Someone else’s lawsuit, your contracts: how the Times case reached regulated AI buyers

The week

Two days after Christmas 2023, one of the world’s best-known newspapers took one of the world’s best-known technology partnerships to court. On December 27, The New York Times sued OpenAI and Microsoft in federal court in Manhattan.

Tools like ChatGPT are built on what are called large language models: software that has read an enormous quantity of text and learned the statistical patterns of language well enough to write fluent answers, summaries and drafts. The reading stage is called training, and the text used is the training data. The more high-quality writing a model sees, the better it tends to write. Professionally edited journalism is exactly that kind of writing.

The Times alleged that the companies had used millions of its articles without permission to train the models behind ChatGPT and Microsoft’s Copilot products, Microsoft’s family of AI assistants built into its software. It also alleged that the models could reproduce Times content closely, meaning that a user could sometimes get the tool to produce passages very like the newspaper’s own. The complaint sought damages and the destruction of models and training data built with Times works. That second demand was striking: beyond money, it asked for the removal of the products themselves, insofar as they were built on the Times’s work.

The complaint was long and unusually concrete. It set out examples in which, the Times said, GPT-4 had produced near-verbatim copies of large parts of its articles when given their opening passages. It also described a different harm: answers that credited the paper with things it had never published. One example involved Wirecutter, the Times’s product review site, which the complaint said GPT-4 had falsely credited with product recommendations. That allegation was about reputation and the paper’s name, separate from copying. The Times was objecting to what the tools said in its name as well as to what they had taken.

The Times said it had approached both companies in April 2023 to raise its concerns and seek fair value for its content, and that those talks had not produced a resolution. The complaint named no figure. It said the defendants should be held responsible for billions of dollars in statutory and actual damages. Statutory damages explain the scale. U.S. copyright law lets the owner of a timely registered work claim a set amount per infringed work without proving actual loss, and the range rises for willful infringement. Multiplied across a large archive, that structure turns a dispute about text into a claim measured in billions.

The pairing of defendants mattered to enterprise buyers. Microsoft had backed OpenAI since 2019, supplied the computing power behind its research and was building OpenAI’s models into products that many regulated organizations already licensed. A suit naming both reached the office software and developer tools on staff desks, as well as the chatbot some employees used in a browser tab.

The suit did not come out of nowhere. It joined a growing set of copyright suits against AI developers brought by authors, artists and other rights holders during 2023. And the vendors had seen the risk coming. In the months before, several vendors had announced commitments to defend enterprise customers against copyright claims arising from their AI products, including Microsoft in September and OpenAI in November. These promises, often described as indemnities, meant that if a business customer were sued over something the AI produced, the vendor would step in and defend it, on conditions.

The same month showed the other route open to publishers. In mid-December 2023, Axel Springer, the German publisher of Politico and Business Insider, announced a licensing partnership with OpenAI. It followed an agreement in July under which OpenAI licensed part of the Associated Press’s news archive. Licensing and litigation were two ways of settling the same question: what training on journalism was worth. In early January 2024 OpenAI published a public response. It argued that training on publicly available material was fair use and noted that publishers could opt out. It called the reproduction the Times described a rare bug it was working to eliminate.

Nothing switched off that week. ChatGPT, Copilot and the services built on them kept running, no court order touched them, and no customer contract changed. What changed was the risk picture around tools that many organizations had adopted quickly during 2023, often through pilots, free trials and features that arrived in software updates rather than through a procurement decision.

For a bank, a hospital or a government agency watching the news, the case looked like a fight between publishers and Silicon Valley. What mattered to them was narrower: if the legal ground under these tools was being challenged, how much of that challenge could land on the organizations buying and using them?

Copyright litigation between publishers and AI developers looks remote from the work of a bank, hospital or agency. They do not train frontier models, the largest and most capable systems at the leading edge, and are unlikely to be named as defendants. They are, however, heavy buyers of AI products whose legal footing the suit challenged, and three of their own choices set how much of that dispute could land on them.

Each corresponds to a different channel through which someone else’s case reaches a non-party. Together they cover the routes: the contractual channel, meaning the indemnity a buyer relies on; the publication channel, meaning the content it puts out under its own name; and the evidentiary channel, meaning the data its vendor holds that a court can order preserved. The legal and technical terms come first.

Copyright, fair use and how buyers get AI

Copyright gives the creator of an original work, such as an article, a book or a photograph, the exclusive right to copy and distribute it, with exceptions. The best-known exception in the United States is fair use, which allows some copying without permission depending on the purpose, the amount used and the effect on the market for the original. AI developers have generally argued that training a model is a transformative use of the material; rights holders have argued it is copying on an industrial scale. Courts take years to settle questions like that.

Why fair use was hard to predict

Courts weigh four factors: the purpose and character of the use, the nature of the copyrighted work, the amount taken, and the effect on the market for the original. No single factor decides a case, and judges weigh them differently on different facts. The fourth factor carried the most weight in the publishers’ suits. A newspaper can argue that a tool which answers readers’ questions with its reporting competes with the newspaper itself. A developer can answer that a model learns patterns and does not substitute for any particular article.

Facts about how the material was obtained also mattered. A developer that bought or licensed its sources stood on different ground from one that copied pirated collections. So did facts about outputs: a model that rarely reproduces its sources is easier to defend than one that can be coaxed into reciting them. These questions could not be answered from a press release, and buyers had no special insight into them.

Training claims and output claims

For a buyer, the most useful distinction is between two kinds of claim. A training claim says the developer copied works to build the model. It targets the company that did the copying, and a customer that merely uses the finished model is a remote target. An output claim says a particular piece of generated text, image or code reproduces a protected work. That claim can reach whoever copied, distributed or published the output, which may be the customer.

The distinction tells a buyer where to concentrate. Training disputes are the vendor’s fight, and the buyer’s main interest is that the product stays available and that the vendor remains solvent and willing to stand behind it. Output disputes can land on the buyer directly, and that is where indemnities, review steps and records do their work.

From the buyer’s side, the tools arrive in several forms. Some organizations use a chatbot directly through a web browser. Some connect their own software to the model through an API, an application programming interface, which is a standard doorway that lets one program send requests to another and receive answers. Others never touch the model provider at all: they use AI features built into software they already buy, such as a customer relationship system or a document editor, with the model running in the background.

Each route changes who the buyer has a contract with. A browser chatbot used on a personal account involves a consumer agreement between the vendor and an individual employee, not the organization. An enterprise subscription or API account creates a direct contract with the model provider. An embedded feature usually involves no contract with the model provider at all, only the existing agreement with the software vendor. The same model can therefore arrive under three very different sets of terms inside one organization.

Some organizations also have a model fine-tuned, meaning further trained on their own documents so it writes in their style or knows their products. Each of these routes carries different contractual terms, and that is where the three channels begin.

The indemnity a buyer relies on

In the months before the suit, Microsoft and OpenAI had each announced commitments to defend enterprise customers against copyright claims arising from outputs of their services. Both promised to pay resulting judgments, on conditions. Other vendors made similar promises. They shifted real risk from buyer to vendor, but their value lay in the terms.

What the first commitments said

Microsoft’s version, announced in September 2023 as the Copilot Copyright Commitment, covered paid commercial Copilot services, including Microsoft 365 Copilot and GitHub Copilot, and Bing Chat Enterprise. In November it was extended to commercial customers’ outputs from the Azure OpenAI Service and later renamed the Customer Copyright Commitment. Microsoft said it would defend a commercial customer sued by a third party for copyright infringement over use of the services or their outputs, and pay adverse judgments or settlements.

The conditions were stated plainly. Customers had to use the content filters and safety systems built into the products. They must not try to generate infringing material, and must not put into the service content they lacked the rights to use. For the Azure OpenAI Service, customers also had to implement the guardrails and mitigations Microsoft specified. OpenAI’s commitment, announced at its developer conference in November as Copyright Shield, applied to ChatGPT Enterprise and its developer platform.

Those conditions are more than fine print. They turn a legal promise into an operational obligation. An organization that builds its own application on a model service, and switches off a filter because it blocks legitimate content, may have stepped outside the protection without anyone in legal knowing.

Why vendors offered them

The commitments made commercial sense for the vendors. Large technology companies were better placed than their customers to defend copyright suits: they had the lawyers, the technical knowledge of their own systems and the budget. Customers, meanwhile, were hesitating. Risk committees at banks and hospitals were asking whether a new tool could expose them to claims nobody could size. A promise to defend removed an objection that was slowing sales.

That does not make the promises hollow. It does mean they were written by the party that benefits from broad adoption and narrow liability. The vendor drafts the scope, the conditions and the cap. A buyer that reads them carefully is doing what any counterparty does with terms drafted by the other side.

An indemnity is a promise by one party to cover another’s losses from a specified kind of claim. It is a familiar tool: a landlord may require a contractor to indemnify it against injuries on a job site. The question is always what is covered, under what conditions, and up to what amount.

Procurement and legal teams can test a commitment with five questions.

• Scope. Which products and license tiers does it cover, and does it reach outputs from fine-tuned or customized models?
• Conditions. What customer conduct voids it, such as disabling content filters or deliberately prompting for protected material?
• Caps. Is it capped, and does the cap sit inside the agreement’s general liability limit? If so, a copyright claim could use up protection the buyer was counting on for other problems.
• Claim types. Does it cover only copyright, or also trademark and other claims?
• Incorporation. Is it incorporated into the agreement that actually governs the organization’s use, rather than a public web page the vendor can revise?

Reading the cap and the conditions together

Caps and conditions interact. Many enterprise agreements carry a single aggregate liability limit that covers data breaches, service failures and indemnities together. If the copyright commitment draws on that same limit, one large claim could leave little protection for a later security incident. Some vendors carve indemnities out of the general cap; others do not. The answer is in the limitation-of-liability clause, not the announcement.

Conditions deserve an owner inside the organization. If the commitment requires that content filters stay on, someone must know which filters exist, who can change them and how a change is approved. Keeping them on is a configuration control, and it belongs in the same change-management process as any other security setting. Legal can read the clause; only engineering can keep the organization inside it.

How the question differs by buyer

Banks have an established framework for this. The interagency guidance on third-party relationships, finalized by the federal banking agencies in June 2023, asks banks to assess contract terms, including indemnification and liability limits, in proportion to the risk. An AI service used to draft customer communications fits that review without a new process. Examiners can be expected to ask whether the review happened and how its conclusions were recorded.

Credit unions follow their own supervisor, the National Credit Union Administration, and many rely on credit union service organizations and core processors for technology. For them the pass-through question in the next paragraph is often the main one, because AI arrives inside a core or digital banking platform.

Health systems usually run contract review through supply chain and legal, with privacy and security sign-off. Their bargaining power varies widely: a large academic system can negotiate; a small community hospital often signs standard terms. Federal agencies sit in a different position again. Litigation against the United States is generally conducted by the Department of Justice, so a vendor’s promise to “defend” an agency has to be read against that. Federal contracting rules also limit which commercial terms can bind an agency. Agencies should ask their counsel how a commercial AI indemnity works for them before relying on it. State and local governments face their own procurement and liability statutes, which vary by state.

Embedded AI raises a further question. When a software vendor builds features on a model provider’s service, the provider’s promise runs to the software vendor, not to its customers. The buyer should ask whether that vendor passes the protection through or offers its own, and get the answer in the contract. Many organizations discovered that their most widely used AI features came through this route.

Suppose a regional bank turns on an AI writing assistant inside its customer service platform. The platform vendor uses a large model provider behind the scenes. The model provider’s copyright commitment protects the platform vendor. The bank’s contract with the platform vendor, signed years before generative AI, says nothing about AI outputs at all. If a claim arose from text the assistant produced, the bank could find that the protection it read about in the press stops one link up the chain.

Closing that gap is mostly a contract amendment. The bank can ask the platform vendor for a written AI addendum. It should say which model providers the vendor uses, whether it passes their copyright protection through, what conditions apply, and whether the bank gets notice of a change in provider. Vendors with many regulated customers often have such an addendum ready. Those that do not have at least told the buyer something useful about their maturity.

The content it publishes

An indemnity covers claims against the buyer arising from vendor outputs. It does not change who publishes. A regulated organization that uses generative AI to draft customer letters, patient education material, policy explainers or public reports issues them under its own name. If a passage closely reproduces a protected work, the publisher carries the reputational exposure, and the indemnity’s conditions decide whether the vendor shares the legal one.

Attribution is a second publication risk

The Times complaint pointed to a harm that has little to do with copying. A model can attribute to a real source something that source never said, as the complaint alleged GPT-4 had done with Wirecutter recommendations. For a regulated organization, the parallel is a draft that cites a regulator, a clinical guideline or a statute for a proposition it does not support. That text may infringe nobody’s copyright and still be inaccurate, misleading or, for some firms, a supervisory problem.

The rules that govern published material differ by sector. Broker-dealers are subject to FINRA’s rule on communications with the public, which requires principal approval of retail communications before use and sets content standards against misleading statements. Banks face unfair, deceptive or abusive practices standards for consumer communications. Health systems are judged on clinical accuracy by patients and accreditors. Federal agencies write under the Plain Writing Act and their own information quality guidelines. An AI-assisted draft passes through whichever of these applies, and the reviewer checks sources and attributions as well as originality.

A headline reading “Hospital’s patient leaflet copied from medical journal” does not mention which software drafted it. The organization’s name is the one on the page, and its board will be the one answering questions.

Output practices can match use to risk. Internal drafting and summarization carry little exposure. Material published externally at scale, such as marketing, educational content and anything that summarizes news or research, deserves a human reviewer who checks for close reproduction and confirms that sources are credited or licensed. Recording which tool and version produced each published item costs little and lets the organization respond quickly to a claim.

Compliance teams in banking already review marketing for accuracy, and health systems already review patient materials for clinical correctness, so the copyright check fits into existing review steps rather than requiring a new one. In practice, that might mean adding a single line to an existing review form: “AI-assisted? If so, which tool, and has the text been checked for close reproduction of a published source?” The cost is a few minutes per item. The benefit is a clear record if anyone ever asks.

How a review step actually works

A copyright check does not require special software, though some teams use similarity tools. The reviewer’s first job is to notice text that reads as if it came from somewhere: unusually polished phrasing, distinctive examples, specific statistics without a source. A quick search on a distinctive sentence will catch most close reproductions of published material. Where the draft summarizes a named source, the reviewer confirms that the summary is accurate and that any quotation is attributed.

Volume decides the design. A marketing team publishing a few pieces a week can review every item. A contact center using AI to draft thousands of customer replies cannot. There the controls shift to the tool: approved templates, limits on what the model can draw on, and sampling of sent messages over time. Recordkeeping follows the same rules as the content. A broker-dealer’s communications are already subject to retention requirements, and noting the tool used adds a field to an existing record, not a new archive.

The case for proportion

A reasonable objection is that verbatim reproduction is rare and most organizational writing is generic. A letter explaining a fee change is unlikely to match anyone’s copyrighted work. That is fair, and it argues for concentrating review where the risk is: long-form public content, material that summarizes news or research, and anything distinctive enough to be worth copying. Blanket review of every AI-assisted sentence would cost more than it saves and would teach staff to stop declaring AI use.

The data its vendor holds

Litigation brings discovery and preservation duties, and those can reach data a vendor holds about all of its users, including organizations that are strangers to the case. Discovery is the stage of a lawsuit in which each side can demand relevant documents and data from the other. A preservation order is a court instruction not to delete material that might be evidence. Both are normal parts of litigation. What is unusual about AI services is how much other people’s information sits in the vendor’s systems.

AI chat histories are records held under a vendor’s retention policy. The Times suit added a sharper possibility: a court in someone else’s case ordering that data kept longer than either the vendor or the customer intended. Every prompt a staff member types, and every answer the tool gives, may be stored for some period. If a court orders those logs kept, they stay, whatever the vendor’s usual deletion schedule.

For regulated organizations this cuts against core obligations. Bank confidentiality duties, HIPAA, and agency records and privacy rules all assume the organization controls where its data goes and how long it stays. HIPAA is the federal law governing how health information is protected; its rules follow patient data wherever it travels.

The protections are contractual and architectural:

• Enterprise agreements can offer zero or minimal retention of prompts and outputs, meaning the vendor keeps nothing, or keeps it only briefly, and organizations sending sensitive data should use them.
• Agreements should state how the vendor will respond to a preservation order or subpoena affecting customer data, including notice to the customer where the law allows.
• Health systems need a business associate agreement, the contract HIPAA requires before an outside company handles patient information on a provider’s behalf, in place before any patient data reaches the service.
• Consumer tiers, which typically carry different retention and use terms, should be blocked for confidential work through technical controls as well as policy. A policy that says “do not paste client data into free chatbots” is a start; a network setting that prevents it is stronger.

The same channel runs the other way when the organization itself is a party to litigation. A bank in a lending dispute or an agency in a records case may need to preserve its own staff’s AI prompts and outputs under a litigation hold, the formal instruction to stop deleting anything relevant to a case. That is only possible if the organization knows which AI tools staff use, whether their logs are retrievable, and who can place a hold on them. Records managers should add AI services to the systems covered by legal hold procedures.

How a preservation duty reaches a non-party

The mechanism is ordinary civil procedure. Once litigation is reasonably anticipated, a party must preserve relevant electronically stored information, and the Federal Rules of Civil Procedure allow sanctions when such information is lost. A defendant AI company, asked to preserve evidence of what its models produced, may be told to stop deleting user conversations that would otherwise expire. Those conversations belong to its customers. The customers are not parties, receive no notice from the court, and have no automatic seat at the hearing.

Third parties can also be reached directly. A subpoena can demand documents from someone who is not a party, and a vendor served with one may have to produce customer data, subject to objections and protective orders. A contract clause requiring the vendor to notify the customer, where the law allows, gives the customer a chance to object or seek protection before the data leaves.

Sector by sector

The stakes differ by organization type. A bank’s main concern is customer information protected under the Gramm-Leach-Bliley Act and confidential supervisory information, the examination material that banks generally may not disclose without their regulator’s permission. An employee who pastes examination findings into a consumer chatbot has moved regulated information into a system the bank does not control, whatever happens in court.

For health systems, the business associate agreement is the threshold. Without one, sending protected health information to the service is itself the problem, before any question of retention arises. Ambulatory networks and physician groups with thinner compliance teams are more exposed here, because staff adopt tools faster than contracts are reviewed.

Public agencies have an additional obligation that runs the other way. Prompts and outputs used in agency business may be records under the Federal Records Act or state records laws, and may be subject to public records requests. An agency therefore needs AI services that can keep what the law requires it to keep, as well as delete what it should not hold. Zero retention at the vendor works only if the agency captures the record somewhere it controls.

Evidence an examiner or auditor would ask for

The controls in this channel produce documents. An auditor would expect to see the list of approved AI services with their retention settings and signed data terms. Next come the business associate agreements where they apply, the controls that block consumer services, and the legal hold procedure naming AI services. A test result helps: evidence that someone tried to reach a blocked service from a managed device and failed.

Following one document through all three channels

The three channels can all operate on a single piece of work. Say a regional health system wants to refresh its patient education leaflets on managing diabetes. A communications officer opens an AI writing assistant built into the system’s office software and asks it to draft a two-page leaflet, pasting in some notes from a clinician, including a short anonymized case description.

The contractual channel is already in play before a word is written. The assistant is an embedded feature, so the model provider’s copyright promise runs to the office software vendor. Whether the health system has any protection depends on the software contract, which the legal team may never have reviewed with AI in mind. If the officer had used a personal account on a consumer chatbot instead, there might be no enterprise protection at all.

The publication channel comes next. The draft is fluent and accurate, but one paragraph reads very like a passage from a widely circulated guide published by a medical society. Nobody intended to copy anything; the model simply produced familiar wording. If the leaflet goes out unchecked, it carries the health system’s logo. A reviewer in the existing patient-materials process, prompted by a line on the form asking whether AI was used, runs a quick check, spots the similarity and rewrites the paragraph in the system’s own words. The review record notes the tool and version.

The evidentiary channel is the least visible. The clinician’s notes and the case description now sit in the vendor’s systems for as long as its retention terms allow. If those terms are generous, and a court in an unrelated case orders the vendor to keep its logs, the health system’s material may be kept far longer than anyone expected, outside its control. If the system has an enterprise agreement with minimal retention and a business associate agreement in place, that exposure largely disappears. If it does not, the safest course is that no patient-related material goes into the tool at all.

The same pattern holds for a different organization. A broker-dealer’s marketing team uses an AI tool to draft a market commentary for retail clients. The commentary needs principal approval under FINRA’s communications rule regardless of how it was drafted. Adding the AI question to that approval gives the reviewer a reason to check for borrowed analysis from a research provider or news outlet. The firm’s retention obligations already cover the final piece. What the firm must decide is whether the prompts, which may include nonpublic views, are kept by the vendor and under what terms.

A county agency drafting a public notice on a new benefit program faces the publication and evidentiary channels in a different form. The notice must be accurate and readable by the public it serves. The prompt and draft may be public records. And if the tool is a consumer service, the agency may have no contract at all governing what happens to them.

No one in this example did anything unusual. The three channels run through everyday work, so everyday controls are what manage them.

Who owns each channel

Each channel has a natural owner. Procurement and legal own the contractual channel, because they negotiate and file the agreements. Communications, marketing and the existing content review functions own the publication channel. Information security, privacy and records management share the evidentiary channel, because it depends on technical settings, data terms and hold procedures. A chief risk officer or general counsel who asks each owner for a short status report on its channel will quickly see where the gaps are.

Ownership also clarifies who pays. Contract work costs legal and procurement time, concentrated at renewal. Review steps cost content teams minutes per item, spread across the year. Data controls cost security engineering effort up front and some user friction afterward. Naming those costs makes it easier to fund them, and harder for any one team to assume another has the matter in hand.

Costs that arrive without a lawsuit

An organization does not have to be sued over copyright for any of these channels to cost it money or reputation. A weak indemnity can turn a vendor’s legal problem into the buyer’s. A careless publication can put the organization’s name in a headline. A loose data agreement can leave customer, patient or citizen information sitting in a vendor’s logs under a court order the organization never saw. Each of those outcomes would land on the desks of the general counsel, the chief risk officer and, eventually, the board.

The good news is that the remedies are ordinary management tools: contract terms, review steps and data settings. They do not require the organization to take a view on who will win the copyright cases. Buyers did not need to predict the outcome of a case that would take years. They needed contracts that allocated risk clearly, review steps that limited what they published, and data terms that kept their information out of other parties’ litigation.

The strongest case against this approach

A sceptic could argue that the whole exercise overstates the risk. Major vendors had promised to defend customers. No regulated buyer was sued over AI outputs in the weeks after the filing. Controls cost time, and slowing AI adoption has its own cost, both in productivity and in staff turning to unsanctioned tools. On that view, the sensible course was to buy from large vendors and move on.

The argument is partly right. Buying from vendors that offer clear commitments is itself one of the controls described here, and organizations should not build elaborate processes for remote risks. It fails on two points. First, the vendor commitments did not reach the most common route, embedded AI, unless the software vendor passed them through. Second, the evidentiary channel has nothing to do with indemnities. No promise to pay a judgment helps an organization whose customer data has been held under a court order it never saw. Those two gaps are cheap to close and expensive to discover late.

Second-order effects

The obvious responses have side effects. Blocking consumer AI services pushes staff toward approved tools only if those tools exist and are good enough; otherwise it pushes them to personal phones. Requiring zero retention can remove the logs an organization needs for its own investigations, audits and records duties. Strict output review can slow the teams that most benefit from drafting help. Each control needs a matching provision: an approved alternative, a record kept on the organization’s side, and review effort sized to real exposure.

Prepared and unprepared buyers

A well-prepared organization has an inventory of the AI tools in use, including features embedded in existing software; a contract review for each that applies the five indemnity questions; a single line in existing content review forms covering AI assistance; enterprise terms with minimal retention for any tool that touches sensitive data; and AI services listed in its legal hold procedures.

Unprepared ones go wrong in predictable ways. They assume the indemnity they read about in the news applies to them, without checking which tier or product they bought. They forget that embedded AI comes through a second vendor. They treat AI-drafted public material as if it were internal notes. They allow staff to use consumer accounts for work because it is convenient. And they discover, only when litigation arrives, that nobody knows where the AI logs are.

A sensible sequence

The work orders itself. Start with the inventory, because every other step depends on knowing which tools are in use and through which contracts. Next, block consumer services for confidential work and confirm enterprise retention terms, because data exposure is the hardest to reverse. Then review indemnities at the next renewal or sooner for high-volume tools. Add the publication check to existing review forms at any point; it is the cheapest step.

Progress can be measured simply. Useful measures include the share of inventoried AI tools with a completed contract review and the number of embedded features whose pass-through status is confirmed. Blocked attempts to reach consumer services, tracked over time, show whether the controls hold. A board or risk committee can follow those without technical background.

Where procurement and legal should look first

1. Which AI tools are our staff using, including AI features inside software we already license, and for each, is a copyright commitment written into our actual contract rather than a vendor web page?
2. Where AI comes through a software vendor, does that vendor pass protection through to us, or offer its own?
3. Which of our published materials are drafted with AI, and does our existing review process check them for close reproduction of other works?
4. Do our enterprise AI agreements limit how long prompts and outputs are kept, and do they require the vendor to tell us about any preservation order affecting our data?
5. If we were sued tomorrow, could we place a legal hold on our staff’s AI prompts and outputs, and who would do it?

The follow-ups are narrower but no less practical. They cover what conduct on the organization’s side would void a commitment, and whether staff know it; whether the commitment shares a cap with everything else in the agreement; whether a business associate agreement is in place for any AI service that might see patient data; and whether consumer AI accounts are technically blocked for confidential work or only discouraged.

These questions do not depend on how the copyright cases end. They depend on facts the organization controls: which contracts it signed, what it publishes and where its data goes. That is why they can be answered now and revisited at each renewal.

With hindsight

The Times case moved slowly. By 2025 it was in discovery and had been centralized with other news publishers’ suits in a multidistrict proceeding against OpenAI before the same judge in New York. A multidistrict proceeding gathers similar cases from different courts in front of one judge so that the shared questions are handled once.

Progress in the consolidated proceeding was procedural for a long time. In October 2025 the judge heard argument on OpenAI’s motion to dismiss the consolidated class complaint brought by authors and on related motions. By late 2025, nearly two years after the filing, the question the Times had raised, whether training on its journalism was lawful, had not been decided on the merits.

The evidentiary channel became concrete in May 2025, when a magistrate judge ordered OpenAI to preserve ChatGPT output logs it would otherwise have deleted. OpenAI said the order did not reach ChatGPT Enterprise customers or API customers with zero-retention agreements. That distinction is the clearest illustration of the argument above: organizations that had chosen enterprise terms with zero retention were, by OpenAI’s account, outside the order’s reach. The contract choice made months or years earlier decided whether their data was caught up in someone else’s case.

Other cases produced the first substantive rulings. In June 2025 a federal judge in California found that training on lawfully acquired books could be fair use while letting claims over pirated copies proceed. In that case, against Anthropic, the parties agreed in September 2025 to a class settlement of at least $1.5 billion, which the court preliminarily approved. The figure showed that the legal exposure around training data was real money, even where parts of the fair use argument succeeded.

The settlement’s terms were as instructive as its size. It covered roughly 500,000 works at about $3,000 per work, required the destruction of the pirated datasets, and released claims for past conduct only. It did not release future claims about the model’s outputs. Training claims and output claims are separate, and resolving one leaves the other open, which is why the publication channel stays relevant to buyers.

Other rulings pulled in different directions. In June 2025 a different judge in the same California court ruled for Meta on fair use against a group of authors. He stressed that the decision rested on the record those plaintiffs had presented. In February 2025, in a case involving a non-generative legal research tool, a federal judge in Delaware had rejected the fair use defense; that decision went to the Third Circuit on interlocutory appeal. In May 2025 the U.S. Copyright Office released a pre-publication version of its report on generative AI training, which treated fair use as dependent on the facts of each use. No general answer emerged.

Regulation added a second track outside the United States. From August 2025, the EU AI Act required providers of general-purpose AI models to maintain a policy for complying with EU copyright law and to publish a summary of their training content. Those duties fell on model providers, not on banks or hospitals using the models, but they gave buyers new documents to request in due diligence.

Licensing grew alongside litigation. More publishers signed agreements with AI developers, and in 2025 the Times itself reached an AI licensing agreement with Amazon while continuing its case against OpenAI and Microsoft.

Vendor copyright commitments spread across enterprise AI agreements. That made the five indemnity questions more relevant, not less: as more vendors offered protection, the differences in scope, conditions and caps became the thing worth comparing.

Embedded AI kept spreading faster than contracts were updated. AI features arrived in productivity suites, customer relationship systems, electronic health record add-ons and case management tools, often switched on by default or by a vendor update. The pass-through question remained the gap most buyers found last.

For regulated buyers, the exposure ran mainly through contracts, publication practices and data retention, as the three channels above suggest. The big copyright questions may stay unsettled for years, and organizations do not need to wait for them. The decisions that protected buyers were ordinary ones, made at contract signing and in review meetings, well before any court ruled.