What this toolkit is for, and who should use it

Artificial intelligence has moved from research labs into ordinary commerce faster than the law can comfortably absorb. A startup founder shipping a generative-AI feature, a patent attorney fielding an "the AI invented it" question, an in-house lawyer reviewing a vendor's model-licensing terms, and a privacy officer worried about facial recognition all confront the same underlying problem: existing doctrines—copyright, patent, contract, privacy, tort—were built for human actors, and courts and agencies are only now deciding how those doctrines apply to machines.

This toolkit is a navigational guide, not a treatise. It gives you a map of the whole field, walks each major decision point at a high level, and at every stage points you to the deeper mclaw.io articles and checklists plus the primary authorities you should read before forming a view. It is written for three audiences at once: the founder who needs to make a sound business decision, the lawyer who needs to advise defensibly, and the careful generalist who wants to understand why these questions are genuinely hard.

A word of caution up front. AI law in 2026 is among the least settled areas of practice. Major copyright suits are mid-stream, agency guidance is being revised, and legislatures (state, federal, and foreign) are actively drafting. Where the toolkit states a rule, treat it as the current best reading; where it flags uncertainty, take that seriously and verify before relying.

Roadmap at a glance

  1. Map the landscape. Understand the cross-cutting legal issues AI raises and which bodies of law are in play.
  2. IP ownership of AI output. Decide who—if anyone—owns what a model produces.
  3. Inventorship and authorship. Confront the threshold question of whether a non-human can be an inventor or author under U.S. law.
  4. Training-data copyright. Track the infringement and fair-use battles over the data used to build models.
  5. Biometric and privacy constraints. Account for BIPA, state privacy laws, and data-protection rules that bound AI data practices.
  6. Contracting for AI. Allocate risk, IP, and indemnity in agreements to build, buy, or deploy AI.
  7. Governance and risk. Stand up an internal program to manage AI legal, ethical, and operational risk.
  8. Adjacent emerging tech. Borrow lessons from how the law has handled drones and cryptocurrency.

Stage 1 — Map the AI legal landscape

Before drilling into any single issue, get the lay of the land. AI does not create one new field of law; it stresses many existing ones simultaneously. A single product can implicate copyright (training data and outputs), patent (AI-assisted inventions), trade secret (model weights and prompts), privacy (personal data in training sets), consumer protection (deceptive or biased outputs), tort (harm from a hallucinated answer), employment (automated decision-making), and sector-specific regulation (health, finance, hiring). Good AI counsel is first a good issue-spotter.

Start by separating the layers: the model (the trained system), the inputs (training data and runtime prompts), and the outputs (what the model generates). Most legal questions resolve more cleanly once you identify which layer a problem lives in. Then identify the actors—developer, deployer, end user—because liability and ownership often turn on who did what.

Resources

Stage 2 — IP ownership of AI output

When a model generates an image, a block of code, or marketing copy, who owns it? In the United States the surprising starting point is that purely machine-generated output may be owned by no one, because copyright requires human authorship (see Stage 3). That does not mean the output is worthless or unprotectable—but it does mean ownership is a matter of degree and of facts about human involvement.

Practically, ownership analysis runs on two tracks. First, copyright: how much human creative control shaped the specific output? A user who merely typed a short prompt likely has a weak claim to authorship of the result; a user who iteratively selected, arranged, and edited the output may have a protectable contribution in those human elements. Second, contract: even where copyright is thin or absent, the terms of service of the AI tool typically assign whatever rights exist (and disclaim others) between provider and user. Always read the tool's terms before assuming you own its output—and before assuming you may use it commercially.

Illustration. A design studio uses a text-to-image tool to generate fifty candidate logos, then heavily edits one in Illustrator. The raw generation is likely uncopyrightable; the studio's substantial human edits may be protectable as a derivative-style contribution, and the client agreement should assign those rights expressly rather than rely on copyright defaults.

Resources

Stage 3 — Inventorship and authorship: can a machine qualify?

This is the foundational doctrinal question, and U.S. courts have answered it consistently: no. On the patent side, the Federal Circuit in Thaler v. Vidal, 43 F.4th 1207 (Fed. Cir. 2022), held that an "inventor" under the Patent Act must be a natural person, so an AI system ("DABUS") could not be named as inventor. On the copyright side, the D.C. Circuit affirmed in Thaler v. Perlmutter (2025) that a work generated autonomously by an AI, with no human author, is not eligible for copyright registration—tracking the Copyright Office's "human authorship" requirement.

The doctrinal holdings are narrow but consequential. They do not say AI-assisted inventions are unpatentable or AI-assisted works are uncopyrightable. They say the named inventor/author must be human, and that the human must have made the kind of contribution the relevant law requires. The USPTO's 2024 inventorship guidance operationalizes this for patents: a natural person must have made a "significant contribution" to the claimed invention (drawing on the Pannu factors), and merely owning or running the AI is not enough. Expect litigation and PTO practice to refine where the human-contribution line falls.

Illustration. A chemist uses a generative model to propose candidate molecules, then exercises judgment to select, test, and refine one into a working compound. The chemist's significant human contribution likely supports valid inventorship; naming the model as a co-inventor would not.

Resources

  • Article: Artificial Intelligence and Inventorship: Global Perspectives on Machine Contributions to Innovation — how the U.S., EPO, UK, and other jurisdictions treat machine inventorship.
  • Article: AI-Generated Inventions: Who Owns What the Machine Creates — the inventorship-versus-ownership distinction in depth.
  • External — Thaler v. Vidal, 43 F.4th 1207 (Fed. Cir. 2022) (cert. denied): patent inventorship requires a natural person.
  • External — Thaler v. Perlmutter (D.C. Cir. 2025): affirming refusal to register an autonomously AI-generated work.
  • External — USPTO, Inventorship Guidance for AI-Assisted Inventions (Federal Register, Feb. 13, 2024) and USPTO AI resources at uspto.gov/initiatives/artificial-intelligence: the significant-contribution standard and examples.
  • External — U.S. Copyright Office, Copyright and Artificial Intelligence, Part 2: Copyrightability (copyright.gov/ai): the human-authorship analysis underlying Thaler v. Perlmutter.

Stage 4 — Training-data copyright: infringement and fair use

The most financially significant AI litigation concerns the data used to train models. Rights holders—news organizations, image libraries, authors, and musicians—argue that copying their works to build a model is infringement; developers argue the copying is transformative fair use. The outcome will shape the economics of the entire industry, and as of mid-2026 it is genuinely unresolved.

The analysis is the familiar four-factor fair-use test (17 U.S.C. § 107), but applied to novel facts: Is training "transformative" because the model learns statistical patterns rather than reproducing expression? Does the model's ability to output near-copies of training works undercut a fair-use defense? Does the use harm the market for the originals—or for licensing the works for training? Early decisions have split and turned heavily on their facts (for example, whether outputs reproduce protected expression, and whether the defendant's copies were lawfully obtained). Watch the New York Times v. OpenAI/Microsoft and Getty Images v. Stability AI litigations as bellwethers. Related questions about scraping the data in the first place (contract, CFAA, and copyright) flow from the hiQ v. LinkedIn line of cases.

Resources

Stage 5 — Biometric and privacy constraints on AI

AI systems that process faces, voices, gait, or other bodily identifiers run headlong into biometric-privacy law, and systems that process personal data generally must satisfy comprehensive privacy regimes. Illinois's Biometric Information Privacy Act (BIPA, 740 ILCS 14) is the sharpest sword: it requires informed written consent before collecting biometric identifiers, imposes retention and destruction obligations, and—critically—provides a private right of action with statutory damages, which has produced large class settlements. Texas and Washington have biometric statutes without (or with limited) private rights of action, and other states are following.

Beyond biometrics, AI development must reckon with state comprehensive privacy laws (California's CCPA/CPRA and the wave of state acts), data-minimization principles, automated-decision-making and profiling rules, and—where EU personal data is involved—the GDPR and cross-border transfer mechanics. The practical takeaways: identify every category of personal and biometric data flowing into training and inference; secure a lawful basis and any required consent; minimize and set retention limits; and document it. These obligations bite at the development stage, not just deployment.

Resources

Stage 6 — Contracting for AI

Most AI legal risk in practice is allocated—well or badly—by contract. Whether you are building a model, buying access to one, or embedding a vendor's AI in your product, the agreement should answer a predictable set of questions: Who owns inputs, fine-tuning data, and outputs? What rights does the provider take in your prompts and data (and can it use them to train)? Who indemnifies whom for third-party IP claims arising from training data or outputs? What are the warranties about accuracy, bias, and lawful sourcing? What confidentiality and security obligations protect trade-secret prompts and proprietary data? And how is liability capped given that AI outputs can be unpredictable?

For deployers, two clauses deserve special attention. First, IP indemnity: given the unresolved training-data litigation (Stage 4), allocate the risk that a model's output or training infringes a third party's copyright. Second, data-use restrictions: ensure the provider will not train on your confidential inputs unless you affirmatively allow it. Many of these issues echo classic software- and data-licensing practice, so adapt your existing technology-transaction playbook rather than starting from scratch.

Resources

Stage 7 — Governance and risk management

The final stage is internal: building a program so the organization makes consistent, defensible decisions about AI. A workable AI governance program inventories where AI is used, classifies each use by risk, sets policies for permitted and prohibited uses (including limits on feeding confidential or personal data into third-party tools), assigns human review for high-stakes outputs, addresses bias and explainability, and documents diligence on vendors and training data. It should connect to the privacy program (Stage 5), the contracting playbook (Stage 6), and incident-response and trade-secret protections, because a careless AI deployment can leak trade secrets or personal data as easily as it can infringe copyright.

Governance is also where emerging regulation lands. The EU AI Act introduces risk-tiered obligations with extraterritorial reach; U.S. states are enacting AI-specific laws (notably on automated employment decisions and disclosure); and regulators are applying existing consumer-protection and anti-discrimination law to AI. A living governance program lets you absorb these changes incrementally instead of scrambling.

Resources

Stage 8 — Adjacent emerging technologies: lessons from drones and crypto

AI is not the first technology to outpace its legal framework, and the patterns repeat. Drones forced regulators to reconcile a new device with airspace, privacy, trespass, and safety law—producing a layered federal-plus-state regime that AI counsel will find familiar. Cryptocurrency forced securities, money-transmission, tax, and commodities law onto a technology none of them anticipated, with regulators stretching old categories to new facts. Both stories teach the same lesson: when a technology is new, the law rarely waits for a tailor-made statute; it applies existing doctrines by analogy first, and clarifies later. Reading how that played out for drones and crypto sharpens judgment about where AI law is heading.

Resources

Master resource index

Articles

Checklists

Related toolkits

External & primary sources

  • USPTO, Inventorship Guidance for AI-Assisted Inventions (Fed. Reg., Feb. 13, 2024); USPTO AI initiatives — uspto.gov/initiatives/artificial-intelligence
  • U.S. Copyright Office, Copyright and Artificial Intelligence report (Parts 1–3) — copyright.gov/ai
  • Thaler v. Vidal, 43 F.4th 1207 (Fed. Cir. 2022) (patent inventorship requires a natural person)
  • Thaler v. Perlmutter (D.C. Cir. 2025) (no copyright for autonomously AI-generated work)
  • 17 U.S.C. § 107 (fair use); 35 U.S.C. § 100 (definition of "inventor")
  • Illinois BIPA, 740 ILCS 14; Rosenbach v. Six Flags (Ill. 2019); Cothron v. White Castle (Ill. 2023)
  • NIST AI Risk Management Framework — nist.gov/itl/ai-risk-management-framework
  • EU AI Act, Regulation (EU) 2024/1689 — eur-lex.europa.eu
  • Litigation dockets — courtlistener.com and pacer.uscourts.gov

This toolkit is general information, not legal advice. AI law is rapidly changing and frequently unsettled; verify the current state of statutes, cases, agency guidance, and fees at the official sources before relying on anything here.