Using AI-Generated Content in Business: Legal Risks and Working Rules. A Practical Guide

Artificial intelligence has become a routine working tool for many companies. Teams use it to create text, graphics, videos, music, software code, and even components of digital products. This can speed up workflows, reduce costs, and expand teams’ capabilities. At the same time, the accessibility of AI tools sometimes creates the mistaken impression that generated outputs can be used for any commercial purpose without restrictions.

In practice, the situation is more complex. Working with AI may create risks of infringing third-party rights, make it harder to protect a company’s own content, result in the disclosure of confidential information, or lead to breaches of contractual obligations to clients. These issues are particularly relevant to IT companies, marketing agencies, digital product developers, design studios, and other businesses whose creative or technical output has independent commercial value.

Below, we examine the legal risks associated with AI-generated content, how to organize its creation and review, and which internal rules can help companies avoid unnecessary problems.

AI-Generated Content and Copyright: Does the Company Own the Output?

For businesses, it is important not only to obtain AI-generated content but also to understand which rights they can acquire and enforce. This determines whether a company can transfer economic rights to a client, grant a licence, incorporate materials into its own product, or take action against copying by competitors. It is therefore worth establishing a clear and consistent chain of title to intellectual property rights.

Using AI does not automatically mean that the resulting content is ineligible for copyright protection. The human creative contribution and the rules of the relevant jurisdiction matter.

In practice, three main scenarios for using artificial intelligence can be distinguished:

1. Full generation. A user gives the system an instruction, receives a completed output, and uses it without substantial modification.
2. Generation based on original materials. A person prepares initial content, a concept, or a detailed foundation, and AI helps develop, supplement, or transform it.
3. Editing. A person creates the main material, while AI performs supporting tasks, such as correcting errors, improving quality, or making targeted changes.

The distinction between these scenarios matters for the protection of intellectual property rights.

For example, the US Copyright Office takes the position that material generated entirely by AI does not, by itself, qualify for copyright protection. However, original creative modifications made by a human, as well as the creative selection or arrangement of elements, may be protected.

In Ukraine, a separate protection mechanism applies to results created without direct human creative involvement. Article 33 of the Law of Ukraine “On Copyright and Related Rights” establishes a sui generis right in non-original objects generated by computer programs. This does not mean, however, that a company automatically acquires exclusive rights to any AI-generated content. The circumstances in which the particular material was created and the AI service’s terms must be considered.

If a company intends to protect key elements of its product through copyright, relying solely on fully AI-generated output is risky. This is particularly true of branding, characters, software, designs, music, scripts, and other commercially valuable assets. We have discussed the formalisation of IP rights and the associated documentation in a separate article.

Choosing an AI Service: Is Buying a Subscription Enough?

Before allowing a team to use an AI tool, a company needs to understand its terms. ChatGPT, Claude, Gemini, and other popular services have their own agreements governing product use, rights in content, and the parties’ liability. Even within the same provider, the terms may differ depending on the subscription plan, access method, or specific product.

Before introducing AI into workflows, we recommend checking the following service terms:

• Commercial use. Do the service terms allow generated outputs to be used in commercial products?
• Content rights. How are the user’s and provider’s rights to uploaded materials and generated outputs defined?
• Data processing. Can the service use uploaded documents, code, and other materials to train or improve its models?
• Liability. What assurances does the provider offer in the event of third-party claims alleging infringement of rights?
• Data storage. Where, for how long, and under what conditions is the company’s information stored?

It is also worth establishing whether the service complies with applicable data protection and AI regulation requirements, including, where relevant, those under the EU Artificial Intelligence Act (EU AI Act). Corporate access controls and the ability to control whether uploaded information is used for model training are also important. The company should separately check which legal entity provides the service, which country’s law applies, and whether subcontractors are involved in processing data.

It is useful to approve a list of AI tools permitted for the team, specifying the products, plans, and authorised use cases. Approval of a service in general does not mean that its free, trial, or experimental versions meet corporate security requirements. These rules can be set out in an internal AI policy, which we have covered in more detail in another article.

Copyright Infringement When Using Third-Party Materials

Companies often use third-party materials as references for generating new content. For example, a designer may upload someone else’s illustration and ask AI to create a similar one, or a developer may submit a piece of software code for modification.

Yet the fact that material is publicly accessible does not mean it can be used without restrictions.

Publishing an image, text, piece of music, or code on the internet does not automatically permit unrestricted commercial use, copying, or adaptation. Nor does every situation fall within the fair use exception. Even where a particular use is permitted, this does not necessarily authorise creating a modified version using AI. Before uploading third-party content to an AI system, a company should verify the legal basis for doing so: its own economic rights, the rights holder’s permission, an open licence, or a statutory exception.

For instance, code from a public repository may be distributed under a licence requiring copyright notices to be retained or other conditions to be met. Similar restrictions may apply to photographs, music, graphics, and other materials.

If the lawful use of a reference cannot be verified, it is better not to upload it to an AI system for subsequent modification.

Configuring AI and Prompts to Reduce Risks

Even an approved AI service and lawfully obtained source materials do not rule out the possibility that the output will contain elements protected by third-party rights. Clear instructions to the AI system (prompts) can help reduce this risk to some extent.

For commercial tasks, we recommend including the following restrictions in prompts:

1. Prohibit reproducing specific works, characters, third-party logos, trade marks, and other commercial identifiers.
2. Specify that supplied references are for general guidance only and must not be copied directly.
3. Exclude imitation of the voices, appearances, or other recognisable characteristics of real people without proper permission.
4. Prohibit reproducing extracts of third-party code, documentation, musical works, and texts without an appropriate legal basis.

These instructions are useful, but they are not sufficient. Even a detailed prompt cannot guarantee that the output is legally original, so finished AI-generated content must still be reviewed.

Reviewing AI-Generated Content Before Commercial Use

Review is necessary even when the company uses an approved AI service. For example, a generated image may include part of someone else’s logo, a video may reproduce a real person’s appearance, or software code may incorporate components governed by a third-party licence.

The review method depends on the type of material:

Text content → check distinctive passages against published materials, including verbatim quotations, sections of documentation, and other potential borrowings.

Images, graphics, and video → use reverse image searches, compare the output with references, and check for logos, watermarks, recognisable characters, and other distinctive elements.

Music and audio → check whether familiar melodies, samples, lyrics, or the voices of particular performers are reproduced.

Software code → look for possible matches in public repositories, check licence notices, library names, and comments, and do not skip standard code-review procedures.

Technical file information should not be overlooked either: metadata, comments, and other details may indicate that third-party material was used. If substantial similarity to a particular third-party work is identified, it is best to suspend use of the output until the risk is addressed or the necessary permissions are obtained.

Documenting AI-Generated Content: Should Creation History Be Retained?

The history of AI-generated materials should also be recorded, particularly when they have independent commercial value or will later be transferred to clients. In a dispute, a company may need to demonstrate where content came from, the human contribution to its creation, and the lawful use of third-party materials.

We recommend retaining the following information:

• The AI service name, subscription plan, and approximate date of use.
• Source materials, references, and evidence of the legal basis for using them.
• The initial generated output and significant intermediate versions.
• A record of changes made by humans, including working files, edits, and commits.
• The results of third-party rights checks and evidence of internal approval of the material.

There is, of course, no need to record every corrected comma or minor stylistic change. The extent of documentation should depend on the value of the material and how extensively AI was used to create it.

This does not necessarily require a separate, complex document-management process. The relevant information can be stored in a project-management system, repository, or internal content database.

Internal Approval of AI-Generated Content

The extent of legal review depends on how artificial intelligence was used. In our view, a practical approach is to classify AI-generated content by risk level, taking into account the nature of the material, its commercial value, and the possible involvement of third-party rights.

For example, four levels can be distinguished:

1. Low risk. AI was used only for technical editing of the company’s own content. Standard internal review is usually sufficient.
2. Medium risk. AI created individual elements that were subsequently substantially refined by a human. Such material should be approved by a responsible employee or team leader.
3. Elevated risk. AI created a substantial part of the output, third-party references were used, or the material itself has high commercial value. Approval by the project manager and, where necessary, a legal review may be appropriate.
4. High risk. The material includes trade marks, recognisable characters, the voices or likenesses of real people, or substantial portions of third-party works. An in-depth legal assessment, management approval, and confirmation of the relevant rights are required.

This approach avoids burdening routine tasks with unnecessary approvals while maintaining stronger controls where risks are genuinely high.

Rules for Publishing AI-Generated Content

Another important aspect of working with AI is using finished material outside the team. This includes not only posting on social media or a website, but also delivering output to a client or incorporating it into a software product, advertising campaign, presentation, or public repository.

Before publication, the company should make sure the team is using the exact version that has been reviewed and approved. If the content was subsequently modified using AI, the earlier review may no longer cover the final output.

Must material be labelled as AI-generated? Not always.

This depends on applicable law, the nature of the content, client requirements, and platform rules. Particular care is needed with realistic synthetic images, voices, and videos that audiences may mistake for authentic materials.

However, even proper labelling does not remedy copyright infringement or the unauthorised use of another person’s likeness. Social networks, advertising services, marketplaces, and app stores may also impose their own requirements for AI-generated content. Failure to follow these rules may result in removal of the material, restrictions on monetisation, or account suspension.

Conclusions

AI-generated content creates new opportunities for businesses, but also raises issues that should not be overlooked. Merely giving a team access to a popular service is not enough. A company needs to determine which tools may be used, how to handle third-party materials, who reviews the output, and under what conditions it can be published.

Particular attention should be paid to intellectual property rights in materials that the company will use as its own commercial assets or transfer to clients. It is important not only to document these rights properly, but also to be able to substantiate them if needed.

In our view, these rules are best set out in an internal AI policy tailored to the company’s activities, tools, and content types. This can help the team act consistently and reduce the risk of claims.

If your company uses AI to create content, software, or other commercial products, it is worth addressing the legal aspects in advance.

The lawyers at Legal IT Group can help assess risks, review AI service terms, prepare internal AI policies, and, where necessary, resolve intellectual property matters.