Who Owns AI-Generated Code? What the Law Says

When someone asks who owns AI-generated code, they are usually asking three different questions at once and getting a muddled answer because of it. Pulling them apart is most of the work:

1. Can you hold copyright in code a model wrote for you?

2. Could that code carry someone else's rights because of what the model was trained on?

3. What do your vendor's terms of service actually grant you?

They have different answers, different risk profiles, and different things you can do about them. This covers US law, which is where the clearest guidance exists, and none of it is legal advice for your specific situation.

Question 1: Can you copyright it?

The short answer is that purely AI-generated output is not copyrightable, and your own contributions around it may well be.

The US Copyright Office addressed this directly in its report on copyrightability released on 29 January 2025. The core holding is that human authorship remains a bedrock requirement, so a work generated entirely by AI is not protected. Existing law does protect original human expression in a work, even where AI tools were used or AI-generated material is included.

The part that surprises people: prompting alone does not get you there. As multiple analyses of the report summarize, the mere selection of prompts, however detailed and however much effort went into them, does not by itself produce a copyrightable work. Writing an elaborate specification and accepting what comes back is not authorship in the copyright sense.

Where a work mixes human and AI-generated content, only the human contributions are potentially protected, and using AI as a tool within a human creative process does not poison the whole work.

For working software, this matters less than it sounds. Most real projects involve substantial human selection, arrangement, modification, and integration, all of which are human contributions. The architecture you chose, the code you edited, the way the pieces fit together: that is yours. A file you accepted verbatim from a single prompt, with no changes, sits on much weaker ground.

Practical consequence, and it is a small one: if copyright in your codebase matters commercially, keep evidence of human involvement. Meaningful commit history and code review records do this as a side effect of working normally. Reviewing what the model produced is something you should be doing regardless, and it happens to strengthen your position here too.

Question 2: Does the code carry someone else's rights?

This is the question with real financial exposure, and it is unsettled.

Models are trained on enormous quantities of public code, including code under copyleft licenses like the GPL that impose obligations on derivative works. The concern is that a model might reproduce a substantial, recognizable portion of a training example, handing you licensed code with the license stripped off.

How the courts are treating training itself has started to clarify. In litigation against Anthropic, a court found that training on lawfully acquired books was fair use, while declining to extend that to a library assembled from pirated sources; the case subsequently settled for a reported 1.5 billion dollars. Norton Rose Fulbright's 2026 survey of AI copyright cases describes the emerging pattern as fact-specific: training on copyrighted material is neither automatically infringing nor automatically fair use, and outcomes turn heavily on how the corpus was acquired and whether output competes with the original work's market. The New York Times case against OpenAI, which centers on near-verbatim reproduction of articles, remains the one most closely watched.

None of that resolves the question for code specifically. What it does tell you is that verbatim reproduction is the pressure point. Training in the abstract is defensible in a way that regurgitating a recognizable chunk of a specific work is not.

The practical risk is genuinely low for ordinary application code, and it is not zero. Models generate a plausible continuation token by token rather than retrieving stored files, as covered in how a model actually produces output, so most output is novel recombination rather than copying. Reproduction concentrates in a narrow band: distinctive, widely-copied, memorable implementations. A standard CRUD handler is not that. A famous algorithm implementation with unusual variable names might be.

What actually reduces this risk:

• Turn on the vendor's duplicate-detection filter if one exists. Several coding assistants offer a setting that blocks or flags output matching public code, and it is off by default in some products.

• Search any suspiciously polished block. If a function arrives complete, idiomatic, and with comments you did not ask for, paste a distinctive line into a code search engine. Thirty seconds.

• Take the indemnity seriously in vendor selection. Several enterprise plans now indemnify customers against third-party IP claims arising from output. Read the conditions, which usually require you to have enabled the filtering above.

Question 3: What do your vendor's terms actually say?

The most immediately actionable question, and the one people skip.

Major coding assistant providers generally assign you whatever rights they have in the output, and this varies by provider and by plan, so it needs checking rather than assuming. Three things to look for in the terms you are actually on:

Output ownership. Does the provider assign output rights to you, and does that apply to your plan tier or only to paid or business tiers?

Training on your input. Whether your prompts and code are used to improve models is usually a setting rather than a fixed policy, and defaults differ between consumer and business products. This overlaps with the broader question of what happens to data you give an AI tool.

Indemnification. If it exists, what conditions attach. Filters enabled, current version, paid tier, prompt notice requirements.

Check these against the vendor's own documentation rather than a summary. Secondary sources on vendor policy are frequently out of date or simply wrong about defaults.

What this means in practice

For most people building an application, the honest summary is that this is a manageable and low-probability risk, not a reason to avoid the tools.

Your code is protectable to the extent you contributed to it, which for real projects is substantially. Your exposure to third-party rights is small and reducible with two settings and occasional vigilance. Your vendor terms probably grant you what you need, and take ten minutes to verify.

The situation deserves more attention if you are shipping code under a permissive open source license, where an inadvertently copyleft-contaminated contribution creates obligations for downstream users, or if you are in an acquisition or due diligence process, where buyers increasingly ask how AI-generated code entered the codebase and what controls existed. Being able to answer that concretely is worth more than a perfect legal opinion.

Regulatory disclosure requirements are a separate track again, moving faster in the EU than in the US, and the AI Act's transparency rules are the place to start if you sell into that market.

Frequently asked questions

Can I sell software that contains AI-generated code?

Yes. Nothing prohibits commercial use of AI-generated code. The limits concern what copyright protection you can assert over the AI-generated portions and the residual risk that some output reproduces licensed material.

Does my prompt count as authorship?

Not on its own, per the Copyright Office's January 2025 report. Prompt selection alone, however detailed, does not produce a copyrightable work. Human authorship comes from your selection, arrangement, and modification of what the model produced.

What if AI reproduces GPL code in my project?

If a substantial, recognizable portion of GPL-licensed code ends up in your codebase, the license obligations attach in principle regardless of how it arrived. This is why duplicate-detection filters and searching unusually polished output are worth the small effort.

Do I have to tell customers my code was AI-assisted?

Generally no under US law today. Sector-specific rules, procurement contracts, and EU regulation can impose disclosure obligations, so it depends on what you sell and to whom.

Is code I write with AI assistance treated differently from code AI wrote alone?

Yes, and the difference is meaningful. Substantial human authorship strengthens your claim to copyright in the result. A file accepted verbatim from one prompt, unedited, is the weakest case.