Once AI-generated images, text and code become part of a commercial product, two separate questions arise: can you use it, and can you stop anyone else from using it? The answers are often different. Below is the checklist that produces a decision.
Marketing generates the campaign visual with AI; engineering has the assistant write part of the code. Once the product ships, the question asked is usually a single one: "could this come back at us?" But two distinct issues are being run together here.
First, permission to use. This looks primarily to the provider's terms, and in most tools it varies by subscription tier. Output generated on an individual account and used in a commercial product is the most common mismatch in practice.
Second, ownership. Copyright protection generally requires a work that is its author's own intellectual creation, with authorship attributed to a natural person. Whether purely machine-generated output with no human input qualifies is contested.
If the output is not a protected work, that does not stop you using it. It does mean you may be unable to stop a competitor using the same thing. For a logo or a hero image that will carry your brand identity, that is a commercially significant difference.
This is why the "record of human contribution" section of the checklist is not a formality: documenting who made the creative choices, which alternatives the output was chosen from and on what criteria, and what was edited afterwards, strengthens any claim you later need to assert.
Code output behaves differently. The risk there is that the output reproduces a copyleft-licensed fragment and that licence's obligations propagate across your product. Run a licence scan before commercial use and record any detected components in your inventory (SBOM).
| Basis | Subject | What it means in practice |
|---|---|---|
| Copyright law | Originality | "Author's own intellectual creation" threshold |
| Copyright law | Authorship | Attributed to a natural person |
| Employment terms | Works by employees | Transfer of rights to the employer |
| AI Act Art. 50(2) | Marking | Machine-readable marking of synthetic content |
| AI Act Art. 50(4) | Deepfake disclosure | Depicting a person doing what they did not do |
| AI Act Art. 53 | GPAI providers | Copyright policy and training-data summary |
| Dir. 2019/790 Art. 4 | Text and data mining | Rightholder's machine-readable reservation |
| Licence terms | Code components | Propagation of copyleft obligations |
Provisions reflect the text as at the date this page was prepared. Authorship analysis differs between jurisdictions — confirm the position in each market you sell into.
Complete a separate one for each family of output. Copy it or download it as markdown. No sign-up.
# GENERATIVE AI OUTPUT — COPYRIGHT AND COMMERCIAL USE CHECKLIST
Document code: AIA-IPR-04 · Version 1.0 · Classification: Internal
Assessment: ……/……/20…… Renewal: on each commercial use
Complete a SEPARATE checklist per family of output.
PART A — OUTPUT RECORD
A.1 Output type: ( ) Image ( ) Text ( ) Code ( ) Audio/video ( ) Other
A.2 Tool and version used: [……]
A.3 Subscription tier: ( ) Individual ( ) Enterprise ( ) API
A.4 Date generated: [……]
A.5 Intended commercial use: [……]
A.6 Territories of use: [……]
A.7 Prompt record retained: ( ) Yes ( ) No
PART B — OWNERSHIP
B.1 Protection generally requires a work that is its author's own
intellectual creation, with authorship attributed to a NATURAL PERSON.
Whether purely machine-generated output qualifies is contested.
B.2 PRACTICAL CONSEQUENCE: if the output is not a protected work you may be
unable to assert exclusive rights. You can use it; you may not be able
to stop others using the same thing.
B.3 RECORD OF HUMAN CONTRIBUTION (strengthens any claim):
B.3.A Person making the creative choices and direction: [……]
B.3.B Edits and adaptations applied: [……]
B.3.C Which alternatives it was chosen from, on what criteria: [……]
B.3.D Is this record retained: ( ) Yes ( ) No
B.4 Where the contribution was by an employee, check the contractual
provision transferring rights to the employer.
PART C — PROVIDER TERMS
C.1.A Is commercial use of the output permitted? ( ) Y ( ) N
C.1.B Does commercial use depend on subscription tier? ( ) Y ( ) N
C.1.C Does the provider assert rights over the output? ( ) Y ( ) N
C.1.D Are inputs used for model training? ( ) Y ( ) N
C.1.E Is there an indemnity for third-party claims? ( ) Y ( ) N
C.1.F On what conditions: [……]
C.2 If C.1.B is "Yes": verify the generating account was ACTUALLY on that
tier. Individual-account output used commercially is the most common
mismatch.
PART D — INFRINGEMENT SCREEN
D.1 IMAGE
D.1.A Recognisable trade mark, logo or trade dress? ( ) Y ( ) N
D.1.B Recognisable image of a living person? ( ) Y ( ) N
D.1.C Directly imitates a specific artist's style? ( ) Y ( ) N
D.1.D Reverse image search performed? ( ) Y ( ) N
D.2 TEXT
D.2.A Verbatim passages from source texts? ( ) Y ( ) N
D.2.B Plagiarism scan performed? ( ) Y ( ) N
D.2.C Unverified factual assertions? ( ) Y ( ) N
D.3 CODE
D.3.A Licence compatibility scan performed? ( ) Y ( ) N
D.3.B Copyleft (GPL etc.) fragments detected? ( ) Y ( ) N
D.3.C Licence obligations for detected components met? ( ) Y ( ) N
D.3.D Recorded in the component inventory (SBOM)? ( ) Y ( ) N
D.4 For every "Yes" in D.1 or D.3, a written assessment is made BEFORE use.
Not having run the scan weakens any good-faith defence.
PART E — MARKING AND TRANSPARENCY
E.1 Machine-readable marking of public synthetic content (Art. 50(2)):
( ) Applies ( ) Does not apply
E.2 Deepfake disclosure (Art. 50(4)): ( ) Applies ( ) Does not apply
E.3 Public-interest AI text disclosure: ( ) Applies ( ) Does not apply
E.4 GPAI providers' copyright policy and training-data summary duties
(Art. 53) are reserved; ask about them in supplier selection.
PART F — TRAINING DATA (if you train or fine-tune)
F.1.A Source of the training data and how obtained: [……]
F.1.B Machine-readable reservation (opt-out) checked? ( ) Y ( ) N
F.1.C Does the data contain personal data? ( ) Y ( ) N (GDPR assessment)
F.1.D Terms of licensed data sets recorded? ( ) Y ( ) N
PART G — DECISION
G.1 ( ) Cleared for commercial use
( ) Cleared subject to conditions: [……]
( ) Not cleared — reasons: [……]
G.2 Reasoning (mandatory): [……]
G.3 Retained with reasoning and date. It is the first document requested
when a copyright claim arrives.
SIGNATURE: Assessed by / Legal review / Approved by
This checklist is general in nature and does not constitute legal advice.
Permission depends first on the provider's terms and usually varies by subscription tier. Even where permission exists, check separately whether the output reproduces a protected third-party work.
Protection generally requires a work that is its author's own intellectual creation, with authorship attributed to a natural person; purely machine-generated output is contested. The result: you can use it, but you may not be able to stop others from doing the same.
The principal risk is licence compatibility rather than copyright. If the output reproduces a copyleft fragment, those obligations may propagate across your product. Scan before commercial use and record components in your inventory.
Art. 50(2) requires machine-readable marking of synthetic content made available to the public. Where content depicts a person doing something they did not do, Art. 50(4) requires disclosure as well.
Partly. These undertakings are usually conditional — a particular tier, filters left enabled, output left unmodified. Read what the indemnity is conditioned on before relying on it; the checklist asks for exactly that at C.1.F.
In a twenty-minute preliminary call we look at which families of output you generate and work out which carry risk and what your provider terms actually say. If your exposure is low, we tell you that clearly too.
Reserve your spot for an online call The call is online · the checklist is yours either way