Generative AI Legal Issues: Copyright, Liability, and Ethics

The legal issues raised by generative AI cluster in six areas: copyright disputes over training data and AI-generated works, a patchwork of U.S. federal and state regulation, the EU’s AI Act, liability for harmful or false outputs, data protection under privacy laws, and professional-conduct rules for lawyers who use the tools. Some of these questions have reached decisive rulings and settlements by mid-2026. Others remain unresolved, with courts applying existing doctrines case by case while legislators debate whether new frameworks are needed.

Copyright and Training Data

The most contested question is whether training a model on copyrighted material is fair use. Dozens of suits are pending against OpenAI, Meta, Anthropic, Stability AI, Google, and others, and several have now produced rulings that begin to draw a line.

The line so far separates lawfully acquired works from pirated ones. In Bartz v. Anthropic, Judge William Alsup ruled in June 2025 that training on lawfully purchased books qualified as fair use, but that the defense did not extend to pirated copies Anthropic had downloaded from Library Genesis and Pirate Library Mirror. The case settled in September 2025 for $1.5 billion, described as the largest copyright settlement in U.S. history. Class members receive roughly $3,000 per work, Anthropic must destroy the pirated datasets, and the settlement releases only past conduct without licensing future training.¹²

The consolidated multidistrict litigation against OpenAI and Microsoft, combining twelve suits including the New York Times case, is pending in the Southern District of New York. Discovery is nearing completion, and in March 2026 the court ordered OpenAI to produce 88 million records.¹ Andersen v. Stability AI is set for trial in April 2027. In Kadrey v. Meta, the court granted partial dismissal on fair use grounds but kept alive claims about Meta’s role in torrenting pirated copies.³ In Thomson Reuters v. Ross Intelligence, the first case to reach the fair use question, the court granted partial summary judgment in February 2025 for Thomson Reuters, holding that Westlaw headnotes are original and that copying them for AI training was not fair use. The Third Circuit is now reviewing that ruling.

Who Owns What an AI Creates

On March 2, 2026, the U.S. Supreme Court denied certiorari in Thaler v. Perlmutter, leaving intact the D.C. Circuit’s holding that the Copyright Act requires human authorship. Dr. Stephen Thaler had sought to register a visual work created autonomously by his AI system DABUS. The Copyright Office, the district court, and the appeals court each concluded that copyright requires a human creator, and the Supreme Court declined to disturb that result without comment.¹⁴

Works generated autonomously by AI cannot be copyrighted in the United States. Works combining AI-generated and human-authored elements can be registered, but the Copyright Office requires applicants to disclose and disclaim the AI-generated portions; protection extends only to what the human contributed.⁵ Patent law follows the same rule. In Thaler v. Vidal, the Federal Circuit held that only natural persons can be named inventors, and the USPTO reinforced this in November 2025 guidance stating that inventorship requires “conception,” an inherently human act.⁶

Licensing Deals Alongside Lawsuits

Some rights holders are pursuing licenses rather than, or in addition to, litigation. In December 2025, Disney announced a three-year agreement to invest $1 billion in OpenAI and license more than 200 characters from Disney, Marvel, Pixar, and Star Wars for use in the Sora video-generation platform.⁷ The deal collapsed in March 2026 when OpenAI shut down Sora, reportedly giving Disney 30 minutes’ notice. No money moved and no definitive agreements were signed.⁸ Disney was simultaneously suing Midjourney, Minimax, and ByteDance over its characters, illustrating how licensing and litigation now run in parallel.

U.S. Federal Regulation

Congress has not passed comprehensive AI legislation. The administration’s approach, set out in the White House’s “National Policy Framework for Artificial Intelligence” published in March 2026, relies on existing sector regulators and industry standards rather than a new federal AI agency. The framework recommends that Congress preempt state AI laws that impose “undue burdens,” specifically barring states from regulating model development or holding developers liable for third-party misuse.⁹

On copyright, the framework takes the position that training AI on copyrighted material does not violate copyright law and urges Congress not to interfere while the courts work through fair use disputes. It does encourage collective-rights arrangements for rights holders to negotiate compensation.⁹

On June 2, 2026, President Trump signed an executive order titled “Promoting Advanced Artificial Intelligence Innovation and Security,” focused on cybersecurity and national defense. It directs agencies to develop a classified benchmarking process for “covered frontier models” and creates a voluntary early-access framework for those models, while explicitly rejecting mandatory licensing or preclearance.¹⁰

The one significant federal statute so far is the TAKE IT DOWN Act, signed in May 2025, which criminalizes nonconsensual publication of intimate imagery including AI-generated deepfakes, with penalties of up to three years in prison. In May 2025 the House also passed a reconciliation package containing a 10-year ban on state and local enforcement of laws regulating AI models and automated decision systems. The provision remains pending in the Senate.¹¹

State AI Laws

States have filled the federal void. Between 2023 and 2025, 27 AI-related laws were enacted across 14 states.¹²

Colorado’s AI Act, originally modeled on the EU AI Act and set to take effect June 30, 2026, was overhauled before it could apply. Governor Polis signed a replacement bill (SB 26-189) on May 14, 2026, delaying the effective date to January 1, 2027 and stripping out the affirmative duty to prevent algorithmic discrimination, mandatory impact assessments, and deployer risk-management programs. What remains is a narrower disclosure-and-rights framework: developers must document intended uses, training-data categories, and known limitations, and consumers can access their data, correct factual errors, and request human review of adverse automated decisions. The Colorado Attorney General has sole enforcement authority, and entities have a 60-day right to cure.¹³

New York’s RAISE Act, signed in December 2025 and effective January 1, 2027, targets frontier models trained using more than 10²⁶ floating-point operations. Large frontier developers, meaning those with annual revenue over $500 million, must publish safety frameworks, report critical safety incidents to the Department of Financial Services within 72 hours, and submit quarterly summaries of internal catastrophic risk assessments. The state Attorney General can impose civil penalties of up to $1 million for a first violation and $3 million for subsequent ones. The law creates no private right of action.¹⁴

Texas enacted the Responsible Artificial Intelligence Governance Act (TRAIGA), effective January 2026, regulating harmful uses and requiring government and healthcare disclosures. Utah requires disclosure when consumers interact with generative AI. California, Maine, New Hampshire, New York, and Utah have passed chatbot-specific transparency and safety laws, with particular focus on mental health and emotional companionship applications.¹⁵¹²

The EU AI Act

The European Union’s AI Act, the world’s most comprehensive AI regulation, entered into force on August 1, 2024 and is being phased in through 2027. It uses a risk-based approach: some practices are banned outright, high-risk systems face specific requirements, and other uses are generally unregulated.¹⁶

Governance rules and general-purpose AI (GPAI) obligations took effect on August 2, 2025. Transparency rules follow in August 2026, requiring that AI-generated content be identifiable in a machine-readable format, that deepfakes be labeled, and that users be told when they are interacting with a chatbot.¹⁶ Models judged to pose “systemic risks,” those trained above a 10²⁵ FLOP threshold, face additional obligations including structured risk assessments, incident reporting, and cybersecurity protections.¹⁷

The EU AI Office published a voluntary GPAI Code of Practice on July 10, 2025 covering transparency, documentation, copyright policies (including respect for machine-readable rights signals such as robots.txt), and safety obligations. Signatories include Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI, OpenAI, and ServiceNow; Meta and Chinese-based AI companies are absent. Though voluntary, the Commission treats adherence as a mitigating factor in enforcement, and non-signatories must demonstrate compliance through more rigorous means. Each member state must establish at least one AI regulatory sandbox by August 2, 2026.¹⁷¹⁶

Liability for Harmful or False AI Outputs

When a generative AI system produces false, defamatory, or dangerous content, who is responsible? Courts have avoided sweeping new rules and are instead applying existing doctrines case by case.

Section 230 and Defamation

Section 230 of the Communications Decency Act, which shields platforms from liability for third-party content, has not been meaningfully tested against generative AI. Companies have generally avoided raising it, likely because AI output is not straightforwardly “third-party content” when the developer’s model materially contributes to it.¹⁸

In Walters v. OpenAI (May 2025), a Georgia state court granted summary judgment to OpenAI on false statements generated by ChatGPT. The ruling rested on traditional defamation doctrine: ChatGPT’s disclaimers precluded treating its output as statements of fact, and OpenAI’s mitigation efforts negated negligence or malice.¹⁹ In Garcia v. Character Technologies (2025), a federal court let claims about a minor’s harmful chatbot interactions proceed, rejecting the defendant’s motion to dismiss and First Amendment defense without reaching Section 230. The Garcia court’s willingness to treat a chatbot as potentially a “product” rather than a speech platform has been followed in additional suits against OpenAI and Character Technologies.¹⁸ A March 2026 Senate hearing explored Section 230 reforms, but no legislation has advanced.²⁰

Product Liability and Duty of Care

Courts are increasingly receptive to treating AI-generated harm through a product-liability lens, on the theory that models predictably producing dangerous hallucinations may be defectively designed. Courts have also required AI companies to preserve logs showing training data provenance, moderation filters, and response protocols, including a federal order in NYT v. OpenAI requiring preservation of user logs. Failing to correct a known false output after notice is increasingly framed as evidence of reckless disregard.²¹

Privacy and Data Protection

Generative AI creates data protection issues at three stages: scraping training data, processing information during training, and generating outputs that may contain personal information.

Under the EU’s GDPR, regulators have been active. Italy’s data protection authority opened a case against OpenAI in 2023 that resulted in a temporary national ban on ChatGPT and a finding of GDPR violations. The European Data Protection Board formed a dedicated ChatGPT task force. France, Germany, Poland, and Austria have each pursued investigations or enforcement, with the Austrian complaint (filed by the privacy group NOYB) focused on ChatGPT’s inability to correct or disclose information about personal data it processes.²²

The tensions are structural. Consent is generally inapplicable to mass scraping. The “legitimate interest” basis favored by developers is contested, with regulators asking whether commercial interest in AI training outweighs users’ fundamental rights, particularly where users do not reasonably expect this use of their data. The “right to erasure” is technically difficult once data has been absorbed into model weights, and regulators have questioned whether true deletion is even possible in trained models.²²¹⁵ The UK’s Information Commissioner’s Office has stated that in the “vast majority of cases,” AI use triggers a Data Protection Impact Assessment because of the high risk to individuals’ rights.²³

Lawyers, Ethics, and AI Sanctions

Adoption in the legal profession has been quick, and disciplinary actions have followed. A 2025 survey by the Association of Corporate Counsel found that generative AI use in corporate law departments doubled in one year.²⁴

Ethics Rules

The American Bar Association’s Formal Opinion 512, issued July 29, 2024, applies existing Model Rules of Professional Conduct to lawyers using generative AI. Lawyers must understand the technology’s limitations (Rule 1.1, competence), protect client information from exposure through AI platforms (Rule 1.6, confidentiality), consult clients about AI use in their matters (Rule 1.4, communication), and charge only for actual time spent using AI rather than time learning it (Rule 1.5, reasonable fees).²⁵ California’s State Bar issued more detailed guidance requiring lawyers to verify all AI-generated citations before filing, anonymize client information before entering it into AI tools, and comply with any local rules requiring disclosure of AI use.²⁶

Sanctions for Hallucinated Citations

Courts have imposed escalating penalties on lawyers who file briefs containing AI-fabricated case citations. A Thomson Reuters study identified 22 instances of nonexistent citations in filings between June and August 2025 alone.²⁷ Notable sanctions include:

Sixth Circuit: $30,000 against two attorneys who submitted more than two dozen fake citations, resulting in case dismissal for “pervasive misconduct.”²⁸
Southern District of Ohio: $7,500 against two attorneys, plus contempt findings and referral to Ohio disciplinary authorities for Rule 11 violations.²⁸
Fifth Circuit: $2,500 against an attorney whose legal AI tools generated fabricated content, with the penalty increased for failure to accept responsibility.²⁸
Northern District of New York: $1,000 against an attorney in Kaur v. Desso, plus mandatory AI-focused continuing legal education, despite the attorney’s admitted awareness that AI could fabricate citations.²⁷

Trade Secrets and Attorney-Client Privilege

Two rulings have put organizations on notice about the risks of sharing sensitive information with AI tools. In Trinidad v. OpenAI, a court dismissed trade secret claims under the Defend Trade Secrets Act because the plaintiff had voluntarily entered proprietary frameworks into ChatGPT, failing to take the “reasonable measures” required to keep the information secret. Sharing proprietary information with a public AI platform can operate as a public disclosure that extinguishes trade secret rights.²⁹

In United States v. Heppner (S.D.N.Y., February 2026), Judge Jed Rakoff held that 31 documents created by a defendant using Anthropic’s Claude were not protected by attorney-client privilege or the work-product doctrine. Claude is not an attorney, Anthropic’s privacy policy permits data collection and third-party disclosure, and the defendant used the tool on his own initiative rather than at the direction of counsel. Judge Rakoff noted the result might differ if counsel had directed use of an AI tool within a controlled, confidential environment; a consumer-grade chatbot with standard terms of service does not meet that bar.³⁰

Antitrust and Competition

Regulators are scrutinizing the industry’s competitive structure. In January 2024, the FTC issued Section 6(b) orders to Alphabet, Amazon, Anthropic, Microsoft, and OpenAI seeking information on the competitive impact of major AI investments, including Microsoft’s $13 billion in OpenAI and Amazon’s and Google’s investments in Anthropic.³¹ The DOJ and FTC divided oversight, with DOJ leading on Nvidia and the FTC on Microsoft and OpenAI.³² Regulators have flagged concern about “pseudo-mergers” in which large technology companies hire startup talent and license intellectual property rather than acquiring the company outright, potentially avoiding merger review. Separately, the EEOC has increased enforcement against AI-powered resume-screening tools that may produce discriminatory results under Title VII and the Age Discrimination in Employment Act.¹⁵

Deepfakes and Synthetic Content

The TAKE IT DOWN Act criminalizes nonconsensual intimate deepfakes using a “reasonable person” test to determine whether the material is indistinguishable from authentic imagery.¹¹ The White House framework also recommends a federal standard protecting individuals from unauthorized commercial use of AI-generated digital replicas of their voice and likeness, with carve-outs for parody, satire, and news reporting. A proposed “No FAKES Act” continues to gather support.⁹

State activity is extensive. Alabama, Arizona, California, and other states have enacted laws targeting election-related deepfakes, nonconsensual intimate AI imagery, and AI-generated child sexual abuse material. Alabama and California have expanded their CSAM statutes to cover AI-generated depictions “virtually indistinguishable” from real children. Arizona and California have extended prohibitions on nonconsensual intimate images to cover realistic AI-generated versions.³³

1
Norton Rose Fulbright. AI in Litigation Series: An Update on AI Copyright Cases in 2026
2
Susman Godfrey. Susman Godfrey Secures $1.5 Billion Settlement in Landmark AI Piracy Case
3
McKool Smith. AI Litigation Tracker
4
Finnegan. Supreme Court Declines to Hear Thaler v. Perlmutter, Leaving Human Authorship Requirement Intact
5
Federal Register. Copyright Registration Guidance: Works Containing Material Generated by Artificial Intelligence
6
Holland & Knight. The Final Word: Supreme Court Refuses to Hear Case on AI Authorship
7
Wall Street Journal. Disney to Invest $1 Billion in OpenAI, License Characters for Use in ChatGPT, Sora
8
Variety. OpenAI Shutting Down Sora Video, Disney
9
White House. National Policy Framework for Artificial Intelligence Legislative Recommendations
10
White House. Promoting Advanced Artificial Intelligence Innovation and Security
11
Mintz. President Trump Signs AI Deepfake Act Into Law
12
Future of Privacy Forum. From Proposal to Passage: Enacted U.S. AI Laws 2023-2025
13
Hunton Andrews Kurth. Colorado AI Act Amended and Effective Date Delayed
14
Wiley Rein. New York Finalizes RAISE Act for Frontier AI Models
15
Baker Donelson. 2026 AI Legal Forecast: From Innovation to Compliance
16
European Commission. Regulatory Framework for AI
17
EU AI Act. Introduction to Code of Practice
18
Moody’s. 230 Immunity for AI Chatbot Lawsuits
19
Quinn Emanuel. Artificial Intelligence Update April 2026
20
Security and Technology. Design Obligation or Third-Party Liability
21
Bloomberg Law. Courts Navigating AI Defamation Opens Legal Risks for Companies
22
Cambridge University Press. Generative AI and Data Protection
23
Debevoise & Plimpton. Eight GDPR Questions When Adopting Generative AI
24
Loyola University Chicago. Generative AI in Legal Practice
25
American Bar Association. ABA Issues First Ethics Guidance on AI Tools
26
State Bar of California. Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law
27
Thomson Reuters. GenAI Hallucinations
28
ABA Journal. Sanctions Ramping Up in Cases Involving AI Hallucinations
29
IPWatchdog. Navigating Recent Developments in Generative AI and Trade Secret Protection
30
Chapman and Cutler. Federal Court Rules That AI-Generated Documents Are Not Protected by Privilege
31
Federal Trade Commission. FTC Launches Inquiry Into Generative AI Investments and Partnerships
32
New York Times. Nvidia, Microsoft, OpenAI Antitrust DOJ FTC
33
Orrick. US AI Law Tracker