Legal & IP Compliance

Weight: 5%

Sources verified Dec 22

Why It Matters

35% of AI code samples have licensing irregularities (Software Freedom Conservancy). GitHub Copilot litigation is ongoing. US Copyright Office clarified AI training fair use in May 2025. Unmanaged legal risk can result in lawsuits and IP contamination.

✓ Software Freedom Conservancy: 35% of AI code samples have licensing irregularities ⓘ

×

SFC Comments to US Copyright Office on Generative AI and Copyleft

Software Freedom Conservancy

The Software Freedom Conservancy's audit found that 35% of AI code samples have licensing irregularities, raising significant copyleft compliance concerns for organizations using AI coding tools. This is critical context for legal_compliance dimension - it quantifies the actual license compliance risk in AI-generated code.

Key Findings:

• 35% of AI code samples have licensing irregularities

Credibility: high

View Source ↗

✓ US Copyright Office: US Copyright Office clarified AI training fair use in May 2025 ⓘ

×

Copyright and Artificial Intelligence Study

US Copyright Office

This is an ongoing multi-part study by the Copyright Office. Part 2 (Copyrightability) is most relevant - it addresses whether AI-generated outputs can receive copyright protection. Part 3 (Generative AI Training) addresses fair use of copyrighted materials in training. The study is still evolving, so conclusions should be referenced with caution as 'current guidance' rather than final rulings.

Key Findings:

• Part 1 (July 2024): Digital Replicas
• Part 2 (January 2025): Copyrightability of AI outputs
• Part 3 (May 2025 pre-publication): Generative AI Training

Credibility: high

View Source ↗

Learn More

• ConceptImplement compliance and risk management patterns

2025 Context

The legal landscape is evolving rapidly. Thomson Reuters v. Ross Intelligence and Bartz v. Anthropic set precedents. Some vendors offer IP indemnification, others don't. Pure AI-generated code (no human input) may not be copyrightable.

Assessment Questions (5)

Maximum possible score: 21 points

○ Q1 single choice 4 pts

Are you aware of the legal/IP risks of using AI-generated code?

[0] No - I didn't know there were legal risks

[1] Vaguely - I've heard there might be issues

[3] Yes - I understand copyright and licensing concerns

[4] Yes - my organization has provided legal guidance

✓ US District Court for the Northern District of California: Ongoing litigation regarding AI training data and generated code ⓘ

×

Doe v. GitHub, Inc. - GitHub Copilot Class Action Lawsuit

US District Court for the Northern District of California

Doe v. GitHub is a class action lawsuit alleging GitHub Copilot violated the DMCA and open-source licenses by training on publicly available code without proper attribution or consent. Most copyright claims were dismissed in May 2023, but breach of contract and open-source license violation claims survive, with an interlocutory appeal filed to the Ninth Circuit in October 2024. Outcome will establish legal precedent for how AI systems can use open-source materials.

Key Findings:

• Ongoing litigation regarding Copilot training data
• Claims of copyright infringement

Credibility: high

View Source ↗

✓ US Copyright Office: Copyright Office guidance on AI-generated works ⓘ

×

Copyright and Artificial Intelligence Study

US Copyright Office

This is an ongoing multi-part study by the Copyright Office. Part 2 (Copyrightability) is most relevant - it addresses whether AI-generated outputs can receive copyright protection. Part 3 (Generative AI Training) addresses fair use of copyrighted materials in training. The study is still evolving, so conclusions should be referenced with caution as 'current guidance' rather than final rulings.

Key Findings:

• Part 1 (July 2024): Digital Replicas
• Part 2 (January 2025): Copyrightability of AI outputs
• Part 3 (May 2025 pre-publication): Generative AI Training

Credibility: high

View Source ↗

✓ US District Court for the District of Delaware: First judicial rejection of fair use defense in AI training context ⓘ

×

Thomson Reuters Enterprise Centre GmbH v. Ross Intelligence Inc.

US District Court for the District of Delaware

In Thomson Reuters v. Ross Intelligence (2025), a US court ruled that training AI systems on copyrighted content (Westlaw's legal headnotes) does not qualify as fair use - the first judicial rejection of fair use defense in an AI training context. The ruling establishes that embedding copyrighted works into training data cannot be justified as fair use merely because AI outputs don't expose the original material. Critical precedent for legal_compliance dimension.

Key Findings:

• Set precedent for AI training on copyrighted content

Credibility: high

View Source ↗

○ Q2 single choice 5 pts

Does your organization have legal policies for AI-generated code?

[0] No policies exist

[1] Informal guidance only

[3] Documented policies exist

[4] Policies + legal review process for AI code

[5] Full compliance program with regular audits

✓ Google DORA: Organizations with formal AI policies see 451% higher adoption ⓘ

×

State of AI-Assisted Software Development 2025

Google DORA

The 2025 DORA report introduces the 'AI Capabilities Model' identifying seven practices that amplify AI benefits. The core insight is that AI is an 'amplifier' - it magnifies existing organizational strengths AND weaknesses. Key stats: 89% of orgs prioritizing AI, 76% of devs using daily, but 39% have low trust. The trust research is critical: developers who trust AI more are more productive, but trust must be earned through organizational support (policies, training time, addressing concerns). The 451% adoption increase from acceptable-use policies is remarkable - clarity enables adoption.

Key Findings:

• 89% of organizations prioritizing AI integration into applications
• 76% of technologists rely on AI for parts of their daily work
• 75% of developers report positive productivity impact from AI

Credibility: high

View Source ↗

✓ GitHub: GitHub provides IP indemnification for Copilot Business/Enterprise ⓘ

×

GitHub Copilot IP Indemnification

GitHub

GitHub Copilot Business and Enterprise tiers provide IP indemnification coverage up to $500,000 against copyright infringement claims for unmodified suggestions when public code filtering is enabled, while Individual and Pro tiers lack this protection. For enterprises evaluating AI adoption, tier-based indemnification represents a critical liability control mechanism. Key for legal_compliance dimension.

Key Findings:

• GitHub Copilot Business/Enterprise includes IP indemnification
• Individual/free tier does not include indemnification

Credibility: high

View Source ↗

○ Q3 single choice 4 pts

Do you scan AI-generated code for license contamination?

[0] No - we don't scan for this

[1] Manual review for obvious issues

[3] Automated scanning tools (FOSSA, Snyk, etc.)

[4] Automated scanning + manual review for flagged code

Note: 35% of AI code has licensing irregularities. Scanning is increasingly essential.

✓ Software Freedom Conservancy: 35% of AI code has licensing irregularities ⓘ

×

SFC Comments to US Copyright Office on Generative AI and Copyleft

Software Freedom Conservancy

The Software Freedom Conservancy's audit found that 35% of AI code samples have licensing irregularities, raising significant copyleft compliance concerns for organizations using AI coding tools. This is critical context for legal_compliance dimension - it quantifies the actual license compliance risk in AI-generated code.

Key Findings:

• 35% of AI code samples have licensing irregularities

Credibility: high

View Source ↗

○ Q4 single choice 4 pts

Does your AI coding tool vendor provide IP indemnification?

[0] Don't know

[1] No - our vendor doesn't offer indemnification

[3] Yes - basic indemnification included

[4] Yes - and we've reviewed the terms with legal

Note: GitHub Copilot Business/Enterprise and some Microsoft offerings include indemnification. Open-source tools typically don't.

✓ GitHub: GitHub Copilot Business/Enterprise includes IP indemnification ⓘ

×

GitHub Copilot IP Indemnification

GitHub

GitHub Copilot Business and Enterprise tiers provide IP indemnification coverage up to $500,000 against copyright infringement claims for unmodified suggestions when public code filtering is enabled, while Individual and Pro tiers lack this protection. For enterprises evaluating AI adoption, tier-based indemnification represents a critical liability control mechanism. Key for legal_compliance dimension.

Key Findings:

• GitHub Copilot Business/Enterprise includes IP indemnification
• Individual/free tier does not include indemnification

Credibility: high

View Source ↗

○ Q5 single choice 4 pts

Do you document human involvement in AI-assisted code for copyright purposes?

[0] No - we don't track this

[1] Informally - sometimes noted in commits

[3] Yes - we document AI assistance levels

[4] Yes - formal process for IP ownership documentation

Note: US Copyright Office requires 'meaningful human authorship' for copyright. Pure AI output may not be protectable.

✓ US Copyright Office: US Copyright Office requires 'meaningful human authorship' for copyright ⓘ

×

Copyright and Artificial Intelligence Study

US Copyright Office

This is an ongoing multi-part study by the Copyright Office. Part 2 (Copyrightability) is most relevant - it addresses whether AI-generated outputs can receive copyright protection. Part 3 (Generative AI Training) addresses fair use of copyrighted materials in training. The study is still evolving, so conclusions should be referenced with caution as 'current guidance' rather than final rulings.

Key Findings:

• Part 1 (July 2024): Digital Replicas
• Part 2 (January 2025): Copyrightability of AI outputs
• Part 3 (May 2025 pre-publication): Generative AI Training

Credibility: high

View Source ↗