Introduction

To avoid copyright infringement when using artificial intelligence, a business should control three stages:

  • the documents and data supplied to the tool,
  • the instruction given to the AI system,
  • the content ultimately released.

In AI terminology, these are often called the “input”, “prompt” and “output”. The input is the material supplied to the system, the prompt is the instruction, and the output is the generated text, image, code, video or audio. These technical terms describe the process; they do not determine ownership or whether the result may lawfully be exploited.

Even where the provider permits commercial use of an output, it does not necessarily guarantee that the output does not reproduce a third party’s work. The business consequences are practical: withdrawal of a campaign, platform removal, redesign costs, a licence demand, infringement proceedings or reputational damage. The appropriate response is not to prohibit AI, but to apply controls proportionate to the value, audience and expected lifetime of the content.

Why can AI-generated content infringe copyright?

Under French law, Article L. 122-4 of the Intellectual Property Code prohibits the unauthorised reproduction, representation, adaptation or transformation of a protected work. “Right holders” include persons or companies to whom the author’s rights have been transferred. Copyright infringement means the unauthorised exploitation of original elements of a work. Using AI does not change the rule: a business may incur liability where it releases an output containing such elements, even if they were generated automatically.

The assessment is not limited to a similarity percentage. The Court of Justice of the European Union considers whether the creative choices of the earlier work remain recognisable in the disputed material (CJEU, December 4, 2025, Joined Cases C-580/23 and C-795/23). A shared idea, theme or general mood is usually insufficient. Risk increases where the output retains a particular composition, original wording, an individualised character, a sequence of scenes, a melody or other identifiable expressive elements.

Prompts requesting content “in the style of” an artist therefore require caution. Copyright does not generally protect an abstract style, but copying precise elements may be unlawful.

Other rights may also apply:

A business review should therefore extend beyond copyright alone.

How should content and instructions supplied to an AI system be secured?

Distinguishing the two situations that may expose the user to risk

  • Where the user provides a protected work to the AI system, such as an image, text, video or piece of music, they must check that they are authorised to copy, modify and use it to generate new content. The fact that a document is available online does not mean that it is free to use. The risk is particularly significant where the user asks the AI to reproduce the work, retain its composition or reuse its recognisable creative elements.
  • Where the user enters only a prompt, without uploading any document, the generated output may nevertheless closely resemble an existing work. The user may be unaware of that work and may not have requested its reproduction, but this does not automatically eliminate the risk of infringement. Before any publication or commercial use, the business should therefore check whether the output reproduces specific and recognisable elements of an earlier creation. Where doubt remains, it is preferable to regenerate the content, modify it substantially or refrain from using it.

For a broader overview of the protection of AI-generated content, we invite you to read our article: "Copyright and Generative AI".

Exclude prompts that request or facilitate copying a copyright-protected work

The instruction should not enable copying of any protected content. A request to reproduce, continue or faithfully imitate an identified work creates a direct risk. By contrast, asking for an original analysis based on facts, without reusing the wording, structure or examples of the sources, reduces that risk. It does not eliminate it: the output must still be reviewed, compared and, where the stakes justify it, legally approved before release.

Teams should also avoid combining, without a genuine need, the name of an author or artist, the title of a work, a protected character, a trade mark and highly detailed composition instructions. Prompts, successive versions, authorised sources and human changes should be retained. This record helps demonstrate an independent creation process, speeds up internal approval and supports an effective response if a claim is made.

How should an AI-generated output be reviewed before release?

Apply a review proportionate to the commercial risk

Before external release, a business should apply a pre-publication legal review of the relevant rights before publication. The review may be light for an internal draft, but it should be strengthened for an advertising campaign, product launch, high-audience content, distributed software or material intended for use in several countries:

  • Identify elements that may be protected and the works, trade marks, individuals or content to which the output appears to refer;
  • Carry out searches suited to the format and assess whether recognisable creative choices have been reproduced, rather than relying only on an automated similarity score;
  • Make a documented decision: approve the output, redesign it substantially, generate a new version, obtain a licence or discard it.

Similarity software may flag a concern, but it does not replace human judgement. Changing a few words, colours or details is insufficient where the essential creative structure remains recognisable. The scope of review should reflect the audience, budget, territories, exploitation period, brand visibility and the difficulty of withdrawing the content after publication. The higher the cost of removal, the earlier clearance should occur.

Adapt the review to the relevant format

Text and software:

For text, the review should cover unusual wording, quotations, titles, highly specific structures and lengthy passages. For software, it should include licence notices, comments, characteristic code blocks and dependencies. Functional code may contain open-source components subject to attribution, share-alike or source-disclosure duties. Those duties must be compatible with the business model, cybersecurity policy and customer commitments.

Images, video and audio:

For images, reverse-image searches and visual comparisons should cover composition, characters, settings, logos and distinctive details. Video and audio reviews should examine clips, scripts, shots, lyrics, melodies, arrangements, performances and voices. Since August 2, 2026, Article 50 of the AI Act and the European Commission guidelines also impose certain transparency duties, particularly for deepfakes, meaning manipulated content that makes a person appear to have said or done something. Disclosure that content was generated or altered by AI may be mandatory, but it does not cure infringement of third-party rights.

What legal and operational governance should a business implement?

Select tools on the basis of verifiable safeguards

Before approving a tool, legal, procurement, security and business teams should review five points:

  • rights in inputs and outputs,
  • provider reuse of data,
  • prohibited uses,
  • third-party rights warranties,
  • indemnification.

Indemnification is the provider’s potential commitment to cover some or all costs of a claim. A commercial-use clause only governs the relationship with the provider; it is not a rights clearance and does not constitute permission from owners whose protected material may appear in the output.

Under Article 53 of the AI Act, providers of general-purpose AI models third-party rights warranties must maintain a policy for compliance with EU copyright law and publish a sufficiently detailed summary of training content. This information can support supplier selection, but it does not guarantee each output or transfer to the provider all responsibility for content released by the business.

Assign responsibility and retain evidence

An effective internal policy identifies approved tools, information that must never be supplied, uses requiring approval and the person accountable for the final decision. Projects can be classified by risk. Improving an internal draft may require limited review; a public campaign, cloned voice, code incorporated into a product or an image involving an identifiable individual justifies enhanced legal and business approval. This structure prevents low-risk projects from being delayed by controls designed for high-risk uses.

Agreements with agencies, studios and contractors should require disclosure of AI use, identification of relevant tools, compliance with licences, delivery of prompts and sources where appropriate, and warranties tailored to the intended exploitation. Internally, the approval file should include searches, licences, rejected versions, human changes and the release decision. This documentation supports a rapid decision to maintain, modify or withdraw content and, where necessary, recovery against the responsible supplier.

For further guidance on ownership and contractual arrangements, we invite you to read our articles: “How can one secure or assign rights in a work created with the assistance of artificial intelligence?” and our analysis of " Can artificial intelligence be freely used in the workplace? ".

Conclusion

Avoiding copyright infringement when using artificial intelligence does not require businesses to prevent innovation. AI should be treated like any other production tool: use authorised sources, avoid prompts that request copying, review outputs, assign human review and implement suitable contracts. The main difference is the speed of generation and limited visibility over the precise origin of some results, which makes traceability essential.

The business objective is to secure market release without imposing a full legal review on every use. A risk-based process reserves in-depth analysis for the most exposed content. Where serious doubt remains, release should be suspended until a licence has been obtained, a sufficiently different version has been produced or a targeted legal assessment has been completed.

Dreyfus Law Firm assists its clients in managing complex intellectual property cases, offering personalized advice and comprehensive operational support for the complete protection of intellectual property.

Dreyfus Law Firm works in partnership with a global network of attorneys specializing in Intellectual Property.

Q&A

Can a work created with the assistance of AI be protected by copyright?

Protection may be available where the final work reflects precise human creative choices, for example in selection, composition, structure or editing. A general prompt may not be enough. The business should be able to identify the human contributions and organise ownership of the corresponding rights by contract.

Does a Creative Commons licence always permit use of a work with AI?

No. Creative Commons licences do not all permit the same uses. Attribution, commercial use, adaptations and share-alike requirements must be checked. Supplying the work to the AI system, transforming it and exploiting the output are separate acts.

Must a business tell its customers that AI was used to produce content?

This depends on the contract, sector, content and applicable rules. Disclosure may be necessary where AI use affects customer warranties, involves personal data or concerns a deepfake. Even where it is not mandatory, a clear clause reduces misunderstandings about the production method and responsibility.

How long should evidence of the AI-assisted creation process be retained?

There is no single retention period. It depends on exploitation, contractual warranties, time limits for claims and the project’s value. For a major campaign, software product or reusable asset, it is prudent to retain prompts, sources, licences, versions and approvals throughout exploitation and beyond.

Does an indemnity offered by an AI provider fully protect the business?

Rarely. Indemnities often exclude claims arising from prompts, output modifications, user-supplied content or particular territories. Recovery may also be capped. The business should compare the indemnity with the project’s actual financial exposure and confirm that the relevant uses and countries are covered.

This publication is intended for general public guidance and to highlight issues. It is not intended to apply to specific circumstances or to constitute legal advice.