A freelance designer in Bristol has been using Midjourney on client work for six months. A client asks who owns the final images. A solicitor in Leeds pastes a case summary into ChatGPT to speed up drafting, then wonders if the firm has breached its own data policy. An agency owner in Manchester sends an AI-drafted report to a corporate client who has just added a clause requiring confirmation that no AI tools were used on copyrighted third-party source material.
These are not edge cases. They are the conversations arriving now in owner-operated businesses across the UK, and the answers all trace back to the same piece of legislation passed before the internet existed.
What is UK AI copyright?
The Copyright, Designs and Patents Act 1988 is the primary law governing AI and copyright in the UK. There is no dedicated AI copyright statute. The CDPA applies to training data, AI-generated outputs, and the content businesses feed into tools every day. Text, images, code, and music are protected by default, and copying them without permission or a recognised exception is an infringement.
One CDPA provision does acknowledge machine-made work. Section 9(3) provides copyright protection for “computer-generated works” where there is no human author, with the “author” being the person who made the arrangements for the work’s creation. That clause, written in the 1980s to cover plotter software and procedurally generated graphics, is now being stretched to cover AI outputs. How much human editorial input is needed to attract standard copyright protection, rather than the narrower 50-year computer-generated works term, remains unsettled in UK law.
The UK government ran a consultation on copyright and artificial intelligence from February 2025, overseen by the Department for Science, Innovation and Technology and the Intellectual Property Office. The consultation proposed new rules for text and data mining, transparency obligations on AI developers, and mechanisms for rightsholders to signal that their content is not available for training. Draft legislation is expected during 2025 and 2026. Until then, the CDPA as it stands governs this area.
Why does it matter for your business?
Two copyright exposures matter for owner-managed businesses. The first is what your team feeds into tools: pasting licensed or client content into a public chatbot can breach your licences and infringe copyright. The second is what you publish from them: AI-generated outputs may reproduce protected work, making you liable even if you did not know the model had trained on that material.
On the input side, the risk often sits in licences you have already signed. Many news databases, stock image libraries, and research subscriptions explicitly prohibit automated text extraction or third-party AI processing. Pasting an extract from one of those tools into a public chatbot may void your subscription terms and expose the business to a contractual claim, separate from any copyright action.
On the output side, the major AI vendors have taken different positions. OpenAI assigns users any copyright it holds in ChatGPT outputs and disclaims liability if those outputs infringe a third party’s rights. Microsoft’s Copilot Copyright Commitment goes further: it offers to defend qualifying enterprise customers and cover adverse judgments in copyright claims arising from Copilot output, provided users have kept the default content filters enabled. That protection is conditional and has scope limits. If you are using AI tools to produce client deliverables and have not read the IP terms, you are carrying risk you have not priced.
Where will you actually meet it?
The copyright question becomes concrete in four situations: client contracts specifying how AI tools may be used on their materials; vendor terms that describe training rights over your input content; professional indemnity claims where AI-generated advice turns out to be wrong or plagiarised; and supply chain audits from larger clients managing their own AI risk under new procurement policies.
The litigation already clarifying the landscape is significant. Getty Images sued Stability AI in the UK High Court in January 2023, alleging that millions of its images were used without licence or payment to train Stable Diffusion. Authors’ groups have filed suits in the US against OpenAI over book content used in GPT model training. Both cases signal that the training-data question is live and contested, even if final UK verdicts remain outstanding.
For business users rather than AI developers, the more immediate risk is in commercial transactions. A growing number of larger UK organisations are adding AI-specific clauses to their supplier agreements, asking service providers to disclose which tools they use and to confirm they have not processed client materials in unmanaged AI tools. If your firm uses AI in client delivery, these clauses will start appearing in your contracts. A short internal policy about which tools you use and on what material makes answering them straightforward.
When to ask vs when to ignore
You can largely set aside the training-data dispute: that argument is between AI developers and rightsholders, not between you and your clients. Your exposure as an owner-manager sits in three narrower areas: what your team puts into tools, what you publish from them, and what your contracts say. In many commercial situations, those three things can be managed without specialist legal advice.
Treat licensed content as sensitive. Instruct your team not to paste full documents from subscription databases, licensed image libraries, or client files into public AI tools unless the relevant terms explicitly allow it. For AI-generated text going into client work, run a quick check on phrases that feel distinctive and look for anything that appears to reproduce a known source closely. Image outputs carry higher risk: avoid prompting for known artists’ styles and check for embedded watermarks or logos.
For significant commercial work, keep a simple record of which tools you used and for what. Documentation of a reasonable process matters more than a perfect one if you ever face a claim.
The moment to involve a solicitor is specific: if a client contract requires you to warrant that your deliverables do not infringe copyright and you are using AI in delivery, get a short conversation with a commercial lawyer before you sign. For the day-to-day usage of mainstream enterprise tools such as Microsoft Copilot or ChatGPT Plus, good internal practice covers the risk without the overhead of legal advice.
What else sits alongside this?
UK AI copyright does not exist in isolation. UK GDPR and the Data Protection Act 2018 apply wherever your AI use involves personal data, independently of copyright. The EU AI Act, fully effective from 2026 to 2027, is influencing UK policy even though the UK is not bound by it. All three reinforce the same core discipline: know what you feed into tools and why.
The government’s 2025 consultation proposed a text and data mining exception that would allow AI developers to train on content they can lawfully access, unless the rightsholder has explicitly reserved rights using a machine-readable mechanism such as robots.txt. This mirrors the approach in Article 4 of the EU’s Digital Single Market Directive. A House of Lords vote in January 2025 backed amendments to the Data (Use and Access) Bill to strengthen copyright protections, 145 votes to 126. The outcome of that process will determine whether UK rightsholders end up with a meaningful opt-out or a narrower right than many expect.
For businesses that create intellectual property, design agencies, software houses, content studios, the practical implication is worth noting now. If the UK enacts an opt-out TDM regime, your website content could be used to train AI models unless you actively signal otherwise via robots.txt or metadata standards. The IPO’s January 2025 report confirmed that owner-managed businesses are materially affected by the current uncertainty. The safest working assumption for 2025 and 2026 is that existing CDPA rules remain in force, the training-data argument continues in the courts, and your practical risk stays where it has always been: what your team feeds in, what you publish out, and what your contracts commit you to.
