Any product team considering the integration of a generative model should be aware that doing so may propagate intellectual property (IP) infringement. Content produced by generative models may contain legally protected IP, putting both the product and its users at legal risk.

From an ethical standpoint, these legal risks raise serious concerns about our collective ethical obligation to the creators and innovators whose work was used—often without consent—to train generative models.

Beyond potential infringement, there is a glaring legal gray area regarding IP ownership of AI-generated content that exists around the world. This ambiguity raises more questions than answers, such as:

• Does a generative AI provider or user own the IP it creates? Law regarding IP ownership of generated content is weak. Many AI providers have stepped in with their own legal interpretations in AI user agreements such as End User License Agreements.

• As a user of an AI tool, do you own the copywrite of generated content? Since many models use partially deterministic mechanisms, similar result or identical content may be generated for different users. Early legal indicators, such as the U.S. Copywrite Office decision around a Midjourney-generated work called Zarya of the Dawn, is indicating, no, you don’t.

Product teams leveraging LLM’s will need to consider the ethical aspects of this issue, and ensure legal agreements cover the both infringement and rights issues.

The Current Situation

Since the explosion of generative AI in early 2022, serious controversy has emerged around the data used to train these models.

A wide range of professionals—journalists, authors, screenwriters, musicians, photographers, and artists, as well as engineers, developers, and inventors in patent-heavy industries—have voiced concerns about how their content is being used. Content providers, from news organizations to publishers, were among the first to take legal action against companies such as OpenAI.

In their March 2025 update, Sustainable Tech Partner News reported that in the over 100 active AI-based lawsuits against providers OpenAI, Microsoft, Nvidia, Perplexity and others, most of them deal with IP infringement claims.

Citing a lack of federal intervention, states like California have begun introducing their own regulations to protect copyright holders and establish clearer boundaries. In September 2024, Governor Gavin Newsom signed Bill AB-2013: Generative Artificial Intelligence—Training Data Transparency, which requires AI developers to disclose training data sources, helping IP owners determine if their content was used. Generative AI companies must comply by January 2026.

In response, AI companies are actively lobbying the federal government to classify the use of copyrighted material in AI training as “fair use”—a move that could significantly reduce or eliminate their legal obligations to intellectual property holders. For example, both OpenAI and Microsoft submitted public responses to the government's Public Comment Invitation on Artificial Intelligence Action Plan, each advocating for the weakening of existing IP laws to allow broader use of copyrighted content in training AI models.

In short, the situation is evolving rapidly, and it remains unclear how these issues will be resolved in the U.S. or globally.

Why Are You at Risk?

Generative AI models, by design, can replicate or remix content used in their training data. If you use AI-generated content that harms original IP holders, you may be liable for damages. If you’re a product company integrating generative AI, you could face additional legal exposure for content generated by your platform.

Furthermore, if you use AI to generate materials— from written content, to design patterns, images, or computer code—you may not actually have the legal right to claim ownership. Copyright and trademark protections (including “first use” rights) may not apply to AI-generated content. Legal clarity on this issue remains unresolved. If your product helps customers generate content, consult legal counsel to understand the risks, and how you should protect your organization.

Why Hasn’t This Slowed Adoption?

Given I’m in AI conversations daily, it’s surprising how little this issue is discussed. It’s unclear whether that’s due to lack of awareness or the estimation of risk is low.

Early indemnity offerings from major AI providers—Google, OpenAI, Microsoft, Adobe—likely played a role in easing the perception of legal risks related to IP infringement. Indemnity is a legal mechanism that protects end users from liability, shifting the burden to the AI provider in cases of infringement. Through a series of changes to their own legal contracts, these companies have reduced the risk related to using AI generated content, even if it contains legally protected IP.

Offering content use indemnity should be a consideration for any company incorporating generative AI into their products.

The Backstory of Indemnity Agreements

IP infringement risks were well understood by AI companies early on—and they recognized these concerns could slow adoption.

As far as I can tell, GitHub was the first to act on this concern. In June 2022, GitHub began offering indemnification for users of its AI-powered tool, Copilot—but only if they used Copilot’s “duplication detection” filter.

Nearly a year later, other providers followed suit:

• In June 2023, Adobe began offering IP indemnification for commercial users of Firefly, its generative image tool.

• In July 2023, Shutterstock introduced indemnification for enterprise users of its GAI-generated image licenses.

• In September 2023, Microsoft launched Copilot, then rolled out its Copilot Copyright Commitment, indemnifying paying customers for copyright claims related to AI-generated content.

• By November 2023, Microsoft extended this protection to Azure service users under a broader Customer Copyright Commitment—including those using Azure’s OpenAI services.

• OpenAI responded to the above with its own Copyright Shield for Enterprise and API customers in November 2023 (note: this protection did not extend to free, pro or plus users).

Today, indemnity clauses are a common tool to reassure customers and drive adoption. Product teams will need consider whether indemnity protections over the use of embedded generative AI within their products will also extend to their customers.

Where Is This All Headed?

Despite these concerns, momentum behind generative AI continues to accelerate. For now, indemnity appears to satisfy early adopters, especially in the absence of meaningful global regulation.

Assuming most AI use cases are made in good faith, and based on early court decisions, we may be heading toward the following outcomes:

• Some use of protected IP for training AI may be considered fair use, especially if no direct harm can be proven.

• More generative AI products will build in mechanisms to prevent or mitigate IP infringement, such as content filters and preventative tools.

• Legislation may pave the way for content owners to request or require generative AI providers to eliminate their content from the model, or restrict from further training.

• In clear cases of copied or traceable IP, providers may be required to compensate the original creators.

• Courts will continue to clarify ownership rights of content produced by AI, but this may differ from country to country

  .

Considerations for Product Teams

If you're thinking about integrating generative AI into your product:

• Educate your team on the current legal and ethical landscape.

• Choose providers that offer indemnity and legal protections for generated content and understand whether this protection would extend to your customers.

• Reduce risk by:

  • Evaluating your AI provider’s training data sources

  • Scoping and limiting types of content created in your own use of generative AI

  • Add guardrails to your own products, such as reviewing generated content for potential infringement

• Consider indemnifying your customers for content generated by your product.

• Take a clear position on IP ownership of AI-generated content—even if the law remains unsettled.

  ---

Final Thoughts: Do Your Homework

As exciting as generative AI is, it’s critical not to overlook the legal and ethical complexities—especially around intellectual property. While some companies argue for expanding the definition of "fair use" to accommodate AI training, many creators, rights holders, and legal experts warn that such changes could severely undermine IP protections that support innovation, creativity, and livelihoods.

If you're building with generative AI, don't rely solely on provider assurances or industry momentum. Take time to research the perspectives of those whose work may have been used without permission. Writers, artists, musicians, inventors, and journalists are raising serious concerns about the long-term implications of weakening IP laws in the name of technological progress.

Educate yourself. Read the public comments from both sides of the debate. Listen to the arguments of IP owners, not just AI companies. Understand what’s at stake—because building responsibly in this space means more than avoiding lawsuits. It means deciding what kind of innovation ecosystem we want to be part of.

Here’s a quick values assessment activity. Gather your product team, including your executive leaders, and ask them to rate the following statements on a scale of 1 to 10 based on how much they agree:

• AI innovation is more important than worrying about imagined risks.

• AI use poses a threat to everyone, and we need to manage those risks.

• If we do something wrong, we can always clean it up later.

• We are responsible for people who choose to use our technology in a way that negatively impacts others.

• We are effective at learning and considering AI ethics.

• I’m concerned about the environmental footprint of AI.

• We have a good understanding of AI-related risks.

• AI guidelines are better than AI policies because they leave room for risk-taking and innovation.

• Everyone on our team should reduce AI-related risks around bias, privacy, security, environmental impact, bad actors, workforce impact, intellectual property violations, personal freedom, and cybersecurity threats.

When I talk to product teams, I’m often surprised at how shallow these kinds of considerations go. Have you discussed these topics as a team? Is there a team lead who is focused on this subject and driving awareness within the team?

A Tale of Two Cities

While conducting research to support a municipality’s attempt to craft internal guidelines, policies, and procedures on AI, I was struck by two cities that landed in very different places.

The first was Boston. When ChatGPT emerged, Boston quickly created a set of guidelines around the use of Generative AI. The guidelines were established in May 2023 and, as of this writing, have not been replaced by policy or procedures (though the guideline indicates it will eventually be updated). Notably, the policy was signed by Boston’s CIO and credits numerous academics for their input.

Choosing guidelines over policies was so unusual that publications like Wired.com highlighted Boston's bold governmental approach.

In contrast, Seattle released its Policy on Generative AI in October 2023—deep into the proliferation of generative AI and five months later than Boston. The draft was written by the Chief Information Security Officer, with the final version signed by the interim CTO.

One section of the Seattle policy stands out:

Generative AI systems may produce outputs based on stereotypes or use data that is historically biased against protected classes. City employees must leverage RSJI resources (e.g., the Racial Equity Toolkit) and/or work with their departmental RSJI Change Team to conduct and apply a Racial Equity Toolkit (RET) prior to the use of a Generative AI tool, especially for uses that will analyze datasets or be used to inform decisions or policy. As per the objectives of the RSJ program, the RET should document the steps the department will take to evaluate AI-generated content to ensure that its output is accurate and free of discrimination and bias against protected classes.

I wasn’t in the room with either of these groups, but the results of their work suggest very different value systems. Boston offers support for questions, while Seattle requires an approval process. Seattle makes punitive actions for non-compliance clear; Boston remains silent on enforcement.

Will either approach lead to better human outcomes? I don’t know. But I suspect that each approach will reinforce the underlying value system of each organization, thereby better achieving those values.

Not a One-Size-Fits-All Answer

If you’re in the early stages of developing a governance approach—be it guidelines, policies, or procedures around AI risk management—you’ll need to start with a higher-level conversation, asking:

• What’s important to us? What do we value?

This work might begin by assessing the cultural value forces at play, such as:

• How does our approach align with our larger organizational values?

• Are we aligned in our thinking (e.g., gaps exposed by the above exercise)?

• Who are the leadership voices that should be considered?

• What do our existing and historical approaches tell us?

• What do respected peer organizations do?

The next set of exercises should refine value statements using assessment approaches like:

• If two opposing forces compete, which one wins?

• Are we clear about the real risks (e.g., costs, human impact) or do we need to do some due diligence to expand our understanding?

• What resources and methods of sharing do we have to “learn as we go”?

• What is our commitment to responsiveness when things go wrong?

• What is our commitment to oversight and assessment?

To further clarify values, try inventing scenarios and analyzing how they align with your values:

• If we use AI that is later found to have racial bias in its algorithm (this is a real scenario, by the way), what would we do? Should we have prevented this, or should we act quickly when issues arise? Or both? Which stakeholders are we accountable to for our approach?

Once you understand your values, you can begin developing a governance foundation to ensure your team achieves what you care about—whether through accountabilities, guidelines, processes, policies, team rituals, education, measurements or monitoring.

AI users and builders should pay close attention to this development. Why did Nvidia’s stock drop? Why is this news significant beyond GPU makers and investors? And what exactly is a GPU?

What is a GPU?

The Graphics Processing Unit (GPU) has been around for over 25 years. The term, credited to Nvidia, originally referred to hardware designed to accelerate complex mathematical computations required for graphical displays. Over time, GPUs have expanded beyond display purposes to become the backbone of AI computing, powering large-scale models like OpenAI’s ChatGPT. This critical role in AI infrastructure has propelled Nvidia to the forefront of AI-related valuations.

How DeepSeek Changed the Game

When DeepSeek was officially announced, it was revealed that the company spent only $6 million on its development. While many analysts believe this figure is a significant understatement, one point is widely accepted—DeepSeek achieved highly competitive accuracy benchmarks, rivaling or even surpassing ChatGPT-4o and Claude 3.5, all while using significantly less computing power. The efficiency gains in AI are advancing so rapidly that costs are decreasing by roughly 75% year over year.

It didn’t take long for analysts to recognize the implications: Nvidia, which dominates the GPU market for AI workloads, may have been significantly overvalued.

The Good News for Humans and Product Companies

This leap in AI efficiency is a win for the planet. The enormous computing demands of AI pose a major challenge to reducing our carbon footprint. Large-scale data centers, essential for running AI models, have led tech giants like Google and Microsoft missing or scaling back their environmental goals. The pace of AI advancements has outstripped our ability to model their ecological impact, but the trajectory is concerning.

Reducing computing power while maintaining high-quality AI output is crucial in mitigating these risks. DeepSeek’s approach demonstrates that it’s possible. (For a technical deep dive into how DeepSeek achieved this, check out this article referencing Apple’s analysis of DeepSeek’s reduced compute power methods or even greater analysis by Khmaïess Al Jannadi).

Another benefit is cost reduction. Lower compute demands translate into significantly cheaper AI processing. For instance, DeepSeek’s initial cost per token was $0.14, compared to Claude’s $3.00 per token. While some of this pricing reflects aggressive competition, it also highlights the lower computational expenses involved.

What Product Teams Should Consider

At a high level, this event challenges our valuation models for AI-driven companies. Traditional business planning relies on year-over-year predictability, but the rapid pace of AI advancements raises an existential question: Can companies successfully plan investments when their core technology’s cost structure changes so drastically and unpredictably? The answer remains uncertain.

On a tactical level, product teams should ask themselves:

• What are our environmental considerations when using AI, and how can we minimize our carbon footprint?

• How will we architect our solution to prioritize lower cost operations before consuming high cost compute models?

• How will we design our AI infrastructure to remain adaptable in a fast-moving market?

• What should we be considering with our contract commitments made to 3rd party providers?

• How will we ensure our product’s value proposition remains resilient against faster, cheaper competitors?

A Final Thought: The Geopolitical Risk of AI Dependence

While companies have long outsourced manufacturing to China for cost efficiency, the implications of shifting AI compute power to foreign-built models deserve careful consideration. AI models shape bias, truth, and perception—often in ways we’re only beginning to understand.

In my own tests with DeepSeek, I noticed some unsettling behavior. When I asked a general question about Uyghurs in China, the AI initially generated a response but then immediately deleted it, replacing it with: “I can’t talk about that.” It felt eerily like censorship.

As AI continues to evolve, companies must weigh not just cost and performance but also the broader ethical and geopolitical risks of their AI dependencies.

In the world of AI, regulatory compliance is a fast-moving target. Complying with the EU’s AI Act is likely the best choice for product owners.

The Power of Regulation

If you haven't noticed, nearly every website now bombards you with cookie consent pop-ups—full-page modals blocking access until you either surrender your data or attempt to decipher a complex set of cookie settings. This is a direct result of regulation.

In 2018, the EU passed the General Data Protection Regulation (GDPR), introducing strict requirements for handling data collected from EU citizens. These broad and complex rules came with punishing fines, forcing companies worldwide to take compliance seriously. I personally consulted to organizations around compliance with the GDPR, and I can attest to the costly and disruptive efforts it took to comply, both by product teams, but also to the entire company. I offer this only as a perspective that early compliance or alignment to regulation might reduce future risk and cost.

Fast forward to 2024, when the EU introduced the world’s most comprehensive AI legislation. As of February 2025, all companies offering services or selling to EU citizens are expected to comply with the AI Act. Even if you aren’t selling or servicing citizens in the EU, you might want to comply with the legislation.

The Fractured World of Compliance

Leading AI experts have emphasized the need for governance and oversight, warning of numerous risks AI presents to individuals, businesses, and nations. Privacy, bias, security, personal liberty, and even safety concerns—including potential AI retaliation—are at stake. We are already witnessing these risks: AI-driven propaganda, difficulty in distinguishing facts from misinformation, and increased mental health crises among social media users. These issues stem not from human actions alone but from self-learning algorithms operating with little oversight and AI-generated content that is often indistinguishable from human-created material.

Despite these warnings, governments are struggling to keep up. Many lack the expertise and resources to enact meaningful legislation. Even private companies, despite some altruistic efforts, face challenges due to competitive pressures and difficulties in agreeing on oversight mechanisms. For example, Facebook’s recent decision to eliminate its fact-checking team highlights the challenge of enforcing AI governance.

At the national level, regulation remains inconsistent. In 2023, recognizing Congress’s failure to pass AI legislation, President Biden issued an executive order titled “Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence.” While the order laid out demands and deadlines for federal agencies to provide oversight, it lacked enforcement mechanisms.

Then, on January 23, 2025, President Trump issued an order revoking the 2023 directive, instead prioritizing global AI dominance. This shift has created uncertainty around compliance requirements in the U.S.

Without federal oversight, individual U.S. states have begun crafting their own AI regulations. If your AI-powered product operates in California or other states with emerging legislation, you may need to comply with varying requirements.

For companies expanding beyond North America or the EU, understanding AI laws in each jurisdiction—including smaller regional regulations—is essential.

Why the EU AI Act Stands Out

Among global AI regulations, the EU’s AI Act is the most advanced, comprehensive, and assertive. Signed into law in June 2024, it governs the use and deployment of AI technologies within the EU. The Act establishes multiple compliance deadlines, with the final one set for June 2026.

A full breakdown of the legislation deserves its own article, but its core objectives include:

• Transparency in risk areas (especially when AI impacts critical human outcomes).

• Bias mitigation and ethical AI training to prevent algorithmic discrimination.

• Secure AI development with protections against internal bad actors.

• Defense against external threats to AI systems.

• Safeguarding intellectual property, privacy, and user safety.

• Restricting excessive surveillance while preserving anonymity rights.

• Compliance with existing EU laws, including GDPR and copyright regulations.

• Special protections for vulnerable groups, including children.

Why You Should Comply

Some software providers argue that the AI Act is too restrictive, potentially stifling innovation over exaggerated fears. However, the legislation aligns with the EU’s broader regulatory culture, which prioritizes citizen protection over unrestricted technological development. If competition or innovation begins to lag, the EU may adjust its approach. For instance, in early 2025, the European Commission repealed the AI Liability Directive, which would have governed AI-related legal claims. While this change does not alter the AI Act itself, it suggests the EU is willing to balance regulation with economic growth.

That said, here are three key reasons why product teams should consider compliance:

1. It’s the most established AI regulation. The AI Act is widely recognized as a comprehensive framework balancing risk management with innovation.

2. It’s clear and well-structured. Unlike the vague U.S. executive orders, the AI Act provides transparent guidelines and clear legal expectations.

3. It’s adaptable. The Act differentiates AI oversight based on risk levels. AI used for life-or-death decisions (e.g., healthcare applications) faces stricter rules than AI used for hiring decisions or document editing. This tiered approach reduces compliance burdens for lower-risk AI applications.

How Is Your Team Managing Compliance?

I’d love to hear how your company is navigating global AI regulations. Do you have a dedicated legal team? Is compliance embedded in your product development process, from early user research to final deployment? How are you ensuring that your AI technologies align with evolving legal landscapes?

Let’s discuss!