Where the System Makes Copies
The Copyright Office’s training framework asks a narrower question than “does an AI model contain copyrighted data?” It asks where a copyrighted work was copied, who made the copy, what happened to the work at that stage, and whether the facts support a claim involving reproduction or a derivative work. Mapping those events lets a reader discuss legal risk precisely without treating the existence of a model as a final judgment about liability.
The distinction matters because a generative AI supply chain can contain several actors: a collector or dataset provider, a model trainer, a distributor of weights, a deployer that adds retrieval and filters, and a user who requests an output. The technical pipeline described in the previous chapter supplies the facts. This chapter translates those facts into a rights map, while keeping a possible infringement separate from the fair-use defense and from the unresolved question of who may be responsible for a particular output.
Reproduction can begin before training starts
Under the Copyright Office’s analysis, a prima facie infringement claim has two basic elements: ownership of a valid copyright and copying of original elements of the work. “Prima facie” means that the initial elements of a claim appear to be present; it does not mean the claimant has defeated a defense. In the training context, the first possible copying event may happen before a model sees a single example.
A developer or dataset provider may download a work from a website, transfer it to another storage system, convert it into a different format, or make several working copies for processing. A filtering system may create a subset. A cleaning process may remove portions of a document. A compilation may combine material from several datasets. These actions can be technically ordinary and still create copies of a protected work. The fact that a later training run uses only a transformed or filtered version does not make the earlier copies disappear.
The source of the work is a separate fact. A publicly accessible page, a licensed database, a customer-provided file, and an unauthorized copy may all be downloaded with the same automated command. They do not carry the same legal history. The report emphasizes that “publicly available” is often shorthand for “available on the internet,” not a statement that the copyright owner authorized AI training. A rights analysis that records only the download but not how access was obtained loses a fact that may later matter under fair use.
Curation can also raise more than a reproduction question. Developers may abridge, rewrite, reorganize, or augment existing works while preparing training material. A work can be translated into another format, paired with a generated caption, or combined with metadata. Some of those steps may implicate the right to prepare derivative works, depending on what was changed and whether protected expression was carried into the new version. Removing author, title, or ownership information can raise a separate issue under copyright-management rules, but the supplied training report reserves that analysis for a later part.
Deletion does not necessarily solve the initial problem. A provider may discard a raw image after extracting information from it, or a developer may delete a dataset after a training run. The earlier reproduction still occurred. Retention matters for other questions—what can be audited, what can be used again, and whether a later actor can access the work—but it is not a retroactive undo button for a copy already made.
The training step itself can create additional reproductions. Large-scale training is generally more efficient when data is placed on high-performance storage. During a run, examples are loaded into batches, shuffled, cached, and presented to the model. Depending on the hardware and software, those copies may last long enough to count as fixed copies rather than merely fleeting signals. The report does not say that every temporary buffer satisfies the same legal test; fixation depends on whether the embodiment is stable enough to be perceived, reproduced, or communicated with the aid of a machine for more than a transitory duration.
This is why “the dataset was deleted” and “the model only saw the work briefly” are incomplete answers. The relevant questions include how many copies existed, where they were stored, how long they lasted, and what technical process created them. A temporary copy may be difficult to prove or may carry less practical significance than a durable training dataset, but its legal relevance cannot be assessed from the word “temporary” alone.
The number of works does not change the basic shape of this inquiry. A dataset may contain millions of works, and any one work may be a small part of the whole. But scale is not a volume discount that eliminates the need to identify what happened to an individual work. The legal question remains tied to the copied work and the particular act. Scale can affect necessity, practicality, and market consequences later; it does not by itself answer whether a copy was made.
The same point applies when multiple organizations divide the work. A dataset provider may perform the first download and curation. A model developer may copy the finished dataset into its own storage. A research organization may train a model and release the weights. A downstream company may continue training those weights on additional material. Each actor may have a different role, purpose, access path, and record of what they did. Treating the entire chain as the conduct of a single abstract “AI company” can obscure both responsibility and defenses.
The sequence makes a crucial distinction visible: the system can make a copy at collection, another during training, and another when retrieval supplies material to a response. Those events may involve different actors and different purposes. A legal analysis that starts only with the final output has already skipped part of the path.
Weights, retrieval, and outputs create different questions
Model weights sit at the most contested point in the map. Technically, weights are numerical values that encode a neural network’s learned mapping from inputs to outputs. Some developers and commenters describe them as statistical relationships rather than copies of the training data. Other evidence shows that models can sometimes generate verbatim, nearly identical, or substantially similar material from their training examples. The careful legal question is therefore conditional, not categorical.
If a model can produce a particular work’s protected expression without receiving that expression through a prompt or an external retrieval source, the expression must exist in some form within the model. The fact that the expression is represented as numbers rather than as a readable document does not by itself prevent it from being fixed. A digital image, for example, can be encoded mathematically and still be reproduced or perceived with the aid of a machine. If the model’s weights retain substantial protectable expression, copying or distributing those weights may implicate the reproduction right.
That conclusion should not be stretched into “every model is a library of all its training works.” The Office reports that memorization varies. It can be influenced by the number of parameters, duplicate examples, repeated training on the same example, unusual or outlier material, the point at which an example is encountered, and the definition of memorization being used. A model may generalize broad language patterns while also retaining some unusually specific passages. The existence of weights alone does not establish which situation applies to a particular work.
The derivative-work question is similarly fact-dependent. Some rightsholders argue that a model is an abstract transformation of its training material and can generate protected copies. Others argue that the model is too far removed from the works to be a derivative work because it does not present their protected aspects to users in ordinary operation. The Office’s framework focuses on whether the model has retained substantial protectable expression from the work or works at issue. Preparation and training may implicate reproduction, but copying the resulting weights raises a derivative-work issue only where the facts support substantial similarity.
The system’s deployment can produce a different kind of copy even when the weights do not retain the relevant expression. Retrieval-augmented generation, or RAG, typically works in one of two ways. A developer may copy works into a retrieval database and later supply relevant material to a model alongside the user’s prompt. Or the system may retrieve a work from an external search engine or website when the user asks a question. In either case, the response process may make a reproduction of the retrieved material. The work may then be summarized, quoted, abridged, displayed in an interface, or retained in conversation state.
This distinction matters for a simple reason: a retrieved article is not the same source as a learned language pattern. If a system answers a question by searching for current reporting and passing the full text to the model, the relevant evidence may be found in the retrieval index, the search request, the text supplied to the model, and the response delivered to the user. If a model produces a rare passage without any retrieval, the investigation turns toward the weights and the earlier training process. Similar words in the final answer do not, by themselves, reveal which path occurred.
Outputs can raise their own rights questions. Users have demonstrated systems producing near-exact replicas of images, recognizable copyrighted characters, or text from news stories. An output that reproduces protected expression may implicate the reproduction right. An output that adapts an original may also implicate the right to prepare derivative works. Depending on the medium and audience, displaying or performing the output can create additional questions. These are possible rights issues, not automatic findings that every similar-looking output infringes; substantial similarity, protectability, access, and the actual expression all remain relevant.
Output controls change the evidence but do not erase the pipeline. A prompt filter may block a request for a song lyric. A system instruction may discourage a request for a named character or a living artist’s style. An output filter may prevent a response from reaching the user. Training may also be designed to make certain reproductions less likely. If those controls work, the public may receive little or none of the protected expression that was copied internally. If they are inconsistent or easily bypassed, the system’s actual behavior may tell a different story from its stated policy.
Control is also distributed through deployment. A company that keeps weights on its own servers may control the interface, retrieval tools, filters, and updates. A company that releases downloadable weights gives others the ability to retrain or deploy the model, subject to whatever license terms are enforceable. An on-device model may be embedded in software and updated through a different channel. Those arrangements do not automatically assign liability, but they determine who made later choices and who could have changed the system’s behavior.
The resulting rights map has four separate questions. First, was a protected work copied during collection, curation, storage, training, retrieval, or output? Second, did a model or output retain or reproduce protected expression closely enough to matter? Third, which actor controlled the relevant copy or user-facing behavior? Fourth, is there a defense, such as fair use, or a license that authorizes the act? The answer to one question cannot be silently substituted for the others.
The supplied report deliberately stops short of allocating responsibility for every infringing output. That question may depend on the conduct of the trainer, weight distributor, deployer, retrieval provider, or user, as well as on notice, control, and the system’s design. The report identifies the places where rights may be implicated; it does not decide every downstream liability dispute. Once the relevant act has been identified, the next question is whether its purpose and character support fair use, and how the other statutory factors change the balance.