Legal architecture for companies building, licensing, and deploying AI. We settle governance, ownership, data rights, and regulatory exposure in the documents before a model ships.
The Copyright Office will not register material a model generated on its own, and a federal appeals court agreed in 2025 that an author has to be human. A company that pays for generated code, copy, or images owns whatever its contract says it owns and nothing more, which is why output ownership, training rights, and the indemnity are the three clauses we read first in an AI agreement.
The regulation arrives on fixed dates. The EU AI Act's prohibitions have applied since February 2025 and its duties for providers of general-purpose models since August 2025. Since January 2026 Illinois employers must notify employees when an automated tool is used in a hiring or promotion decision and may not use one with a discriminatory effect.
We act for companies that build models, companies that deploy them, and the investors behind both: we trace what a model was trained on before anyone warrants it, put ownership and liability in the agreement rather than the pitch deck, and map which regimes a specific system triggers, with locally admitted counsel where a matter reaches a foreign regulator.
Internal governance frameworks and acceptable-use policies that define what data may be fed to a model, who approves a use case, how outputs are reviewed, and where human oversight is required before deployment.
Licensing of foundation models, fine-tuned systems, and training datasets, covering scope, field-of-use, data provenance, and the representations and indemnities that keep a build defensible as it scales.
Authorship, IP ownership, and rights allocation for AI-generated work product, documented in the contract so ownership of inputs and outputs is settled by agreement while copyright law catches up.
Mapping the developing privacy, consumer-protection, transparency, and sector rules to a specific system, with coordination of additional or locally admitted counsel where a matter crosses borders.
Drafting and negotiating the agreements that buy, sell, and embed AI, with the data rights, performance and accuracy terms, confidentiality, indemnification, and liability allocation a standard SaaS template was never written to handle.
Consent, provenance, and privacy compliance for training and inference data, the layer beneath every AI system, structured so the lawful basis for the data is established before the model relies on it.
The Copyright Office registers a work containing AI-generated material only for the human contribution, and an applicant must disclose generated content that is more than minimal. A prompt alone does not make the prompter an author. The same logic governs patents: a natural person must have made a significant contribution to each claim.
In 2025 the earliest federal rulings on model training treated learning from lawfully bought books as fair use while leaving the use of pirated copies exposed. Add website terms that forbid scraping, licenses that forbid fine-tuning, and biometric data that Illinois law requires consent to collect, and provenance becomes a diligence item.
The EU AI Act sorts systems into tiers, and a high-risk system used in employment or credit carries conformity assessment, logging, and human-oversight duties. Colorado's AI Act asks deployers of similar systems for an impact assessment and a notice to the person affected. Where a system lands decides the compliance budget, so classification comes first.
A model provider's copyright indemnity typically falls away if the customer fine-tuned the model, disabled a safety filter, or knew the output infringed, and it rarely covers claims arising from the customer's own prompts or data. The no-training-on-your-data promise often applies to one API tier and not the consumer product the staff actually use.
ISO/IEC 42001, published in 2023, is an AI management-system standard a company can be certified against, and the NIST AI Risk Management Framework supplies the vocabulary regulators and customers use. A working program has an inventory of systems in use, an approval gate before a new use case ships, and a log of model changes.
The FTC treats unsubstantiated accuracy and capability claims for AI products as deceptive advertising and ran an enforcement sweep on them in 2024, the year the SEC also charged advisers who overstated their use of AI. It has also ordered the deletion of models trained on data a company should not have held.
Before anything ships, we trace what the model was built from: training-data provenance, dataset and model licenses, open-source and copyleft terms, scraped-content exposure, and whose personal data is embedded in the weights. The output is a defensible map of what you own, what you license, and what you merely tolerate.
We paper the stack, meaning the training-data licenses, model and API terms, fine-tuning and output-ownership provisions, and IP indemnities calibrated to real infringement risk, so every input the model learned from and every output it produces sits on a contractual right.
An AI governance framework goes in before deployment: acceptable-use policy, human-oversight and documentation requirements, and a jurisdiction-by-jurisdiction map of the moving regimes, from the EU AI Act's risk tiers and Colorado's AI Act to FTC unfairness authority and the sectoral regulators.
Once live, the work becomes evidentiary. Incident and model-change logging, vendor and customer AI terms kept current as regulation shifts, and an AI diligence file all have to stand up when an acquirer, investor, or regulator asks how the system was built and governed.
A model is only as ownable as the rights it was trained on.
The work starts with provenance: what a model was trained on and whether the company holds a right to each source. It moves to ownership, since the Copyright Office will not register purely machine-made material and a contract has to fill the gap. It then maps the rules that reach the use case, from the EU AI Act's risk tiers to Illinois's employment notice rule to the FTC's authority over deceptive claims. And it ends in the contracts, which have to say what happens to data, outputs, and liability when the model is wrong. The practice sits where corporate, intellectual-property, and privacy law meet, and it does the most good before a model ships.
As between you and the model provider, whoever the contract says; most provider terms assign output to the customer, subject to the provider's own license to use it. As against the world, less than you may think. The Copyright Office registers only the human contribution to a work that contains AI-generated material, a federal appeals court confirmed in 2025 that an author must be human, and the Patent Office requires a natural person to have contributed significantly to each claim. We therefore document ownership, license scope, and indemnity in the agreement and keep a record of the human authorship that can be protected.
Yes, and a short one that is followed beats a long one that is not. The EU AI Act expects providers and deployers of high-risk systems to maintain documentation, logging, and human oversight; Colorado's AI Act asks deployers for impact assessments and notices; a customer's procurement team increasingly asks for alignment with ISO/IEC 42001 or the NIST AI Risk Management Framework. The core of a workable policy is an inventory of the systems in use, a named owner for each, and an approval gate before a new use case or a new data source goes live. The board will ask who signed off, and the policy is the answer.
By layers, and the answer turns on what the system does and where its users are. In the EU the AI Act bans a short list of practices, has imposed transparency and documentation duties on general-purpose model providers since August 2025, and regulates high-risk uses in employment, credit, and essential services. In the US there is no single statute: the FTC polices deceptive AI claims and unfair data practices under Section 5, the CFPB requires specific reasons in an adverse-action notice even when a model made the decision, and states have added their own rules, Illinois among them since January 2026. We map the exposure to the specific use case and coordinate with locally admitted counsel where a matter reaches a foreign regulator.
Start with the data: who may use the inputs, whether the provider may train on them, and how long they are retained. Then the outputs: an assignment to the customer, a license back to the provider if one is needed, and an acknowledgment that neither party can promise copyright in machine-made material. Then the failure terms: an accuracy or performance standard the product can actually meet, a remedy when it does not, and an indemnity whose exclusions have been read, because the standard carve-outs for fine-tuning, disabled safety features, and customer-supplied data are where the risk returns. A SaaS template answers none of this, which is why it is not the starting document.
Yes. We scope the engagement to the company in front of us, its size, sector, and stage, and we sit within a broader corporate practice, so the same partner who sets up your AI governance can reach IP, privacy, financing, and disputes counsel without handing you off. For earlier-stage companies, Corporate Counsel On Demand provides board-level judgment without the cost of a standing department.
Disclosure, governance, and the public-market obligations that follow a company through the regulatory questions AI now raises for boards and investors.
Explore →Board structure, fiduciary duty, and federal and state securities compliance for companies whose AI decisions now sit on the board's agenda.
Explore →Disclosure, policy, and risk frameworks where responsible-AI commitments meet a company's broader governance and reporting obligations.
Explore →Diligence and deal structuring where AI assets, data rights, and model licenses are part of what is being bought or sold.
Explore →Reviewed by Jonathan D. Herpy, Sr., Senior Partner · Last updated October 2026 · Educational overview · Not legal advice
One partner is accountable for the whole matter, and you have that partner's direct line. Chicago, London, and Dubai work to the same standard.