Training AI on Copyrighted Works: What the Key Rulings Actually Established

Jia (Cleo) Song / Mao Peng · Artificial Intelligence · 2026-07-04 · 12 min read

This article is Part One of our series “The 3D Lifecycle of AI,” current as of mid-2026.

Introduction

Of all the copyright risks generative AI presents, the input-side question, whether it is lawful to train a model on copyrighted works, is the most discussed and the most frequently misread. This article goes back to the opinions themselves and lays out what several key rulings in the United States (and one in England) actually established, which propositions now carry binding force, and which remain unsettled.

Training on lawfully acquired works is trending toward being found fair use; building on pirated material is not. But on the specific question of AI training, no appellate court has yet ruled on fair use, and several federal district judges have openly disagreed with one another.

Key Takeaways

1. Training on lawfully acquired works is trending toward being found fair use; building on pirated material is not.
2. No appellate court has ruled on fair use in AI training, and judges on the same district court have openly disagreed.
3. The fight has shifted to whether a company can prove how its data was acquired, and whether its outputs reproduce protected expression.

Note: This article is for general informational purposes only and does not constitute legal advice or create an attorney–client relationship; several of the cases discussed remain pending at trial or on appeal. Please consult qualified counsel about specific matters.

1. Fair Use and “Transformative” Use

Fair use under Section 107 of the U.S. Copyright Act is the principal defense available to those who train models. Whether a use of a copyrighted work qualifies as fair use turns on four statutory factors (17 U.S.C. § 107):

1. the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes;
2. the nature of the copyrighted work;
3. the amount and substantiality of the portion used in relation to the copyrighted work as a whole; and
4. the effect of the use upon the potential market for or value of the copyrighted work.

Of the four, the first factor (the purpose and character of the use) and the fourth (the effect on the potential market for the original) carry the most weight in practice. At the heart of the first factor is whether the use is “transformative.”

The classic definition of “transformative” comes from the Supreme Court’s decision in Campbell v. Acuff-Rose (1994): whether the new use adds something new, with a further purpose or different character, altering the original with new expression, meaning, or message. The refinement that now binds comes from Andy Warhol Foundation v. Goldsmith (2023): whether a use has a “further purpose or different character” is a matter of degree, and it must be weighed against the commercial nature of the use, above all against whether the use substitutes for the original in the market; adding “new meaning” alone is not enough.

The four factors, however, are not simply applied one by one from the outset. Warhol imposed a threshold step before the factors come into play: fair-use analysis proceeds use by use, so a court must first identify the distinct ways in which a work has been used and then evaluate each use separately (Andy Warhol Found. for the Visual Arts, Inc. v. Goldsmith, 598 U.S. 508, 533 (2023)). What counts as a “use” is an objective question, defined by what the user actually did with the original rather than by the user’s subjective intent (id. at 544–45). And each use must be defined narrowly enough that one broadly framed “use” does not swallow other infringements that could be assessed separately (id. at 541, 546–48).

This threshold step is often skipped, yet it frequently drives the outcome. It is precisely what allowed Judge Alsup in Bartz to break Anthropic’s conduct into several distinct “uses” and judge each on its own terms. He identified three uses of the books at issue: training models on them, digitizing lawfully purchased print copies, and downloading pirated copies to build a permanent library. The first two were fair use; the third was not.

One point bears emphasis. On the specific question whether training AI on copyrighted works constitutes fair use, there is as yet no binding appellate decision. The district court rulings to date bind only the parties before them, carry at most persuasive weight, and do not fully agree with one another in their reasoning. The only appellate case now under way is Ross, discussed below, and it has not been decided.

2. Five Rulings

1. Bartz v. Anthropic (N.D. Cal., Judge Alsup, June 2025)

According to the summary judgment opinion, Anthropic downloaded millions of books for free from pirate sites while also buying print copies, which it disassembled and scanned into searchable digital files, all in service of building a central library of “all the books in the world,” to be kept “forever,” from which it then drew datasets to train successive versions of Claude.

Judge Alsup’s ruling has three layers. First, using the books to train large language models was “exceedingly transformative” and constituted fair use; the models extract statistical patterns rather than reproduce the works’ content for users. Second, digitizing print books the company had lawfully purchased (a format conversion) was also fair use. Third, downloading more than seven million pirated books to build the permanent library was infringement, and no fair use.

The rule this establishes is that there is no AI exception allowing a company to skip paying for materials it could have bought lawfully. The $1.5 billion settlement corresponds to how the data was acquired, not to the act of training itself. (The settlement received preliminary approval in September 2025. At the final approval hearing in May 2026, the court declined to approve it from the bench and requested supplemental submissions on attorneys’ fees and other issues. As of mid-2026, final approval remains pending.)

2. Kadrey v. Meta (N.D. Cal., Judge Chhabria, June 2025)

As to the result, Meta won partial summary judgment on fair use. But the significance of this decision lies in its reasoning, not its outcome.

Judge Chhabria opened by observing that when the question is whether copying copyrighted works without permission to train generative AI is unlawful, “in most cases the answer will likely be yes.” His analysis puts market harm at the center: generative AI can “flood” a market at negligible cost (his examples were biographies of lesser-known figures, magazine articles, and genre fiction), damaging the market for the originals and weakening the incentive to create, and fair use does not protect copying that would significantly undermine rights holders’ ability to profit from their works.

He expressly rejected the idea that transformativeness equals safety, holding that no rule makes a “transformative use” automatically immune from infringement, and that under the fourth factor, “harm to the market matters more than the purpose of the copying.” He went so far as to say, by name, that Judge Alsup in Bartz had relied too heavily on transformativeness and given market harm short shrift.

Meta prevailed because this particular group of plaintiffs failed to present adequate evidence of market dilution, not because such training is fair use as a matter of law. In other words, Kadrey and Bartz reached the same result on the surface, while the two judges of the same court openly disagreed over the relative weight of transformativeness and market harm, which is itself evidence that fair use remains unresolved.

3. Thomson Reuters v. Ross Intelligence (D. Del., Judge Bibas, sitting by designation, February 2025)

This decision contains a rarity: Judge Bibas reversed his own 2023 ruling (his own words were to the effect that a wise man knows when he is wrong). In 2023 he had largely denied both sides’ summary judgment motions, and the case was headed to trial. Before the trial set for August 2024, he went back through the record, concluded that his earlier ruling had not done enough, and took summary judgment back up, inviting the parties to submit renewed briefing.

On the facts, Ross set out to build a legal research tool to compete with Westlaw. It asked Thomson Reuters for a license and was refused (as a competitor), so it obtained, through a third party called LegalEase, roughly 25,000 “Bulk Memos” (legal question-and-answer materials that lawyers had drafted from Westlaw’s editorial headnotes) and used them for training.

The 2025 ruling went for Thomson Reuters and against Ross on both direct infringement and fair use, finding that the use was commercial and not genuinely transformative (its output was a market substitute), and that it harmed Thomson Reuters’s markets, including the potential market for licensing AI training data. The opinion is explicit that it addresses only non-generative AI. The case is on appeal to the Third Circuit; oral argument was held on June 11, 2026, and no decision has issued. When it comes, it may well be the first appellate ruling on fair use in AI training.

This was the first decision to hold that training AI on copyrighted material was not fair use, though it is confined to non-generative AI and a direct market substitute. And the judge’s reversal of his own position shows how unstable the answers to this question remain.

4. New York Times v. OpenAI (S.D.N.Y. MDL, Judge Stein)

Strictly speaking, the New York Times case sits closer to the output side (whether the model “regurgitates” protected text verbatim), but its training-infringement claims are advancing as well. The case has now been consolidated with suits by numerous news organizations and authors into a multidistrict litigation (MDL, the federal procedure that transfers pending cases of the same or similar type from across the country to a single federal judge). It survived motions to dismiss in 2025, and in 2026 the focus has turned to discovery, with the court ordering production of roughly 20 million ChatGPT output logs, an order broadened further in March. The conclusion we can draw from this litigation so far is that lawful training does not mean safe outputs. We take up the output side later in this series.

5. Getty Images v. Stability AI (United Kingdom, November 2025)

The High Court of England and Wales largely rejected Getty’s copyright claims, but it bears emphasis that Getty itself withdrew its main (primary) copyright infringement claims during trial. What the court actually heard and rejected was “secondary infringement,” on two grounds: first, the training took place outside the United Kingdom; second, the court accepted the finding that the model itself does not contain copies of the works. Getty prevailed only to a very limited extent, on trademark issues.

The lesson is that where the training occurred and what the model actually stores can decide the case outright, and different jurisdictions answer these questions differently. (The parallel U.S. litigation continues; Getty has dismissed its Delaware action and refiled in the Northern District of California.)

The five cases above center on books, news, images, and legal databases, but the training litigation also has a music front. In June 2024, the three major record labels sued the AI music companies Suno (District of Massachusetts) and Udio (Southern District of New York) on the same day. In 2026, the Udio case produced a ruling favorable to the plaintiffs on how the data was acquired (DMCA anti-circumvention), while summary judgment on fair use in Suno, after repeated extensions, has been pushed to January 2027. The music cases share the fair-use logic of the book cases but differ in one respect: two copyrights are in play, in the sound recordings and in the underlying compositions. We develop that thread in this series in “AI Music: Training, Rights Clearance, and Voice Cloning.”

3. What Is Already Clear

Taken together, the rulings above yield three rules that are already clear.

First, training on lawfully acquired works trends toward being found fair use; building on pirated material does not. The pirated material may prove to be the most expensive part (witness the $1.5 billion total settlement in Bartz, benchmarked at roughly $3,000 per pirated work).

Second, fair use is highly case-specific and still contested. It turns on the balance between the degree of transformation and the harm to the market, judges on the same court have not reached agreement, and the first appellate decision has yet to land.

Third, the fight has moved from whether copyrighted data was used in training to whether a company can prove how its data was acquired and whether its outputs will reproduce protected expression. Both, in our view, lie within a company’s own control.

4. Data-Provenance Diligence in Practice

The input side corresponds to the first of the three checks to run before launch. Even the rulings friendliest to AI protect nothing more than training on lawfully acquired works.

In our view, a company building an AI product should be able to answer three questions:

1. What data, exactly, were the model and any fine-tuning datasets trained on? Vagueness about sources is itself a warning sign;
2. Is there a traceable chain of licensing or lawful acquisition? “We used a popular open-source dataset” is not a sufficient answer, because several well-known datasets have pirated books mixed in, which is precisely the problem Books3 and LibGen presented in Bartz;
3. When fine-tuning on scraped web data or customer data, do the company’s terms and its actual practices genuinely permit it? Scraping in violation of website terms, or using customer data beyond the scope of the authorization, reintroduces the same unlawful-acquisition problem that dragged down Anthropic’s internal book library.

The work at this step is fairly basic, yet it is decisive to the outcome. What it ultimately produces is a data-provenance record solid enough to hand directly to an investor, an acquirer, or a court.

5. Conclusion

At bottom, input-side risk is a question of proof: can the company show that its product is built on lawfully acquired data? Companies that can make that showing stand on firmer ground in litigation, in fundraising, and at exit. The next article turns to the output side: whether what AI produces can belong to the company at all.

Key Cases and Sources

Bartz v. Anthropic, PBC, No. 24-cv-05417-WHA, 2025 WL 1741691 (N.D. Cal. June 23, 2025); Kadrey v. Meta Platforms, Inc., No. 23-cv-03417-VC (N.D. Cal. June 25, 2025); Thomson Reuters Enter. Ctr. GmbH v. Ross Intelligence Inc., No. 1:20-cv-00613 (D. Del. Feb. 11, 2025), appeal docketed, No. 25-2153 (3d Cir.); In re OpenAI, Inc., Copyright Infringement Litig., MDL No. 3143 (S.D.N.Y.); Getty Images (US), Inc. v. Stability AI, Inc. (N.D. Cal.); Getty Images (US) Inc. v. Stability AI Ltd. [2025] EWHC 2863 (Ch); Campbell v. Acuff-Rose Music, Inc., 510 U.S. 569 (1994); Andy Warhol Found. for the Visual Arts, Inc. v. Goldsmith, 598 U.S. 508 (2023); U.S. Copyright Office, Copyright and Artificial Intelligence, Part 3.

In This Series

This is Part One (the input side) of our series “The 3D Lifecycle of AI.” Next, Part Two (the output side): What Your Company Creates with AI May Not Belong to You. See the full series index.