Let's start with a scenario that's already playing out in boardrooms and legal departments: a startup builds its entire product using an AI coding agent. They ship, they grow, they raise a Series A. Then someone asks the question nobody thought to ask earlier — do we actually own this codebase?
It sounds like a hypothetical. It isn't. The intellectual property status of AI-generated code has quietly become one of the most consequential unresolved questions in software law — and the industry is largely pretending the answer is obvious when it is anything but.
Note: this article describes how copyright authorities and courts are currently approaching AI-generated works. It is not legal advice. Anyone making real decisions on this should talk to a lawyer in their jurisdiction.
Where the Law Actually Stands
The United States Copyright Office has been the most explicit. In Part 2 of its Copyright and Artificial Intelligence Report , released in January 2025, the Office concluded that copyright requires human authorship — and that prompts alone do not provide enough control over the output for that authorship to attach. Purely AI-generated material is not eligible for registration. The position was reinforced two months later when the DC Circuit's Thaler v. Perlmutter decision unanimously upheld the Office's refusal to register a work autonomously created by an AI system.
As Shira Perlmutter, then Register of Copyrights, put it when the report was released:
Our conclusions turn on the centrality of human creativity to copyright.
The operative word in the Office's analysis is "sufficient" — sufficient human control over the expressive elements of the work. And nobody has defined that with precision. Is it enough to write the prompt? To choose which output to accept? To edit 20% of the lines? The guidance says it must be analyzed case by case, which is honest but not particularly comforting if you are trying to ship a product.
The United Kingdom has, since 1988, been one of a small handful of jurisdictions — alongside New Zealand, Ireland, India, and Hong Kong — with a statutory provision specifically for "computer-generated works." Section 9(3) of the Copyright, Designs and Patents Act 1988 assigns authorship in such works to "the person by whom the arrangements necessary for the creation of the work are undertaken." On paper, this looked like it might offer a path to claiming copyright over purely AI-generated output.
In practice, it has rarely been relied on, and its scope was never really tested. And on 18 March 2026, the UK government's Report on Copyright and Artificial Intelligence proposed to repeal s.9(3) . The government's stated view: in the absence of evidence of the provision's continuing value, the protection for wholly computer-generated works should be removed, while copyright should continue to protect works created with AI assistance. The European Union has long taken the same line — that human authorship is the hinge — through case law and the broader logic of its copyright framework.
The result is not the patchwork the industry assumed. It is, increasingly, a convergence: the major Western jurisdictions are aligning on the same answer. Code generated entirely by an AI agent, without sufficient human creative input, is unlikely to enjoy copyright protection anywhere that matters. The same codebase that you thought was a defensible asset in London is, by 2026, looking the same way it does in San Francisco and Berlin.
The Practical Consequences
Consider what it means for your product to be built on code that lives outside copyright. A competitor can legally copy it. You can't sue for infringement. Your codebase — the moat you thought you were building — is, for the parts that are pure AI output, a commons. Reframed unkindly: you're paying to produce something anyone can use for free.
The companies most exposed aren't the ones using AI agents the least. They're the ones using them the most — and documenting human creative contribution the least.
Training Data Liability — The Other Side of the Coin
There's a second-order problem, and it's already in litigation. Several ongoing lawsuits allege that coding agents trained on open-source repositories reproduce copyrighted patterns in their output. The most prominent is Doe v. GitHub (filed November 2022, ongoing), a class action against GitHub, Microsoft, and OpenAI brought on behalf of open-source developers whose code was used to train Copilot. The plaintiffs allege violations of open-source license terms and the DMCA's prohibition on stripping copyright-management information.
The case has been a slow grind. Several claims have been dismissed; others survive. The core legal question — whether training on open-source code constitutes infringement or fair use, and whether agent outputs that resemble training material create downstream liability — remains genuinely unresolved.
⚖️ Who carries the bag? If those claims, or future ones like them, succeed, the company that used the agent — not just the agent vendor — may be the one holding liability for infringement. You deployed it. You shipped the output. The contractual protection in most agent vendor terms of service is thinner than developers assume, and the indemnification clauses, where they exist at all, often carve out exactly the scenarios you'd want them to cover.
What Responsible Teams Are Doing Now
The answer isn't to stop using AI agents. The answer is to build documentation practices that establish human creative contribution at each meaningful decision point. Concretely, this looks like:
- Recording architectural decisions and specifications written by humans before the agent runs, so the creative direction has a paper trail
- Logging meaningful human edits to AI output, not just accepts and rejects — granularity matters here, because "I clicked accept" is the weakest possible evidence of authorship
- Reviewing agent vendor agreements specifically for IP indemnification clauses, and what they actually cover when output is alleged to infringe
- Getting a legal opinion on the jurisdiction-specific status of your core IP — before you need one in a due-diligence binder
None of this is glamorous, and most of it adds friction. The companies that take it seriously now are the ones that won't be surprised in a Series B data room.
The Bigger Picture
If AI-generated code is systematically unprotectable across the jurisdictions that matter, the economic model of software startups — build a defensible codebase, raise on it, exit on it — starts to crack. The moat moves upstream: to data, to distribution, to brand, to proprietary models trained on your specific domain, to the ineffable thing called taste. Code itself becomes a commodity faster than anyone planned for.
The question isn't whether AI writes good code. The question is whether the good code AI writes is actually yours.
The legal frameworks will eventually catch up. They always do. But the companies that understand the gap — and act before it closes — will be in a very different position than those who assumed the answer was obvious.
Further reading: the US Copyright Office AI initiative (Parts 1, 2, and the pre-publication Part 3 on training), the UK government's March 2026 Copyright and AI Report , and the GitHub Copilot litigation tracker maintained by Matthew Butterick.
No comments yet