The Copyright Question Begins Before the Prompt
This series examines the U.S. Copyright Office’s framework for copyrighted works used in generative AI systems, with a focus on one practical question: where, along the path from source material to public output, do copyright concerns arise, and what facts make one use more defensible than another? The answer cannot be found by asking only whether a model “learned from” copyrighted works. A reader who follows the work through acquisition, training, deployment, and output can distinguish a possible infringement from a fair-use defense, a licensing problem from a technical problem, and human authorship from machine-generated expression.
That distinction matters because the same system can perform several different acts. A developer may download and curate works, train a model on them, distribute model weights, add a retrieval system, and release outputs to users. A copyright owner may object to the initial copies, to the model’s ability to reproduce expression, to a retrieval summary that replaces an article, or to the market effects of high-volume generated material. These are related concerns, but they are not one legal event.
Why “training on copyrighted data” is too broad
The phrase sounds like a single transaction. In practice, it compresses a chain of decisions and relationships. What was copied? From where? By whom? For what purpose? Was the material licensed, owned, lawfully accessed, merely available on the internet, or obtained from an unauthorized source? Did the system use a broad collection to learn general patterns, or was it tuned to produce works resembling a particular author, song, character, or publication? Can users reach protected expression through the resulting system?
The Copyright Office’s Part 3 report on generative AI training treats those questions as central. It describes a rapidly changing field and offers an analytical framework rather than a ruling on any particular developer. Its conclusion is deliberately conditional: existing law can address the new technology, but the result depends on the works used, their source, the purpose of the use, and controls on outputs. Some uses may be fair; some may not be.
The stakes run in both directions. Generative AI developers argue that large and diverse bodies of material help models perform useful tasks, and that requiring permission for every work could make research and competition impractical. Creators and copyright owners argue that unlicensed copying can appropriate the expressive value of their work, enable competing outputs, and weaken markets that support future creation. Neither concern can be evaluated well if “AI training” is treated as a magic word that settles the issue before the facts are known.
The reports also place a boundary around what they do not decide. Part 3 identifies points where copying or other exclusive-rights issues may occur, but says allocation of liability for infringing outputs will be addressed in a later part of the report. It should therefore not be read as a complete answer to who is responsible whenever a system produces a problematic output. Part 2 addresses a different endpoint: whether an output containing AI-generated material includes enough human authorship to receive copyright protection. That question is connected to training, but it does not answer whether the training was lawful.
One work, several legal moments
A useful way to understand the subject is to follow a work through the system. The first stage is acquisition and curation. Developers may collect material through web crawlers, public databases, user interactions, owned collections, or licenses from third parties. They may also rely on datasets assembled by others. The raw material is then filtered, cleaned, deduplicated, weighted, or compiled. Each operation can involve copies or modified versions. “Publicly available” often means visible or downloadable on the internet; it does not by itself mean that the copyright owner authorized the use.
The next stage is training. A neural network adjusts numerical parameters as it compares predicted outputs with examples. In language models, the process commonly involves predicting the next token from preceding context. Image, audio, and video systems use analogous learning objectives. The model’s weights reflect patterns learned from the training material, but the report records disagreement about whether those weights should be understood as statistical abstractions, retained copies, or something that can be either depending on the example.
Training is also not necessarily one event or one actor’s work. A broad initial phase may be followed by continued training, fine-tuning, or alignment for a narrower task. A third party may further train an already distributed model. A label such as “pre-training” or “fine-tuning” does not reveal what data was used, why it was used, or how much it influenced later behavior.
Deployment adds another layer. Users generally interact with a larger system rather than with bare weights. The system may call a search engine, consult a retrieval database, apply hidden instructions, or filter prompts and outputs. Retrieval-augmented generation, or RAG, can supply individual works as additional context when a user asks a question. A cloud service may remain under the developer’s control, while an on-device or open-weight model may be copied, retrained, and deployed by others. These choices affect both control and public access.
This technical story also explains why “the model needed all of the internet” is not a complete legal argument. The report describes scale as an important driver of performance, but it also notes that the value of more data is contested and that quality can matter more than quantity. Developers choose material for the model’s intended purpose: legal documents may help a legal system, medical literature may help a medical system, and broad foundation models seek varied language and subject matter. The choice of data is therefore evidence about what the developer was trying to make the system do, not just evidence about how much material was available.
Curation makes that purpose visible. A dataset may remove duplicates, watermarks, navigation text, or low-quality material; it may give extra weight to a domain or combine several collections to improve a capability. Those steps can improve a model, but they also create a more specific record of what was selected and why. A work that was merely present in a large crawl is not necessarily being used in the same way as a carefully selected collection of expressive works intended to produce a particular kind of output. That difference does not decide a copyright claim, but it can change the facts a decision-maker must examine.
Nor is a model simply a publicly readable copy of every work it encountered. The report records a real disagreement about what model weights retain. Some developers describe weights as numerical relationships rather than copies; other evidence shows that a model can sometimes produce verbatim or nearly identical material. The careful conclusion is conditional. If a system can generate protected expression without receiving that expression from a prompt or retrieval source, the expression must exist in some form within the model. If the system instead retrieves a work at the moment of answering, the relevant copy may belong to the deployment layer. The distinction is technical, but it determines which evidence matters.
This map shows why legal analysis must track transitions. A copy made while assembling a dataset is not the same event as a retrieved article displayed to a user. A model that can reproduce a memorized passage raises a different question from a system that uses a source only to classify or translate content. A guardrail may reduce what users can access, but it does not erase the earlier fact that a work was copied. The system’s design changes the evidence that a court or policymaker would need.
The questions a durable answer must keep separate
The first distinction is between a possible violation and a defense. Copyright owners have exclusive rights that can be implicated by reproduction, distribution, public display or performance, and derivative works. The Copyright Office says that downloading, transferring, reformatting, filtering, and compiling copyrighted works can create reproductions. Training may involve local and temporary copies. RAG may copy material into a retrieval database or at the moment it is retrieved. Outputs that replicate or closely resemble protected works may raise reproduction or derivative-work questions.
That does not mean every identified copy loses a case. Fair use is an affirmative defense under section 107, and its four factors are balanced in light of the circumstances. The Office emphasizes that the same copying may be fair for one purpose and not another. A system used for research or a constrained, non-substitutive task presents a different question from one trained or deployed to generate unrestricted expressive material that competes with its sources. Commerciality, lawful access, the nature of the works, the amount copied, public exposure, and market effects all matter.
Imagine the same copyrighted novel appearing in three systems. In one, it is part of a broad model used to translate or classify text. In another, a retrieval system supplies passages so the product can answer a user with a detailed summary instead of directing them to the novel or an article about it. In a third, a narrowly tuned system is marketed to generate stories that closely resemble the source’s expressive world. The work has not changed, but the purpose, access route, output, and market relationship have. That is why a responsible analysis must describe the use before it weighs the defense.
The second distinction is between permission to use a source and protection for an output. In Part 2 on copyrightability, the Office states that copyright requires human authorship. Using AI as an assistive tool does not remove protection from human expression, but purely AI-generated material is not protected under the Office’s analysis of current technology. Prompts alone generally communicate ideas without controlling how a system executes expressive elements. Human-authored inputs that remain perceptible, creative selection and arrangement, and sufficiently original modifications can receive protection for the human contribution. None of those rules grants permission to train on another person’s work.
The third distinction is between a legal conclusion and a practical response. Where fair use is uncertain or weak, licensing may be the durable path. The Part 3 report describes direct and collective licensing in some sectors, while also recognizing that ownership can be diffuse, transaction costs can be high, and no emerging market has yet proved capable of serving every kind of model and work. A licensing deal can address consent and compensation; it does not by itself guarantee that a model will never memorize expression or that every output is noninfringing.
A responsible assessment therefore starts with a fact record, not a slogan. Identify the work and its source. Name the actor and stage. Describe the purpose and the system’s deployment. Determine what was copied and what, if anything, became accessible to users. Check the controls and their actual effectiveness. Then ask which fair-use factors and licensing markets are relevant. If the question concerns an output, separately identify the human-authored expression, if any, that can be claimed.
This is the durable lesson of the Copyright Office’s framework: copyright boundaries follow the system’s use and consequences. The next necessary step is to understand the technical pipeline closely enough to see how source works become curated training material, learned weights, retrieval context, and user-facing behavior. Without that map, legal categories will remain too broad to guide judgment.