What organizations must know about legal risk, data leakage, audit trails, and how to keep AI working inside — not around — your document security controls.
AI has become indispensable for knowledge work — but in most organizations, the AI policies and the copyright policies have been written by different teams who have never been in the same room. The result is a compliance gap that is growing more expensive by the quarter. This guide brings those two conversations together.
Why this matters more in 2026 than ever before
Three years ago, using AI on a copyright-protected document was unusual enough to feel like a niche concern. Today it is mundane. Analysts upload research reports to AI tools to generate summaries. Lawyers paste contract clauses into chat interfaces to compare drafting. Editors feed licensed articles into AI writing assistants to extract insights. This is now routine — and largely ungoverned.
The gap between what employees are doing and what copyright and data protection policies permit has never been wider. According to IBM's 2025 Cost of a Data Breach report, nearly 13% of organizations reported breaches involving AI models, with 97% citing inadequate AI access controls as a contributing factor. And that is before the copyright exposure is factored in.
Copyright law protects the expression of ideas — the specific text, structure, and arrangement of a document. When an employee pastes that expression into an external AI tool, they may be creating an unauthorized copy, transmitting it to a third party, and generating derivative outputs — all potential infringement events — in a single action that takes four seconds and leaves no audit trail.
This is not a theoretical risk. Litigation has crystallized the exposure. The Thomson Reuters v. Ross Intelligence decision in February 2025 confirmed that even AI-assisted analysis of copyrighted legal content — not just reproduction — can constitute infringement when the original work is used to build a competing product. The question of what constitutes fair use in AI workflows is now being litigated across dozens of cases simultaneously.
The legal landscape: what courts and regulators are saying
Understanding the legal context is essential for building an AI policy that is actually defensible. Here is where things stood as of mid-2026:
The U.S. Copyright Office position
The Copyright Office's May 2025 report — its most comprehensive guidance on AI and copyright to date — concluded that fair use in AI contexts depends entirely on the specific facts of each case. On one end of the spectrum, noncommercial research or analysis that does not enable portions of the works to be reproduced in outputs is likely to be fair use. On the other end, copying expressive works from licensed sources to generate content that competes in the marketplace is unlikely to qualify.
"Some uses of copyrighted works for generative AI will qualify as fair use, and some will not. It is not possible to prejudge litigation outcomes." — U.S. Copyright Office, May 2025
The practical implication is that intent, purpose, and output matter. Summarizing a licensed report for internal decision-making sits in a different risk category from extracting that report's content to train a model or generate a competing publication.
The EU AI Act
The EU AI Act reaches full enforcement on August 2, 2026. Among its requirements, general-purpose AI providers must publish a summary of the copyrighted works used in training data and comply with Directive 2019/790 — the EU's copyright rules for the digital single market. Enterprises using AI on copyrighted content must also document their compliance basis. Ignorance of the source of a document's copyright status is no longer a defensible position.
The "AI summary" litigation
A parallel wave of litigation — distinct from training data cases — targets AI-generated summaries of copyrighted journalism and books. In April 2025, a New York court found that ChatGPT and Copilot summaries of news articles were not substantially similar to the originals, suggesting that well-constructed AI summaries can survive a copyright challenge. But in October 2025, the same court declined to dismiss infringement claims related to AI summaries of fictional works, finding that a reasonable jury could find substantial similarity. The outcome varies significantly by content type.
10 best practices for AI use on copyright-protected documents
The following practices are grounded in current legal guidance, enterprise data security standards, and the practical realities of how AI is used in document-heavy organizations.
1. Keep AI inside the DRM perimeter
The single highest-impact control is ensuring that AI interactions with copyright-protected documents occur within the same platform that enforces the DRM — not in an external tool. When AI operates inside the security envelope, no unauthorized copy of the content is ever created. The DRM controls — access restrictions, watermarking, audit logging — remain intact throughout every AI interaction.
2. Classify documents before applying AI policies
A blanket "no AI" policy on protected documents creates the shadow-IT problem: employees find workarounds outside your visibility. A classification-based policy — which defines permitted AI uses for each document sensitivity tier — is more enforceable and less friction-generating. Factual business documents generally carry lower copyright risk than licensed creative or journalistic content.
3. Never use public AI tools for licensed third-party content
Content pasted into a public AI chatbot may be logged, retained, and — depending on the provider's terms — used for model training. This simultaneously creates an unauthorized copy, transmits it to a third party, and potentially incorporates it into a competing system. For licensed reports, standards documents, legal databases, or published research, public AI tools are categorically inappropriate.
4. Require no-training, no-retention commitments from AI vendors
For any enterprise AI platform that handles copyright-protected documents, contractual commitments that the provider will not retain, log, or train on document content are baseline requirements. Verify these commitments are reflected in data processing agreements, not just marketing materials — and check whether they cover API usage separately from consumer products.
5.