Who Owns AI-Generated Code? Copyright, Licensing, and the Copyleft Trap

Your AI wrote half the codebase. Before you ship it — or raise on it — the question lands: do you actually own this code, and are you allowed to use it the way you are using it? The honest answer is that "who owns it" is really three different questions, and the riskiest one is the one almost nobody checks. This is practical guidance, not legal advice — IP law is jurisdiction-specific, so treat this as a map, not a ruling.

Three questions hiding inside "who owns it"

1. Can AI-generated code even be copyrighted?

In several major jurisdictions, copyright requires human authorship. The U.S. Copyright Office has repeatedly taken the position that purely AI-generated output, with no meaningful human creative contribution, is not copyrightable. The EU and other jurisdictions vary, and the law is still moving.

The counterintuitive consequence: for the parts an AI generated with little human shaping, you may not hold an exclusive copyright — which means you may not be able to stop others from using that same code. For most product teams this is survivable (your moat is rarely a single function), but it matters if your value is the code itself, and it is worth knowing before you tell an investor you "own" everything.

2. Are you allowed to use it commercially?

This is usually the easy one. The major AI coding tools (Copilot, Cursor, Claude, and others) assign output rights to you in their terms and generally permit commercial use — some even offer IP indemnification on paid/enterprise tiers. But "usually" is not "always," and terms differ by plan. Read the terms of the specific tool and tier you use, and keep a note of it. Free tiers and consumer plans sometimes carry different terms than business ones.

3. Could it carry someone else's license? (the trap)

Here is the one that bites. AI models are trained on enormous amounts of public code under many different licenses — including copyleft licenses like GPL and AGPL. A model can, and sometimes does, reproduce training-data snippets close to verbatim. If a chunk of generated code is substantially a copy of GPL-licensed code, then the GPL's obligations attach to it — regardless of the fact that an AI produced it and you had no idea.

The copyleft trap, concretely

Copyleft licenses are "viral": incorporate GPL code into your product and the license can require you to release your source under the same terms. That is fine for an open-source project and a serious problem for proprietary software. The danger with AI-generated code is that the contamination is invisible — there is no import line, no dependency in your manifest, no obvious signal. It is just code that looks like yours.

Teams have discovered copyleft-tainted AI-generated code late in a release cycle and faced the worst options: rewrite the contaminated module, or change how they license their product. The cost is not the license fee — it is the emergency rewrite and the shipped-product risk.

What to do before you ship AI-generated code

• Know your tool's terms. Confirm the IDE/model you use grants you commercial rights to output, on the tier you are actually on.
• Watch for verbatim reproduction. Be especially careful when the AI produces a large, complete, recognizable block (a known algorithm, a parser, a distinctive utility) — that is where regurgitation of licensed code is most likely.
• Track provenance. Keep some record of which parts of the codebase were AI-generated, so that if a license question ever arises you can answer it instead of auditing everything in a panic.
• Flag copyleft early. Catch GPL/AGPL-style patterns at commit time, not at release.
• Keep a dated record. "We checked, here is what we found, as of this date" is what turns a vague worry into something you can defend to a customer, an acquirer, or counsel.

Provenance: the layer that is still missing

You cannot manage what you cannot see. The reason license contamination is scary is that AI-generated code arrives with no provenance — no trail of where it came from or what it might carry. That is exactly the gap the next generation of dev guardrails is built to close: provenance and ship-safety for AI-generated code, at commit time, in the loop where you actually work.

We are building that into Legalithm next — know what your AI wrote, flag license-contaminated or unattributed snippets, and prove it is safe to ship. If that is a pain you feel, get early access — it tells us to build it for you sooner.

And the other obligation: the EU AI Act

Copyright and licensing are about the code. If your app also puts an AI feature in front of users — a chatbot, generated content, a classifier — you may separately owe duties under the EU AI Act, regardless of who owns the code. That is a different question with its own answer; see Does the EU AI Act apply to vibe-coded apps? and run the free AI Act assessment to find your tier.

Honest limits

This is general information, not legal advice — copyright and licensing outcomes depend on your jurisdiction and your facts, and this is an area where getting a qualified IP lawyer involved for anything high-stakes is the right call. Legalithm's job is to surface the questions early and keep a cited, dated record so you are not finding out at the worst possible moment.

Bottom line: you can almost always use the code your AI wrote — but "use it" and "own it cleanly" are not the same thing, and the copyleft trap is invisible until it is expensive. Provenance, caught in the loop, is how you keep AI-generated code shippable.