Who owns content generated by an AI tool in the UK?

Under current UK law, copyright protection requires a human author. Where a work is generated entirely by an AI without creative input from a human, the position is complex and the law has not yet fully resolved it. The Copyright, Designs and Patents Act 1988 does provide a specific provision for computer-generated works, but how it applies to modern generative AI outputs is actively debated. In practice, the terms and conditions of the AI tool you are using will often include clauses addressing ownership of outputs. We advise on these questions on a case-by-case basis.

Does the EU AI Act apply to UK businesses?

Yes, it can. The EU AI Act applies to any organisation placing an AI system on the EU market or whose AI system affects individuals in the EU, regardless of where the organisation is based. UK businesses that sell AI products or services into the EU, or whose AI systems affect EU users, are likely to be within scope. We advise UK businesses on how to assess their exposure to the Act and what steps they need to take.

What contracts do I need if I am building an AI product?

At minimum, you will need terms and conditions or a licence agreement for users of your product, a privacy policy addressing how you process personal data, and agreements with any third-party AI providers or data suppliers whose services you are using in your product. Depending on the nature of your product, you may also need a data processing agreement, an acceptable use policy, and bespoke agreements for enterprise customers. We advise AI startups and developers on the full suite of documentation needed to launch and scale.

Can I use publicly available data to train my AI model?

Not always. Publicly available does not mean freely usable for any purpose. The data may be protected by copyright, database rights, or website terms of service that restrict how it can be scraped or used. GDPR applies if any of the data includes personal information. We advise on the legal position for specific datasets and help clients structure their data acquisition to reduce risk.

What is a DPIA and when do I need one for an AI system?

A Data Protection Impact Assessment is a structured process for identifying and mitigating data protection risks. Under UK GDPR, a DPIA is required before you begin any processing that is likely to result in high risk to individuals, which includes many AI systems that process personal data at scale, make automated decisions, or use surveillance or monitoring technology. We advise on whether a DPIA is required and help organisations prepare compliant assessments.

What should an AI acceptable use policy cover?

An internal AI acceptable use policy should address: which AI tools employees are permitted to use, what data they may and may not input into those tools (particularly confidential client or business data), who is responsible for reviewing and checking AI outputs before they are relied upon, and what the consequences of misuse are. It should be updated as the AI tools in use change and as the legal framework evolves. We draft policies tailored to each organisation’s specific tools and risk profile.

AI Lawyers London

We offer smart AI legal advice and support services to clients
at a cost effective rate.

DISCUSS YOUR AI LEGAL MATTER

Artificial intelligence is reshaping how businesses operate, how content is created, and how value is generated and protected. It is also raising legal questions that have no settled answers, from who owns the output of a generative AI tool to how the EU AI Act applies to a UK business selling software into Europe.

Our AI lawyers in London advise businesses, developers and individuals on the legal issues that arise from building with, procuring and using AI. We combine expertise in contract law, intellectual property and data protection to provide practical advice across the full lifecycle of an AI product or deployment.

Our AI Law Services

AI Contracts and Agreements

AI products and deployments require a new category of commercial contract. Whether you are a developer licensing an AI model to business customers, a company procuring an AI solution from a vendor, or an enterprise deploying AI tools across your workforce, the contractual framework needs to reflect the specific risks and characteristics of AI: variable outputs, third-party model dependencies, data handling obligations and the question of who is liable when something goes wrong.

We draft and negotiate AI software development agreements, AI-as-a-service (AIaaS) agreements, API licence agreements and bespoke AI deployment contracts. We ensure that liability is clearly allocated, IP ownership is addressed, data use obligations are properly reflected, and that the contract works in practice as well as in law.

AI and Intellectual Property

Who owns content generated by an AI tool? Who owns the model itself, and the training data that built it? These are live and contested questions in UK law, and the answers depend on the circumstances of each case. We advise on copyright ownership of AI-generated outputs, protecting AI products through trade secrets and contractual confidentiality, licensing AI-generated content, and the IP implications of using third-party datasets or foundation models. We have direct experience advising on AI copyright matters and the boundaries between human and machine authorship under UK law.

Training Data and Data Licensing

Using data to train an AI model raises significant legal risk if not handled carefully. Copyright in training data, scraping restrictions, database rights, confidentiality obligations and GDPR compliance all intersect in this area. We advise on whether specific datasets can lawfully be used for model training, how to structure data licensing arrangements with third parties, and how to protect your own data from being used by others. We have advised clients on the legal issues arising from both the use of publicly available data and the licensing of proprietary datasets for AI purposes.

EU AI Act Compliance

The EU AI Act is in force and its requirements are phasing in through 2026. It applies not only to businesses established in the EU, but to any organisation whose AI system affects users in the EU market. That includes many UK businesses. The Act introduces a risk-based classification system, with different requirements depending on whether an AI system is classified as minimal risk, limited risk, high risk or unacceptable risk. High-risk systems face significant obligations around documentation, transparency, human oversight and registration.

We advise UK businesses on whether their AI systems fall within the scope of the Act, how those systems should be classified, and what compliance obligations apply. We help clients prepare the documentation required by the Act and advise on the practical steps needed to meet the relevant requirements.

AI and UK GDPR

AI systems that process personal data are subject to UK GDPR and the Data Protection Act 2018. Automated decision-making, profiling, and the use of personal data to train models all carry specific obligations. We advise on data protection impact assessments (DPIAs) for AI systems, the lawful basis for processing data in AI contexts, transparency obligations, and what organisations must tell individuals when decisions affecting them are made or influenced by automated systems. We also advise on the interaction between AI tools and employment data, healthcare data and other sensitive categories.

AI Acceptable Use Policies and Governance

If your employees are using AI tools in their work, you need a clear framework governing how those tools may be used, what data can and cannot be input, and who is responsible when AI output is wrong. Many organisations have deployed AI tools without putting governance structures in place, creating significant legal and reputational risk. We draft internal AI acceptable use policies, advise on third-party AI tool procurement, and help organisations build the governance framework they need to use AI responsibly and with confidence.

AI in the Workplace

Employers using AI in recruitment, performance management or workforce monitoring face a specific set of legal risks. Automated screening tools can perpetuate bias and give rise to discrimination claims. Monitoring employees through AI-enabled tools raises data protection and employment law issues. Replacing roles with AI systems requires careful handling of redundancy obligations. We advise employers on the legal framework around AI in the workplace, helping them adopt AI tools without creating unnecessary legal exposure.

AI Disputes

When an AI system fails, causes loss or produces outputs that lead to harm or damage, the legal question of who is liable is rarely straightforward. Liability may sit with the developer, the deployer, the user, or a combination, depending on how the system was contracted, how it was used and what went wrong. We advise on disputes arising from AI system failures, AI-generated errors and AI contract breaches. We also advise on pre-dispute risk management, helping clients structure their contracts to allocate liability appropriately before problems arise.

Our Recent Work

We have advised on a range of AI-related matters, including:

Advising on copyright ownership questions arising from content generated using AI tools, including the boundaries of human authorship and the rights in AI-assisted creative works.
Advising on the legal implications of using third-party data in AI model development, covering data licensing, copyright and GDPR considerations.
Reviewing and advising on commercial contracts involving AI tools and the allocation of liability for AI system performance.

All client matters are handled in the strictest confidence.

If you have an AI legal matter, please contact us, and we will outline the service we can offer, and the associated costs.

AI Law Contents

How can we help?

Contact our team anytime for a no-obligation chat about your legal matter. Once you speak with us, you will notice the difference yourself.

Call 0207 790 7311 or email contact@freemanharris.co.uk.

Influencer Law Team

Talha Fazlani
Lawyer
Talha Fazlani advises on IP, content rights and disputes, including the emerging area of AI-generated content and copyright. He acts for both businesses and individuals on matters where AI intersects with intellectual property and reputational issues.
Ian Freeman
Managing Director
Ian Freeman, Managing Director, has extensive experience advising on commercial contracts and technology matters, including the drafting and negotiation of agreements for technology-driven products and services.
Lana James
Paralegal
Lana James advises on commercial contracts, data matters and intellectual property, with experience in drafting agreements for technology businesses and advising on data licensing and content rights.

What our clients say?

I would recommend Freeman Harris solicitor to anyone. I was very happy in the way I was dealt with. The solicitor that handle my case was professional and efficient, she always put my mind at ease under difficult circumstance.

Blake R

Web Developer

Google

Trustpilot

REVIEWS

AI Legal Fees

Service

Fees

VAT

Total

AL Advice

From £800

£160

From £960

Hourly Rate

From £300

£60

From £360

Common AL Law Questions

Who owns content generated by an AI tool in the UK?
Under current UK law, copyright protection requires a human author. Where a work is generated entirely by an AI without creative input from a human, the position is complex and the law has not yet fully resolved it. The Copyright, Designs and Patents Act 1988 does provide a specific provision for computer-generated works, but how it applies to modern generative AI outputs is actively debated. In practice, the terms and conditions of the AI tool you are using will often include clauses addressing ownership of outputs. We advise on these questions on a case-by-case basis.
Does the EU AI Act apply to UK businesses?
Yes, it can. The EU AI Act applies to any organisation placing an AI system on the EU market or whose AI system affects individuals in the EU, regardless of where the organisation is based. UK businesses that sell AI products or services into the EU, or whose AI systems affect EU users, are likely to be within scope. We advise UK businesses on how to assess their exposure to the Act and what steps they need to take.
What contracts do I need if I am building an AI product?
At minimum, you will need terms and conditions or a licence agreement for users of your product, a privacy policy addressing how you process personal data, and agreements with any third-party AI providers or data suppliers whose services you are using in your product. Depending on the nature of your product, you may also need a data processing agreement, an acceptable use policy, and bespoke agreements for enterprise customers. We advise AI startups and developers on the full suite of documentation needed to launch and scale.
Can I use publicly available data to train my AI model?
Not always. Publicly available does not mean freely usable for any purpose. The data may be protected by copyright, database rights, or website terms of service that restrict how it can be scraped or used. GDPR applies if any of the data includes personal information. We advise on the legal position for specific datasets and help clients structure their data acquisition to reduce risk.
What is a DPIA and when do I need one for an AI system?
A Data Protection Impact Assessment is a structured process for identifying and mitigating data protection risks. Under UK GDPR, a DPIA is required before you begin any processing that is likely to result in high risk to individuals, which includes many AI systems that process personal data at scale, make automated decisions, or use surveillance or monitoring technology. We advise on whether a DPIA is required and help organisations prepare compliant assessments.
What should an AI acceptable use policy cover?
An internal AI acceptable use policy should address: which AI tools employees are permitted to use, what data they may and may not input into those tools (particularly confidential client or business data), who is responsible for reviewing and checking AI outputs before they are relied upon, and what the consequences of misuse are. It should be updated as the AI tools in use change and as the legal framework evolves. We draft policies tailored to each organisation’s specific tools and risk profile.

Contact our Influencer Law Team

If you are building an AI product, advising on AI adoption, or dealing with a legal issue that involves artificial intelligence, contact our team for an initial discussion.

We provide clear, practical advice on AI law without unnecessary complexity.