Full-Lifecycle Compliance for Commercial Generative AI: From Development to Dispute Resolution

Jia (Cleo) Song / Mao Peng · Artificial Intelligence · 2026-07-02 · 10 min read

This article is the overview of our series “The 3D Lifecycle of AI,” current as of mid-2026.

The commercialization of generative AI is moving out of the technology race and into a phase of compliance scrutiny. In September 2025, Bartz v. Anthropic reached a preliminary settlement of $1.5 billion, the largest copyright settlement in U.S. history (the court granted preliminary approval in September 2025; final approval was still pending as of mid-2026). Defendants in pending cases include OpenAI, Meta, Stability AI, and other leading companies, while the plaintiffs have expanded from individual authors to The New York Times, music publishers, and stock-image companies.

On the surface, these cases are scattered across different courts and involve different types of works, but at the business level they raise the same questions: whether the training data was lawfully sourced, whether the model’s outputs infringe, and whether the company can claim rights in those outputs. A defect at any one of the three points can turn into real exposure in financing due diligence or upon a single demand letter.

The decisions handed down from 2025 through early 2026 have not given final answers on every disputed issue, but they have made clear where the risks actually lie, and most of those risks are ones a company can identify and control on its own before a product launches. This article is the overview of our series “The 3D Lifecycle of AI,” and its aim is to map the overall landscape. The series begins with intellectual property and, following the same lifecycle from development through deployment to dispute resolution, will expand over time into data privacy, trade secrets, AI investment and M&A, and other areas of law. Each topic is treated in depth in its own article, flagged at the relevant point in the text below.

Note: This article is for general informational purposes only and does not constitute legal advice or create an attorney–client relationship. Several of the cases discussed remain on appeal, and the law in this area is evolving rapidly. Please consult qualified counsel about your specific situation.

1. The “3D Lifecycle” of AI

A company’s AI legal risk runs through the entire life of an AI product. We organize it as the “3D lifecycle” of AI: Develop, Deploy, and Defend.

The Develop phase covers compliance in getting the product built, including rights in and cleaning of training data, licensing of models and datasets, and ownership of the intellectual property in what the model produces.

The Deploy phase covers compliance in taking the product to market, including AI governance and disclosure, automated decision-making and algorithm audits, cross-border regulation, and outputs that implicate other people’s personality rights, such as digital humans.

The Defend phase addresses how to respond once something goes wrong, including rights assertions, damages and insurance, due diligence, and incident response.

Questions of intellectual property, together with rights in a person’s likeness and voice, run through the entire product lifecycle. Training data and output ownership belong to Develop; digital humans and cross-border compliance belong to Deploy; how risk gets allocated and how litigation gets handled belong to Defend. Each article in this series corresponds to one of these links and is labeled with its phase.

2. The Landscape in 2026

As of mid-2026, more than one hundred generative-AI copyright lawsuits have been filed in U.S. courts, and the number keeps growing (one docket tracker counted 113 as of May 2026, and 143 worldwide), concentrated in the Southern District of New York (S.D.N.Y.), the Northern District of California (N.D. Cal.), and the Central District of California (C.D. Cal.). The defendants cover nearly every major AI company, including OpenAI, Microsoft, Meta, Anthropic, Stability AI, and Midjourney. Suits filed in 2026 have added Google, xAI, Perplexity, Apple, and Nvidia as defendants. The plaintiffs have grown from novelists and visual artists to The New York Times, major publishing houses (Hachette, Macmillan, and others), music publishers, and Getty Images.

Compared with 2023, when the debate was still over whether plaintiffs could win at all, the current landscape differs in three substantive ways.

First, money has actually changed hands. Bartz settled for $1.5 billion, and music publishers are seeking more than $3 billion from Anthropic in a separate case.

Second, disputes are shifting from litigation toward licensing, and training data has gone from a free input to a production factor with a market price. OpenAI’s deal with News Corp, Microsoft’s deal with HarperCollins, Reddit’s IPO disclosures, and the licenses or settlements between Warner and Universal on one side and Suno and Udio on the other all point the same way.

Third, the insurance market has started pricing the risk. Effective January 2026, ISO (Insurance Services Office) added an optional endorsement to its standard commercial general liability forms allowing insurers to expressly exclude AI-related copyright infringement from coverage. When insurers single out a risk for exclusion, that is itself evidence the risk is real.

3. Two Ports: Input and Output (the Develop Phase)

In the Develop phase, copyright risk concentrates at two ports. On the input side, the question is whether training a model on copyrighted works is lawful. On the output side, there are two layers: whether the model’s outputs themselves infringe, and whether the company can claim rights in them. The answers at the two ports are not the same.

The Input Side: Is Training Lawful?

On the input side, one rule has become clear: training on lawfully acquired works is trending toward fair use, while building on pirated material is not. The summary judgment in Bartz v. Anthropic held that Anthropic’s use of books to train large language models was fair use, while holding that downloading more than seven million pirated books to build a library constituted infringement. In Kadrey v. Meta, Meta prevailed, but the judge, sitting in the same district, publicly disagreed over whether transformativeness or market harm should weigh more heavily, and Meta won only because the plaintiffs failed to adequately prove the market harm they suffered. In Thomson Reuters v. Ross, the AI side lost outright on fair use; the case is now on appeal to the Third Circuit and may become the first appellate decision on fair use in AI training. In the U.K., Getty v. Stability AI saw the copyright claims largely rejected because the training took place abroad and the model contains no copies of the works.

The dispute has thus moved on from whether copyrighted data was used in training to whether the company can prove the data was lawfully acquired and whether the AI’s outputs reproduce protected expression, and both of those are largely within a company’s own control. For a complete walkthrough of these cases, see “Training AI on Copyrighted Works: What the Key Rulings Actually Established” in this series.

The Output Side: Can You Own It, and Does It Infringe?

On the output side, companies tend to focus on only one question when there are in fact two independent ones.

The first is ownership. U.S. law turns not on whether AI was used, but on how much creative control a human exercised over the final work. Prompts alone, however detailed, are generally not enough to give the user rights in the output. The selection, arrangement, and modification a human layers on top of AI output can be protected, and often what is protectable is only that human layer, not the underlying raw AI output.

The second is infringement. An output that is substantially similar to a protected work can infringe even where the training itself was lawful. On the ownership layer, see “What Your Company Creates with AI May Not Belong to You”.

One category deserves a separate flag: AI digital humans, AI voiceover, and AI micro-dramas. When an output reproduces a real person’s face or voice, the main risk is often not copyright but rights in likeness and voice (see, for example, Tennessee’s ELVIS Act and the federal NO FAKES Act), and the output is subject to three sets of rules at once, in China, the United States, and the EU. That issue sits closer to the Deploy phase; see “Your AI Digital Human: Modeled on Whom?” If what gets copied is an artist’s style, neither copyright nor personality rights quite reaches it; see “When AI Imitates an Artist’s Style, Does the Law Step In?” AI music implicates training, rights clearance, and voice cloning all at once; see “AI Music: Training, Rights Clearance, and Voice Cloning.” And an AI micro-drama pulls in training, ownership, likeness and voice, and regulation together; see “Every Legal Risk in One AI Micro-Drama.”

4. Three Checks to Run Before Launch

Whether a company trains its own model, fine-tunes an open-source model, or simply calls a vendor’s API, it should complete the following three checks before the product launches.

The Data-Provenance Check (Develop)

This is an input-side issue, and it is where the law is clearest after Bartz: even the decisions friendliest to AI protect only training on lawfully acquired works.

A company should be able to answer three questions. What data, exactly, were the model and the fine-tuning datasets trained on (vagueness about provenance is itself a risk signal)? Is there a traceable chain of licenses or lawful acquisition (“we used a popular open-source dataset” is not a sufficient answer, because a number of well-known datasets contain pirated books)? And when fine-tuning on scraped web data or customer data, do the company’s terms and its actual practices in fact permit it? The work here is basic, but it is decisive to the outcome. What it ultimately produces is a data-provenance record fit to hand directly to an investor, an acquirer, or a court.

The Dual-Risk Check on Outputs (Develop/Deploy)

A company’s AI outputs typically carry both ownership risk and infringement risk, yet in practice companies tend to watch only one. For outputs the company intends to own (brand assets, distinctive product outputs, content meant for licensing), real human authorship (selection, arrangement, editing, and creative modification) should be built into the workflow, with records that document the creative process. For customer-facing outputs, keep output filtering on, leave the model vendor’s guardrails in place, and watch whether the output mimics a recognizable style, character, logo, or text; digital humans additionally require advance licenses for likeness and voice.

The Contractual Risk-Allocation Check (Defend)

Most AI copyright risk can be shifted by contract, but only if the company accurately understands the terms from three angles.

First, upstream, with the vendor. Microsoft, OpenAI, Google, and Adobe all offer copyright indemnification, but such indemnities typically cover only paid tiers, require content filtering to be enabled and guardrails left intact, and are often voided by fine-tuning.

Second, downstream, with customers. The intellectual-property warranties a company gives its customers should not exceed the protection it actually receives from its vendors.

Third, externally, with investors and acquirers. Data provenance has become a standard item in AI financing and M&A due diligence. Watch the insurance gap as well: after ISO introduced its exclusion endorsement in January 2026, a company should not assume its liability policy will pay an AI copyright claim; it should confirm the scope of coverage, or purchase standalone coverage. For the practical mechanics of this layer (along with incident-response planning), see “When AI Goes Wrong, Who Pays?”

5. The Cross-Border Compliance Companies Overlook (the Deploy Phase)

Cross-border compliance belongs to the Deploy phase. For companies operating across multiple markets, or selling into a market from abroad, the following points are routinely missed.

First, the EU AI Act can apply even where a company has no EU entity. If an AI system’s output is used within the EU (Article 2(1)(c)), the Act may apply regardless of where the model was trained, and providers of general-purpose AI models must also publish a summary of the content used for training (Article 53(1)(d)).

Second, U.S. states are writing rules of their own. California AB 2013 requires developers to publish documentation about the training data used in generative AI systems, with disclosure obligations effective January 1, 2026.

Third, friendly policy is not a legal safe harbor. The federal AI Action Plan of July 2025 effectively sidestepped the fair-use question for training data, but the executive branch cannot rewrite copyright law, and it binds neither the courts, nor the states, nor the EU.

In addition, companies expanding out of China must layer on China’s domestic regulation, including the rules governing generative AI services, the labeling requirements for synthetic content, and a position on the copyrightability of AI output that differs from the U.S. one. For the EU and state-level detail, see “Taking AI Products Global: What the EU and U.S. States Regulate.” For the full picture of China’s domestic rules and the key differences between the two systems, see “One AI Product, Two Rulebooks: China vs. the U.S.”

6. Conclusion

The companies that endure in generative AI are, for the most part, not the ones that moved fastest and worried least. They are the ones that can explain what their business is built on, confirm what they own, and pin down where the risk sits. Do the homework in each of the three phases (Develop, Deploy, and Defend), and the decisions of 2025 and 2026 no longer make an AI business untouchable; they simply make its risks identifiable. The rest is the discipline of running the checks once before launch.

If your company is commercializing generative AI, whether by building your own model, fine-tuning, or embedding AI in customer-facing products, we can help you complete these three checks before launch, reviewing your AI use policies, vendor contracts, copyright registrations, and incident-response procedures against current U.S. and cross-border law.

Disclaimer: This article is provided for general informational purposes only and does not constitute legal advice or create an attorney–client relationship. The law governing AI and copyright is evolving rapidly, and several of the decisions discussed here remain on appeal. Companies should consult qualified counsel about their specific circumstances.

In This Series

This article is the overview of our series “The 3D Lifecycle of AI.” The full series index (updated as new installments publish) is available on the series page. Published so far: Part 1 (the input side), “Training AI on Copyrighted Works: What the Key Rulings Actually Established”; and Part 2 (the output side), “What Your Company Creates with AI May Not Belong to You”. Upcoming installments will add data privacy, trade secrets, and investment and M&A for AI companies.