HN user

senaevren

262 karma

legallayer.substack.com — Talking about legal but in devs' language

Posts3
Comments26
View on HN

Whether a trained model is itself personal data is a very interesting topic, and is it really possible to keep training and still be able to delete it? That is another viable question, especially for smaller models trained on user data

The tension you are describing is real and the piece does not capture it well enough. PE acquirers pushing portfolio companies toward Claude Code while their lawyers are adding AI code reps to purchase agreements is exactly the gap that will produce the first painful deal. The rep usually survives unsigned because neither side has done the analysis. When the first deal falls apart or a rep is breached post-close because of GPL contamination in an AI-assisted codebase, that will set the market standard faster than any court ruling.

Fair point and worth being precise about. Cert denial is not meaningless: it leaves the lower court ruling intact, it signals the Court did not find the issue urgent enough to resolve now, and as you note, other circuits will look at the DC Circuit's reasoning. What it does not do is bind other circuits or establish Supreme Court precedent. The distinction matters here because if a Ninth Circuit case involving AI-generated code reaches a different conclusion, that circuit split would be live law regardless of the Thaler cert denial.

You are right that no court has yet ruled that a specific set of human contributions to AI-assisted work was sufficient to establish authorship. What exists is the inverse: the Copyright Office has granted partial registrations where human-authored elements were separated from AI-generated elements, as in Zarya of the Dawn, where the human-written text was protected but the Midjourney images were not. The Allen v. Perlmutter case pending in Colorado is the first direct judicial test of whether iterative prompting and editing can constitute authorship. Until that decision, the positive threshold is genuinely unknown. The piece reflects this in the calibration section at the end, though your point is worth adding to the authorship discussion more explicitly.

That is exactly the gap the piece is aimed at. The M&A conversation is where this becomes concrete very fast, and most founders shipping AI-assisted code have not had it yet.

Fair and correct. Cert denial means the Court declined to hear the case, not that it endorsed the lower court's reasoning or settled the question nationally. The DC Circuit ruling stands and the Copyright Office's position is consistent, but that is stable doctrine rather than Supreme Court-settled law. Updated the piece to reflect this distinction accurately.

The original bargain you describe, limited term in exchange for public disclosure, is exactly what makes the current situation strange. If AI-generated output falls into the public domain immediately, that is actually closer to the original intent of copyright than 95-year terms. The legal question is whether that outcome happens by design or by accident, and what it means for the people building products on top of AI-generated codebases right now.

The San Francisco Canyon case is a good example of exactly the right distinction. Work-for-hire determines who owns the output, but if the process of creating that output involved copying protected material, the infringement claim runs separately. The piece makes this point on the open source contamination section: owning the output and having a clean chain of title to the output are different questions. You can own AI-generated code and still have a copyleft problem in it.

The chardet dispute is the closest thing to an active test case on this specific question, and you are right that it has not resolved into settled law. "Emerging legal consensus" was imprecise. The more accurate framing is: the legal community's working assumption, based on how copyright doctrine treats derivative works, is that training-data provenance travels with the output. That assumption has not been tested definitively in court yet.

fair correction, updated the piece to reflect this. Bad faith under DMCA requires knowing the claim is false, not merely being wrong. A good faith belief in copyright ownership, even one that turns out to be mistaken, is a defense. The more accurate framing is that if the codebase is found to be predominantly AI-authored, the takedowns would fail on the threshold question of whether there is a valid copyright to assert, which is a different issue from intent.

The model ownership question and the output ownership question run on separate legal tracks and the piece focuses on the second deliberately. On the first: the model weights are owned by Anthropic under work-for-hire from their engineers regardless of what the training data contained. Training data copyright infringement is a separate tort claim against Anthropic, not a basis for anyone else to claim ownership of the model. The Bartz settlement resolved the pirated books claim without disturbing Anthropic's ownership of the weights. Owning the training data does not give you ownership of the model trained on it, any more than owning the paint gives you ownership of the painting.

The sound recording analogy breaks down at the point where the recorder makes no creative decisions. Pressing record captures what is already there. Prompting Claude generates something that did not exist, through decisions the model makes about structure, naming, pattern, and implementation. The closer analogy is hiring a session musician and telling them the key and tempo. You own the recording under work-for-hire if they signed the right contract, but the creative expression in the performance is theirs unless explicitly assigned. The button you push to start the model is not the same button as the one on the recorder.

The meaningful human authorship question is the elephant, agreed, and the regulators have deliberately refused to quantify it for exactly the reason you describe any bright line number becomes a target to game rather than a standard to meet.

The logging point is sharper than it might appear. In a copyright dispute over AI-assisted code, interaction logs could cut both ways. A plaintiff trying to establish human authorship would want the logs to show substantial architectural redirection, multiple rejections of Claude output, and documented reasoning for structural decisions. A defendant challenging that authorship claim would subpoena the same logs to show verbatim acceptance of output without modification.

The practical implication i guess here,that the developers who want to preserve a copyright claim over AI-assisted code should treat their prompt history as a legal document from the start. It seems all over the world the logs are the evidence. Whether they help or hurt depends entirely on what they show.

This is actually closer to how the Copyright Office thinks about it than the article makes clear. The registration guidance that emerged from the Thaler proceedings specifically asks applicants to describe the human creative contributions and how the AI was used. A documented workflow showing requirement, architectural decision, rejection of AI output, human restructuring, and review creates a paper trail that maps directly onto what the Office looks for. The can you show how it got here test you are describing is the practical version of the legal standard.

Meta's confidence almost certainly rests on the employment contracts and IP assignment clauses, not on a legal theory that AI output is inherently copyrightable. The enterprise agreement with Anthropic assigns outputs to the licensee. The employment contract assigns work product to Meta. Those two documents together give Meta a defensible ownership position regardless of the authorship question. The interesting gap is for developers using personal accounts or consumer plans on side projects, where neither of those documents exists.

The intermingling argument is actually central to the Bartz settlement structure. The settlement required destruction of the pirated dataset specifically because commingled training data creates an unresolvable provenance problem. For deployers building on Claude, EDPB Opinion 28/2024 requires a documented assessment of the foundation model's training data legal basis before deployment. "We cannot tell which outputs came from which source" is not a satisfactory answer to a regulator running that assessment. wrote about it before here: https://legallayer.substack.com/p/i-read-every-edpb-document...

The fourth point about code commenting is the one that connects directly to the ownership question. When developers write comments to explain intent, those comments are evidence of human creative direction. When Claude writes the code and the comments, and the developer merges without adding their own explanation of the architectural decisions, the record of human authorship disappears along with the institutional knowledge. The documentation problem and the copyright problem are the same problem.

The place where it concretely matters is M&A due diligence. Acquirers are now routinely asking about AI tool usage in development and running license scans as a condition of closing. A codebase that cannot demonstrate human authorship over its core IP, or that contains GPL contamination, creates a representation and warranty problem in the purchase agreement. For most companies day to day you are right. For the companies that get acquired or raise institutional capital, the question becomes very concrete very quickly.

That is exactly the right question and the answer is genuinely strange. Uncopyrightable work falls into the public domain, which means anyone can use it, copy it, or build on it freely. The employer can still call it a trade secret and protect it through confidentiality obligations in employment contracts, but that protection is contractual rather than property-based. A trade secret loses protection the moment it is disclosed. So the employer's claim over purely AI-generated code is essentially: "you cannot share this" rather than "we own this." Those are meaningfully different legal positions, and most companies have not thought through which one they actually have.

The compiler analogy is the right one to reach for and the Copyright Office addressed it directly: the question is not whether you provided input, it is whether the creative expression in the output reflects human authorship. With a traditional compiler, the programmer authors every expression in the source. With an LLM, the programmer authors the intent and the model makes the expressive decisions about structure, naming, pattern, and implementation. Whether that distinction matters legally is what Allen v. Perlmutter is working through right now. The summary judgment briefing completed in early 2026 and it may be the next landmark ruling on exactly this question.

This is the sharpest point in the thread. You are right if the output has no copyright to begin with, there is nothing to assign. The employer's contractual claim over purely AI-generated code is not a copyright claim, it is a trade secret and confidentiality claim. Those are weaker protections: they require the information to remain secret, they do not survive disclosure, and they cannot be enforced against independent creation of the same code. Most IP assignment clauses in employment contracts were not drafted with this scenario in mind and may be claiming rights that do not legally exist.

The work-for-hire doctrine actually supports your intuition more than the AI authorship question does. The reason Anthropic likely owns Claude Code has little to do with whether Claude wrote it and everything to do with the employment contracts of the engineers who directed it. The DMCA takedown question is genuinely interesting though because DMCA requires the claimant to assert copyright ownership in good faith. If a court later found the codebase was predominantly AI-authored and therefore not copyrightable, the 8,000 takedowns could be challenged as bad faith DMCA claims. That is a different and more tractable legal question than the ownership one.

A few things worth flagging: On GDPR: Using a named individual's identity to generate commercial AI output isn't obviously covered by "legitimate interest." Affected EU-based individuals likely have real grounds to object or request erasure. On IP/publicity rights: You can't copyright an editing style — but you absolutely can have a right of publicity claim when a company profits from your name and simulated judgment without consent. The Lanham Act's false endorsement provisions could also be in play here. The kicker: The "sources" cited by the feature were broken, spammy, or pointed to completely unrelated content. So the defense that suggestions are inspired by someone's actual work may not even hold up technically.