in court filings are accurate” and that sanctions can include dismissal.16United States District Court Middle District of Georgia. Use of Artificial Intelligence by Pro Se Litigants
Privilege for communications with AI tools is limited. In United States v. Heppner, decided in February 2026, a federal court held that documents generated through a publicly available AI platform were not protected by the attorney work product doctrine. The court reasoned that the materials were not generated by or at the request of counsel and that the defendant was not acting as counsel’s agent when using the AI. The court left open whether the result would differ if an attorney directed the client to use AI or if the platform had contractual confidentiality protections. Anyone relying on a public AI tool should assume prompts and outputs are discoverable.
Risk Scoring in Sentencing
Several states use algorithmic risk assessment tools to inform sentencing and bail decisions. In State v. Loomis, the Wisconsin Supreme Court upheld the use of COMPAS scores at sentencing, reasoning that judges retain discretion and the score is not the sole factor. The court also acknowledged that defendants have no meaningful ability to challenge how the score was calculated because the algorithm is protected as a trade secret. A defendant can verify the questionnaire answers but cannot see which factors were weighted or how heavily. The tension between proprietary algorithms and due process is one of the most consequential unresolved issues in this area.