Copyright risks for AI companies often materialize before a model ever speaks a word.
In our conversations with AI entrepreneurs, we have found that many teams are not unaware that copyright risks exist; what genuinely confuses them is:At exactly which step does the risk arise?Some believe that because the company merely calls third-party foundation models, liability should rest with the upstream provider; some believe that because the materials come from clients, the public internet, or paid databases, the sources themselves pose no problem; and some teams explain that RAG is merely retrieval and the model does not output lengthy passages of the original text, so infringement should not arise.
These statements are not entirely wrong, but they usually explain only one link in the data-use chain. By the time the company enters financing due diligence, major-client review, or receives a complaint from a rights holder, what the other side actually presses on is often:Where were the materials obtained? Who has the authority to provide them to the company? What the company obtained is reading permission, or permission to copy, segment, train on, and retain long-term? Which knowledge base or model version did this batch of materials enter? If a rights holder demands that use cease, can the company accurately locate and remove them?
On July 20, 2026,a U.S. federal court finally approvedAnthropic()a USD 1.5 billion class-action settlement with some authors, publishers, and other rights holders.It should first be made clear that this USD 1.5 billion is not an infringement damages award ordered by the court for Anthropic to pay, nor is it a uniform licensing price for AI companies to use books to train models. What is truly noteworthy about this case is that the court examined data acquisition, corpus construction, model training, and subsequent use separately: the fact that one link may assert fair use does not mean the entire data-use chain is automatically lawful.
The court upheld training—so why did Anthropic still have to pay USD 1.5 billion?
In the Anthropic case, the court held that, under the specific facts of the case, using books for model training was for the purpose of analyzing linguistic structures and statistical relationships rather than providing users with substitutes for the original books, and therefore the relevant training was transformative and could constitute fair use. The court also upheld a narrower digitization method: purchasing physical books, scanning them into digital copies, and destroying the corresponding originals; where the number of copies is not increased and no external dissemination occurs, such format conversion may also be supported.
However, the conclusion differs when a large number of e-books are downloaded from pirate websites and placed into a permanent, general-purpose repository. The court declined to treat the front-end pirated downloading and long-term retention as fair use merely because those materials might be used for training in the future.In other words, the transformative nature of the training purpose does not automatically resolve the problems inherent in the manner in which the data was obtained.
This does not mean, however, that the court has already determined by final judgment that Anthropic bears liability for pirated reproduction. The relevant liability and damages still required further proceedings, and the case was later concluded through settlement.Anthropic's willingness to pay USD 1.5 billion is more accurately understood as a consolidated pricing of the class action, statutory damages, trial and appellate uncertainty, rather than a payment of an "AI training fee" to the court.
This can be understood as follows: a chef studying the structure and writing style of a cookbook is not the same thing as downloading an entire set of cookbooks from a pirate website and permanently storing them in his own repository. The former concerns how a work is studied and used; the latter must first answer where the materials came from, why they may be reproduced, and why they may be retained long term.
Data acquisition, ingestion and reproduction, cleaning and segmentation, model training or knowledge-base ingestion, retrieval output and long-term retention are different links in a single chain.The existence of a lawful basis for one step does not give rise to a presumption that the entire chain is free of problems.
Figure 1 | Copyright risk nodes in the AI data use chain
Using third-party models does not mean that all data responsibility lies upstream
Many AI startups do not train foundation models; instead, they call third-party models through APIs and then build their own industry knowledge bases, RAG()systems, agents or vertical applications. This model does reduce some of the risks associated with an enterprise directly training foundation models, but it does not transfer the enterprise's own responsibility for processing data to the upstream model vendors.
Enterprises must first distinguish between "data" and "works." Mere facts, numerical values, formulas and general information may not constitute works within the meaning of copyright law, but the same set of materials may simultaneously contain articles, images, reports, personal information, trade secrets, platform data rights and interests, and contractual restrictions. Therefore, in determining whether a set of materials may enter an AI system, one must not only ask "whether there is copyright" but also further determine what the materials specifically contain, by what means the enterprise obtained them, and whether the current use falls within the scope of authorization.
RAG is not a copyright vacuum either. When an industry report enters a RAG system, it typically undergoes downloading, format conversion, cleaning, chunking, vectorization and knowledge-base storage. Even if the model ultimately outputs only a few sentences of summary, copying may still occur during the preceding technical processing, and such processing may also exceed the scope of the database agreement or the client's authorization. Conversely, the fact that a knowledge base contains protected works does not mean that every retrieval output necessarily infringes; a separate assessment is still required based on the specific manner of copying, the output content and the scope of authorization.
Therefore, "we only do RAG" cannot replace data review, and calling a third-party model cannot relieve an enterprise of the liability arising from building its own knowledge base, processing client materials and continuously optimizing its products.
Three things Chinese AI companies most easily misunderstandData not constituting a work does not mean it can be used freely
Even if certain content is not protected by copyright, it may still involve personal information, trade secrets, platform rules, database rights and interests()and contractual obligations. An enterprise cannot simply conclude that no other restrictions exist merely because it determines that a batch of materials is "not copyrighted."
Publicly viewing or paying to purchase does not mean it can be used for training
Public accessibility only shows that users can access the content under specific conditions; it does not automatically mean that the content may be downloaded in bulk, copied, chunked, fine-tuned or stored long-term in a commercial knowledge base. Purchasing a database account is more like buying a reading-room ticket: it typically permits querying and reading, but does not necessarily permit moving the entire collection into an enterprise knowledge base.
Article 29 of the Copyright Law provides that, where a license contract does not expressly license a right, the other party may not exercise that right without the copyright owner's consent.Therefore, "lawful source" and "authorization for the current use" are two different things.Being able to read, being able to download, being able to use internally, being able to build a knowledge base and being able to use for model training are not inherently the same set of rights.
Not being subject to the Interim Measures for the Administration of Generative Artificial Intelligence Services does not mean there are no other compliance obligations
Some internal knowledge bases, enterprise self-use tools, or specific B2B services may not directly fall within the scope of these Measures, but the relevant business activities will still be subject to copyright, personal information, data security, anti-unfair competition, as well as customer contracts and platform terms.
Fair use is not an all-purpose pass that can be swiped open simply by invoking "innovation"
The Anthropic case applied U.S. copyright law(), and cannot be directly transplanted to China. Article 24 of the Copyright Law sets out the specific circumstances of fair use, and China has not yet established a text and data mining exception that generally applies to commercial AI training.
This does not mean that all AI training necessarily constitutes infringement; rather, it means that enterprises cannot reach a fair use conclusion solely on the grounds that "the training is innovative," "the model does not output the original text," or "the use will not substitute for the original work." It is still necessary to specifically determine whether reproductions of works are formed in the technical processing, at which stage the reproduction occurs, whether the model, knowledge base, or final output retains and presents identifiable expression of the work, and whether the relevant conduct can fall within the specific circumstances provided by current law.
The Supreme People's Court has stated that new types of cases, such as the use of training corpora for large models and infringement involving AI-generated content, should be adjudicated prudently. This indicates that domestic adjudicative standards are still being developed, and enterprises should not build their core products and data assets entirely on fair use defenses that remain uncertain.
How to handle historical data: first control the inflow, then clean up the stock
For startups that have been operating for some time, the most practical question is often not "how to do things going forward," but what to do with data that has already entered their systems. Many companies cannot immediately shut down their products, empty their knowledge bases, and retrain, so governance plans must take into account legal risk, technical cost, and business continuity at the same time.
A more realistic sequence is: first stop adding new high-risk data, then take stock of the historical stock; first preserve source, contract, and usage records, then decide whether to isolate, replace, or delete.Enterprises can first establish a data inventory recording the data source, acquisition time, providing entity, contracts and platform terms, purpose of use, storage location, and which knowledge base, fine-tuning task, or model version the data entered.
High-risk data should be handled on a priority basis, including files from pirate websites or sources that cannot be explained, data for which suppliers cannot provide proof of the chain of rights, materials used clearly beyond the scope of customer authorization, and content obtained by circumventing paywalls, anti-crawling measures, or access controls. In addition to possible copyright and contract risks, such conduct may also give rise to liability for unfair competition where the corresponding conditions are met.
Remediation does not offer only two options: "continue using" and "delete immediately." Enterprises can first stop adding new data, restrict access, isolate suspicious data from the production environment, and then, according to the actual situation, supplement authorization, replace it with compliant data, or rebuild the knowledge base and retrain. Where deletion is truly necessary, it is also necessary to ensure that the relevant files, chunked data, vector records, and backup copies can be located, and to retain complete internal approval and remediation records.
These measures cannot automatically make past conduct lawful, but they can prevent the risk from continuing to expand, and can also demonstrate in subsequent financing, customer review or dispute resolution that the company has the ability to identify problems, limit impact and complete remediation.
Figure 2 | The five-step path for historical data remediation
To manage new risks, one can start with a data ledger()Start
For startups with limited resources, data governance does not require building a massive compliance system from the outset. The most practical starting point is to first establish a data ledger jointly maintained by business, technology and legal teams.
For each batch of data, at a minimum the following should be recorded: who provided it, where it was obtained, on what contract or platform terms it is based, which scenarios it is permitted to be used for, which scenarios it is prohibited from being used for, which product, knowledge base or model version it entered, how long it is retained, and how to exit after a complaint, expiration of authorization or termination of cooperation occurs.
Contracts must also be written into real technical scenarios. Rather than vaguely agreeing that "the data source is lawful" or that "the supplier guarantees non-infringement," it is better to specify whether the materials may be downloaded, copied, cleaned, format-converted, segmented, used to build a knowledge base, used for retrieval, fine-tuning, evaluation or model optimization, and to clearly state the applicable products, the entities using them, the term, and how third-party rights claims are handled.
Enterprises must also know which knowledge base or model version a batch of materials has entered, and whether it can be separately isolated, replaced and deleted. Data that cannot be located is difficult to stop losses on once a complaint arises; data that cannot be split and exited will also significantly increase uncertainty in financing, mergers and acquisitions and major customer review.
Conclusion: AI copyright risks often arise before the model speaks
What Chinese AI companies should note most in the Anthropic case is not the isolated conclusion that "training constitutes fair use," nor the figure of USD 1.5 billion, but that the court examined different data use stages separately: where the materials came from, why they could be copied, for what purpose they entered the database, and why they needed to be retained long-term.
Fair use is not a liability exemption label for unlawful data sources, and lawful sourcing is not synonymous with being able to train, retrieve and retain long-term at will.Calling third-party models can reduce some of the underlying training risk, but it cannot resolve for enterprises the liability arising from their own building of knowledge bases, handling of customer materials and optimization of products.
For startups, it is not too late to begin governance now.First bring today's newly added data under control, then gradually address problems left over from the past; the earlier source records, authorization boundaries and exit mechanisms are established, the lower the cost of subsequent remediation, and the easier it is to transform data from a potential risk into a company asset that can withstand financing and customer review.
Mankun Services |For enterprises that are building industry knowledge bases, RAG systems, vertical models or agent products, Mankun Law Firm can assist enterprises in areas such as verification of the sources of training and knowledge-base data, the scope of copyright and database authorization, terms for the use of customer data, remediation of historical data, supplier contracts and financing due diligence materials, helping enterprises to develop high-risk data inventories, remediation plans, data exit mechanisms and due diligence explanatory documents.
References:
•Relevant documents and public information concerning the settlement of the Anthropic copyright class action in the U.S. federal courts
•Copyright Law of the People's Republic of China
•Interim Measures for the Administration of Generative Artificial Intelligence Services
•The Supreme People's Court's Implementation Plan for Judicial Protection of Intellectual Property by People's Courts (2026-2030)
•Anti-Unfair Competition Law of the People's Republic of China (2025 Revision)
/ END.
*This article is an original article of Mankun Law Firm and represents only the personal views of the author. It does not constitute legal consultation or legal advice on any specific matter. For reprinting and legal consultation, please add our customer service:mankunlawyer。
About the Lawyers
About Mankun
