3.1. Training as reproduction

The training of large-scale GenAI models typically relies on extremely large datasets, often comprising text, images, audio and video scraped from the internet. These datasets may include works and other subject matter protected by copyright or related rights, such as press publications, photographs, films or phonograms (Gervais, Reference Gervais2019, 6). In fact, curating and creating data corpora raises important copyright law issues, particularly regarding the extent to which text and data mining (TDM) exceptions cover the activities required to compile them – such as web scraping and related forms of automated data extraction.

The most central legal question in this phase is whether the ingestion and processing of such data to train an AI model constitutes acts of reproduction within the meaning of EU copyright law. Some commentators argue that training merely extracts abstract, non-copyrightable features from data: advocates of the non-copying thesis emphasize that the output of training is not a repository of stored works but a configuration of parameters within a mathematical model (Bracha, Reference Bracha2025). During training, the system processes input data to extract non-protectable elements of works in order to adjust weight matrices in order to minimize predictive error. The trained model, therefore, comprises large arrays of numbers and algorithmic instructions, which encode multidimensional vector relationships. On this account, the process consists of the extraction and formalization of statistical regularities, rather than the duplication of protected expression.

However, the prevailing view in EU legal scholarship is that training necessarily involves acts of reproduction. Under this view, AI training not only extracts data value but also extracts expressive value from the works in the datasets, especially when such expression may be “memorized” in the model or “regurgitated” in outputs. This interpretation aligns with the broad conception of reproduction developed by the Court of Justice of the European Union (CJEU), which encompasses both permanent and temporary copies, provided that they reproduce the protected work in whole or in part and are fixed for a period of time.Footnote ² Also, training may involve acts of extraction and reutilization of datasets or other databases protected under the database sui generis right.Footnote ³ Accordingly, absent an applicable exception or authorization, training activities may prima facie infringe copyright. The most relevant exception or limitation is that of TDM. Other exceptions, such as temporary copies (art. 5(1) InfoSoc Directive) and incidental inclusions (art. 5(3)(i)), seem less relevant at present.

3.2. The TDM exceptions under Articles 3 and 4 of the DSM Directive

Articles 3 and 4 of the DSM Directive establish two distinct exceptions for TDM, reflecting a differentiated regulatory approach (Margoni & Kretschmer, Reference Margoni and Kretschmer2022).

Article 3 introduces a mandatory exception for TDM carried out by research organizations and cultural heritage institutions for the purposes of scientific research. It permits reproductions and extractions of lawfully accessible works and other subject matter to the extent necessary for TDM. This exception cannot be contractually overridden and applies irrespective of the rightsholder’s consent, provided access to the material is lawful. Rightsholders may, however, implement proportionate measures to ensure the security and integrity of their networks and databases. Copies generated under Article 3 may be retained for scientific research purposes, including for the verification of research results.Footnote ⁴ Article 4, by contrast, establishes a broader but conditional exception applicable to all users and for any purpose, including commercial uses. It permits reproductions and extractions for TDM of lawfully accessible works, but it is subject to an opt-out mechanism: rightsholders may expressly reserve their rights in an appropriate manner, including by machine-readable means for online content.

The opt-out mechanism in Article 4 raises significant practical and legal challenges in the context of GenAI training (Keller, Reference Keller2023). There is ongoing debate as to what constitutes an “appropriate manner” of reservation and whether non-machine-readable means, such as contractual terms or website notices, may suffice.Footnote ⁵ Additional questions persist concerning the scope (general vs. specific) and timing (ex ante vs. ex post) of opting out, as well as regarding who is entitled to exercise such reservations (Mezei, Reference Mezei2024). Moreover, the effectiveness of opt-outs is questionable in large-scale scraping contexts, where AI developers may have limited ability to identify and respect individual reservations of rights.

The AI Act attempts to address some of these issues by imposing specific obligations on providers of general-purpose AI models. Article 53(1)(c) requires providers to put in place a policy to comply with EU copyright law, including mechanisms to identify and respect reservations of rights expressed under Article 4(3) DSM Directive. This obligation effectively integrates copyright compliance into the broader AI governance framework (Quintais, Reference Quintais2025).

An emerging consensus in EU copyright law is that many reproductions and extractions made during the training of AI models can be conceptualized as forms of TDM. This view appears to be endorsed by the EU legislator itself. Recital 105 of the AI Act explicitly acknowledges that the development and training of general-purpose AI models may rely extensively on TDM techniques and that such uses may be covered by the exceptions introduced by the DSM Directive. Similarly, the Code of Practice for General-Purpose AI Models published in July 2025 assumes that training activities may fall within the scope of the TDM exceptions, subject to compliance with their conditions. This legislative and regulatory context suggests that, at least in principle, AI training may be lawful under EU copyright law where it complies with Article 3 or 4 of the DSM Directive. However, some scholars have resisted this view in the context of GenAI technologies (Dornis, Reference Dornis2025a; Rosati, Reference Rosati2025; Alonso & Lucchi, Reference Alonso and Lucchi2025).

Among other arguments, they argue that the initial purpose underlying the training of a model is legally determinative for the applicability of TDM exceptions. On this view, TDM covers exclusively analytical uses of protected works and does not extend to uses that are intrinsically generative in nature (Alonso & Lucchi, Reference Alonso and Lucchi2025, 516). The legislative rationale of the TDM exceptions, it is contended, was to enable the extraction of new information from datasets through analytical techniques – such as advanced statistical processing, correlation analysis, inferential modeling or the generation of relational embeddings – rather than to facilitate the production of expressive outputs that may substitute for the original works. In other words, the TDM exceptions would assume a considerably more limited function in the context of GenAI than in relation to other forms of AI, such as predictive, classificatory or discriminatory models.

A similar restrictive approach appears in the decision of November 11, 2025, by the Regional Court of Munich (LG München I) in GEMA v. OpenAI. The court adopted a comparatively narrow interpretation of Article 4 of the DSM Directive, suggesting that the exception may not encompass the full spectrum of activities involved in the training of generative AI systems. In particular, where protected works are memorized within the model, the exception would arguably extend only to preliminary stages of the value chain – such as data collection, preparation and dataset creation – but not to the training process itself or to the storage of embeddings that effectively reproduce protected content.

This reasoning leaves open a significant doctrinal question: whether the absence of memorization would suffice to bring the acts of reproduction occurring during model training within the scope of the TDM exception. The answer remains uncertain, underscoring the unresolved boundaries between analytical processing and generative deployment in contemporary AI systems. At the same time, the multipurpose and modular nature of foundation models – capable of being deployed autonomously across a range of downstream applications, including both GenAI systems and predictive or discriminatory ones – may complicate the understanding of the TDM scope of application and the assessment of liability.

3.3. Limits of the TDM framework

Despite its apparent centrality, the TDM framework does not resolve all copyright issues associated with AI training and, in particular, with training for generative purposes. First, the TDM exceptions cover only the rights of reproduction and extraction under the sui generis database right. They do not directly address other exclusive rights, such as communication to the public, adaptation or moral rights, which might be more relevant at later stages of the GenAI value chain.

Second, the exceptions are subject to the three-step test, which requires that they apply only in certain special cases, do not conflict with the normal exploitation of the work and do not unreasonably prejudice the legitimate interests of the rightsholder.Footnote ⁶ Critics argue that large-scale commercial AI training may undermine existing and potential licensing markets, raising concerns about “market dilution,” and thus question the compatibility of a broad interpretation of the TDM exception with the three-step test (Dornis & Lucchi, Reference Dornis and Lucchi2025). A narrow interpretation of exceptions and limitations is accompanied by a high level of protection of exclusive rights.Footnote ⁷ Other scholars have pointed out instead that an opt-out opportunity for copyright owners effectively precludes any conflict with the normal exploitation of a work or any unreasonable prejudice from the outset (Senftleben, Reference Senftleben2026).

Third, unresolved questions remain regarding the lawfulness of training on unlawfully accessible content, such as works obtained from shadow libraries, or where technical protection measures have been circumvented. These scenarios may fall outside the scope of the TDM exceptions and expose developers to liability. Some scholars have advocated for broader conceptions of the requirement of a lawful source to foster scientific research. For instance, it has been suggested that the requirement of lawful access should only cover the behavior of the beneficiary of the exception and not extend to the status of the accessed source (Margoni, Reference Margoni2024).

Finally, the extraterritorial dimension of the AI Act raises further uncertainty. The territorial scope of the copyright-related obligations imposed on providers of general-purpose AI models under Article 53 of the AI Act remains one of the most contested issues in the emerging EU regulatory framework for GenAI. In particular, it is unclear to what extent these obligations apply to training activities conducted outside the EU where the resulting models, or their outputs, are subsequently placed on or made available within the internal market (see Recital 106). The debate reflects a structural tension between the traditionally territorial nature of copyright law and the internal-market logic of EU regulatory legislation. Several interpretative approaches have been advanced to address situations in which an AI model is trained outside the EU without complying with the reservation-of-rights mechanism under Article 4 of the DSM Directive. Some scholars contend that Article 53 of the AI Act should be conceptualized primarily as a market-access compliance mechanism rather than as a substantive extension of EU copyright law (Stieper & Denga, Reference Stieper and Denga2024; Quintais, Reference Quintais2025, 9–10). Under this view, the act of making such a model available on the EU market would not, in itself, constitute copyright infringement. Instead, noncompliance would trigger regulatory consequences under the AI Act, including potential sanctions. Other scholars maintain that copyright infringement arising from noncompliance with TDM conditions abroad should be limited to cases where protected works or other subject matter were scraped from sources located within the EU (Peukert, Reference Peukert2024, 9–12). Finally, a broader interpretation suggests that training activities conducted abroad in violation of Article 4 of the DSM Directive may give rise to copyright infringement once the resulting model is placed on the EU market (Rosati, Reference Rosati2025).

To sum up, significant legal uncertainty persists as to whether the training of AI models falls squarely within the scope of the EU TDM exceptions. Much depends on how broadly or narrowly courts interpret key concepts such as “reproduction,” “lawful access” or a developer’s intentionality in training a model with a view to generating creative content. A restrictive construction would heighten the risk of copyright liability for AI developers, potentially necessitating extensive licensing arrangements and increasing transaction costs, thereby affecting innovation and market entry. Conversely, a more expansive interpretation of the TDM exceptions could provide greater legal certainty and foster technological development within the EU. Such an approach may also pragmatically align EU practice with more permissive environments, particularly in jurisdictions such as the US, where flexible doctrines have been invoked to accommodate large-scale data use in technological innovation (Lee, Reference Lee2025; Sag & Yu, Reference Sag and Yu2025). It remains unclear whether such an interpretative direction ought to emerge through decentralized judicial development in individual cases, or whether it would be preferable for it to be articulated through a more coherent, top-down legislative intervention.

5.1. Regurgitation and substantial similarity

The output phase raises perhaps the most intuitively compelling copyright concerns. Where a GenAI system produces content that closely resembles or reproduces protected material from its training data, this may constitute an unauthorized reproduction, adaptation or communication to the public of protected subject matter (Rosati, Reference Rosati2025). This phenomenon, often referred to as “regurgitation,” remains imperfectly understood from a technical perspective. While most outputs are novel combinations of learned patterns, there is evidence that models may reproduce memorized content, particularly in response to specific prompts (Carlini et al., Reference Carlini, Hayes, Nasr, Jagielski, Sehwag, Tramer, Balle, Ippolito and Wallace2023).

From a legal standpoint, the assessment of infringement of the right of reproduction will likely rely on established tests, such as substantial similarity. EU law does not employ a single harmonized test, but CJEU case law emphasizes the reproduction of the author’s own intellectual creation and, probably, its recognizability in the final output. Applying this standard to AI-generated outputs will require careful analysis of the relationship between the output and any identifiable pre-existing work.

In many cases, the immediate cause of an infringement will be the conduct of the end user, who formulates prompts that induce the system to reproduce or adapt protected works. However, AI providers and deployers cannot be excluded from the analysis.

5.2. Potential liability of users

Several caveats must be taken into account when assessing the potential copyright liability of users who prompt a GenAI system to produce outputs that closely resemble protected works.

First, it is necessary to distinguish between the mere generation of an output by a user and the subsequent acts performed in relation to that output, such as its reproduction, distribution, communication to the public or adaptation. Once the output is downloaded, shared online, incorporated into commercial materials or otherwise disseminated, distinct acts falling within the scope of the exclusive rights of the rightsholder may arise. This may facilitate avoiding the hurdles to prove that the act of generating content through an AI system entails, in itself, an act of exploitation within the meaning of copyright law. In many cases, the practical and economic relevance of AI-generated content lies not in its production but in its subsequent circulation and commercial use. Accordingly, exploitation acts of the following generation are likely to be more consequential in assessing liability for infringement.

Second, copyright law generally excludes liability for independent creation: infringement presupposes a causal link between the protected work and the allegedly infringing result. However, in the context of GenAI, users may obtain outputs that closely resemble existing works without any knowledge of, or intent to reproduce, those works (Szkalej, Reference Szkalej2025, 97). This raises the question whether users can effectively invoke independent creation where similarity results from the model’s training process, particularly if the relevant work formed part of the training dataset or was “memorized” in the model’s parameters. The doctrinal challenge lies in determining whether the user’s lack of access or awareness suffices to break the chain of causation, or whether the model’s prior exposure to the work may be imputed to the user in certain circumstances.

Third, even where substantial similarity can be established, liability does not automatically follow. Exceptions and limitations may apply, most notably the exception for quotations and caricature, parody and pastiche under EU law. The pastiche exception may acquire heightened relevance in cases where AI-generated outputs imitate particular genres, aesthetics or artistic conventions. Yet the scope of “pastiche” remains contested, both conceptually and in its practical contours, and its extension to AI-generated content is far from settled (Mezei et al, Reference Mezei, Jutte, Sganga and Pascault2024). The assessment will depend on whether the output engages in a form of stylistic dialogue, homage or transformative reference that satisfies the normative justifications underlying the exception.

Finally, any assessment of liability must clearly distinguish between protected expression and the unprotected elements of a replicated work. This distinction is particularly salient where users prompt GenAI systems to generate outputs “in the style of” a specific artist. Contemporary GenAI systems are increasingly capable of emulating highly distinctive artistic styles with considerable technical accuracy, thereby intensifying the need for doctrinal clarity. Under the prevailing view in copyright theory, style as such does not enjoy protection; copyright safeguards only concrete and original expressions. However, drawing the line between unprotected stylistic influence and protected expressive elements is often complex in practice. The difficulty lies in determining when an output merely reflects general aesthetic features characteristic of an author’s style, and when it reproduces sufficiently specific expressive choices to trigger protection (Sobel, Reference Sobel2024). This challenge is further compounded by national approaches to the assessment of substantial similarity. Jurisdictions that adopt holistic tests – such as those resembling the “total concept and feel” doctrine developed in the US – risk blurring the analytical distinction between style and expression. By focusing on the overall impression produced by a work, such approaches may inadvertently conflate stylistic emulation with the reproduction of protected expression. In turn, this may broaden the effective scope of copyright protection and expand the potential for liability at the output stage.

5.3. Potential liability of AI providers

A central issue in the output phase concerns the allocation of liability among the various actors involved in the GenAI ecosystem. As previously discussed, in many scenarios, the immediate act that gives rise to potential infringement will be performed by the end user who prompts the system and disseminates the resulting output. From a doctrinal perspective, this suggests that primary liability will often attach to users. However, given the technical and organizational interdependence between users and system providers, doctrines of secondary liability – such as contributory or accessory liability, inducement or joint tortfeasorship, depending on the national framework – are likely to assume particular significance. Secondary liability for copyright infringement is not harmonized in EU. The decisive questions under national law will concern the degree of control exercised by providers over outputs, their knowledge (actual or constructive) of infringing uses, and the foreseeability of unlawful conduct.

In practice, the implementation of technical safeguards, such as output filters, content classifiers, watermarking systems and prompt moderation tools, may significantly influence liability assessments. From a copyright perspective, the presence of such measures may serve as evidence that a provider has taken reasonable steps to prevent foreseeable infringements, thereby mitigating the risk of secondary liability. Conversely, the absence of effective safeguards in circumstances where infringing outputs are predictable and recurrent could support arguments of negligence or constructive knowledge. The design, scope and effectiveness of these technical measures are therefore likely to become central factors in judicial evaluations of diligence and responsibility in the output phase.

AI provider’s primary liability for the generation of outputs may not be excluded, however, as illustrated by the GEMA v. OpenAI decision. In particular, in its interpretation of the right of communication to the public, the CJEU has expanded the scope of primary liability to encompass conduct that national legal systems have traditionally characterized as secondary infringement, thereby potentially subjecting facilitative acts to direct liability.Footnote ¹⁰

6.1. RAG and the Like Company v Google case

RAG is a hybrid architecture that combines generative language models with external information retrieval systems. Instead of relying exclusively on knowledge encoded in model parameters during training, a RAG system first retrieves relevant documents or data from an external corpus (e.g., curated databases, proprietary repositories or the open web) and then conditions the model’s response on that retrieved material (Lewis et al., Reference Lewis, Perez, Piktus, Petroni, Karpukhin, Goyal, Küttler, Lewis, Yih, Rocktäschel, Riedel and Kiela2020). This architecture addresses several well-known limitations of standalone LLMs: it mitigates hallucinations by grounding responses in identifiable sources; it improves factual accuracy and timeliness, since the external knowledge base can be updated independently of model training; and it enhances transparency, as systems may provide citations or references to retrieved materials.

Contemporary AI chatbots widely employ RAG mechanisms, particularly in enterprise and knowledge-intensive settings. For example, customer-service assistants retrieve internal policy documents before generating answers; legal or research assistants query curated databases to support doctrinal or factual claims; and web-enabled chatbots like ChatGPT and Gemini perform live searches to provide up-to-date information.

From a copyright perspective, RAG gives rise to several complex questions. A particular problem concerns the legal qualification of a deployer of an AI system that uses RAG to retrieve data from the open web under the EU Digital Services Act (DSA). A central issue is whether such agents may be characterized as intermediary service providers and, more specifically, whether they can be assimilated to hosting services or search engines for the DSA’s liability framework (Melian Pérez, Reference Melian Pérez2025). Where a deployer qualifies as a hosting service provider, it may benefit from the conditional liability exemption for third-party content. This safe harbor applies insofar as the intermediary service provider lacks actual knowledge of illegal activity or content and acts expeditiously to remove or disable access upon obtaining such knowledge. These exemptions are accompanied by due diligence obligations, including the establishment of notice-and-action mechanisms, compliance with transparency requirements and, where the provider qualifies as a very large online platform, the implementation of enhanced risk assessment and mitigation measures.

The applicability of these safe harbors to deployers of GenAI systems using RAG remains contested. The key doctrinal question is whether retrieved content from the internet incorporated into model outputs can still be regarded as “third-party information” stored or transmitted neutrally and passively. If, by contrast, the deployer is considered to play an indispensable and deliberate role in selecting, integrating and presenting protected works to users, this may suggest an active intervention that goes beyond the conditions traditionally associated with safe-harbor protection.Footnote ¹¹ In such a scenario, reliance on the DSA liability exemptions could be significantly restricted or even excluded. A related problem concerns the role of the provider of an AI system that employs RAG. It is unlikely that such providers can be qualified as intermediary service providers under the DSA.

The Like Company v Google case (C-250/25), pending before the CJEU, may become a landmark decision for AI-generated outputs under EU copyright law. The dispute concerns outputs generated by the Bard (now Gemini) chatbot in response to prompts requesting summaries of specific online press publications operated by the plaintiff, a Hungarian company.

The plaintiff alleges that the chatbot’s responses constitute an unauthorized communication to the public of its press publications. The case primarily concerns the legal status of AI-generated outputs, rather than training activities. Nevertheless, the referring court has also raised questions relating to training and TDM, even though these issues appear only tangentially relevant to the facts. Notably, the factual scenario may involve RAG, whereby the chatbot retrieves content from the online sources operated by the plaintiff at query time and generates a summary. The CJEU’s approach to framing and narrowing the issues will be crucial. Its judgment may set important precedents for the application of copyright law to AI-generated summaries and for the interpretation of communication to the public in AI-mediated contexts, where RAG has become very common.

6.2. Moral rights in the GenAI value chain

Although the EU copyright acquis is primarily concerned with the harmonization of economic rights and related exceptions, moral rights remain an integral part of the European copyright landscape (Dore, Reference Dore, Mézei, Travis and Pogácsás2024). Their protection derives chiefly from national laws of the Member States, shaped by Article 6bis of the Berne Convention, which recognizes the author’s right to claim authorship of a work (right of attribution or paternity) and the right to object to any distortion, mutilation or other modification of the work that would be prejudicial to the author’s honor or reputation (right of integrity).

Two features of moral rights are particularly relevant for GenAI. First, moral rights are typically inalienable and non-waivable, or at least subject to strict limitations on waiver under national law. Second, they are generally not affected by copyright exceptions and limitations, including the TDM exceptions introduced by the DSM Directive. As a result, even where acts of reproduction carried out in the context of GenAI are lawful under an exception, moral rights claims may, in principle, still arise. This creates a structural tension between large-scale, automated data processing and author-centric rights grounded in personality and dignity (Sundara Rajan, Reference Sundara Rajan2025, 348 and ff.).

The training of GenAI models raises the question of whether large-scale data ingestion and processing may infringe moral rights (Lucchi, Reference Lucchi2025, 62). With regard to the right of attribution, it is likely that training activities do not trigger an obligation to identify authors. Training involves the automated processing of vast quantities of data for analytical purposes, without any public disclosure of individual works or their authorship. In such a context, attribution is not only practically unfeasible but also conceptually misaligned with the rationale of the right, which presupposes a communicative or expressive use of the work. Imposing attribution requirements at the training stage would effectively render TDM and AI training impossible, undermining the very objectives pursued by the DSM Directive. However, as described in a study commissioned by the EU, 67 percent of respondents agreed that rightsholders should be permitted to invoke moral rights to object to the use of their works in AI training (European Commission, 2022, 230).

A similar conclusion is generally reached with respect to the right of integrity. Although training entails the technical transformation of works – through processes such as tokenization, fragmentation and vectorization – these transformations occur at an internal, non-expressive level. The right of integrity traditionally protects the author against modifications that are perceptible to the public and that prejudice the author’s honor or reputation. Internal data processing that leaves no identifiable work accessible to human perception is therefore unlikely to constitute a legally relevant modification. Moreover, the absence of any communicative act makes it difficult to establish the type of personal or reputational harm required for an integrity claim.

Similarly, moral rights claims at the storage stage face significant obstacles. As long as any memorized content remains latent and non-expressive, there is no context in which attribution could be required, nor any perceptible modification that could ground an integrity claim. EU copyright law has traditionally required that the protected work be at least indirectly identifiable for moral rights to be engaged. Accordingly, moral rights concerns in the storage and distribution phase remain largely hypothetical and contingent on subsequent expressive uses. However, approaches such as the GEMA v. OpenAI case can lead to a more relevant role of moral rights at the storage phase.

The generation of outputs is the phase in which moral rights acquire their greatest practical and legal significance (Geiger & Di Lazzaro, Reference Geiger and Di Lazzaro2025). Unlike training and storage, output generation involves communicative acts that are directly perceivable by users and, potentially, by the public at large. The right of attribution may be implicated where AI-generated outputs reproduce or closely track identifiable preexisting works. This is particularly relevant in cases involving summaries, paraphrases or representations of journalistic or literary content. Where an output reproduces protected expression from a specific work, national laws may require that the author be identified, even if the reproduction is partial or mediated by an AI system. Misattribution can also lead to an infringement of this moral right.

The right of integrity is potentially even more salient in the output phase. AI-generated content may distort, misrepresent or inaccurately summarize protected works, thereby associating authors with meanings, viewpoints or qualities they did not intend. Such distortions may be particularly harmful in sensitive contexts, including political commentary, journalism, scientific communication and artistic expression. In these cases, authors may plausibly argue that AI-generated outputs prejudice their honor or reputation, even in the absence of direct economic harm.

6.3. Technical protection measures and digital rights management

As AI developers rely on vast quantities of data scraped from the internet, the processes involved frequently interact with TPMs and DRMI.

TPMs are technologies, devices or components designed to prevent or restrict unauthorized acts regarding copyrighted works (e.g., paywalls, encryption, CAPTCHA or sophisticated anti-scraping scripts). To build massive training datasets, AI developers deploy web crawlers to harvest digital content. DRMI includes any information provided by rightsholders that identifies the work, the author or the terms and conditions of its use (e.g., digital watermarks, metadata or embedded licensing terms). Raw data scraped from the web are highly unstructured. Before the data can be fed into a neural network architecture, it must undergo rigorous preprocessing – a phase that involves cleaning, normalization and tokenization. During this “cleaning” process, extraneous data, including metadata, author attributions and licensing terms, are routinely stripped away to optimize the text or image for algorithmic analysis. Consequently, the AI model “learns” the expressive patterns of the works without retaining the associated DRMI.

The circumvention of TPMs and the removal of DRMI can carry severe legal ramifications within the EU copyright system. Articles 6 and 7 of the InfoSoc Directive establish autonomous grounds for liability. This means a rightsholder can sue an AI developer for stripping metadata or bypassing a paywall even if the underlying extraction of the data is eventually deemed permissible (e.g., under a TDM exception). However, removal or alteration of any electronic rights-management information is not sufficient by itself: the agent should know or should have reasonable grounds to know that by so doing, it is inducing, enabling, facilitating or concealing an infringement of any copyright or any related rights, including the database sui generis right. In case of infringement, rightsholders can seek civil remedies, including injunctive relief (to halt the scraping or force the deletion of unlawfully acquired training data) and damages. Furthermore, Member States are required to provide proportionate sanctions, which in some jurisdictions include criminal penalties for willful circumvention or alteration for commercial advantage.

Similar protections exist in the US under the Digital Millennium Copyright Act (DMCA), specifically Section 1201 (anti-circumvention) and Section 1202(b) (removal of Copyright Management Information, or CMI). The stripping of CMI during AI training has become a heavily litigated issue in US federal courts, though plaintiffs face stringent statutory hurdles. To succeed under Section 1202(b), plaintiffs must prove a “double scienter” (two-tiered intent): the AI developer must have (1) intentionally removed the CMI, and (2) known or had reasonable grounds to know that this removal would induce, enable, facilitate or conceal an infringement. AI companies frequently argue that CMI removal is merely a technical byproduct of standard machine-learning preprocessing, rather than an intentional act designed to contribute to infringement. So far, US District Courts have mostly dismissed claims based on CMI removal.Footnote ¹²

6.4. Remedies and enforcement

If copyright infringement is established, rightsholders within the EU may rely on a harmonized system of remedies set out in Directive 2004/48/EC on the enforcement of intellectual property rights (IPRED). This framework provides for injunctive relief, pecuniary compensation in the form of damages, and corrective measures, including the recall, removal from the channels of commerce or destruction of infringing goods.

The application of this remedial framework to GenAI systems, however, raises novel and complex issues (Rubi-Puig & Wolsing, Reference Rubi-Puig, Wolsing, Bonadio, Mezei and Alonso2026). Traditional remedies were designed for tangible infringing goods or clearly identifiable acts of reproduction and distribution. By contrast, GenAI’s technological architecture complicates the calibration of proportionate remedies.

The assessment of damages illustrates these difficulties. Under the Directive, compensation may be calculated, inter alia, based on lost profits, unfair profits made by the infringer or a lump sum corresponding at least to a hypothetical license fee (Article 13 IPRED). In the context of AI training, however, rightsholders may encounter significant evidentiary obstacles. In many sectors, established licensing markets for AI training uses are only nascent or absent, making it difficult to demonstrate a consistent market practice or even the rightsholder’s own licensing policy. Proving actual economic harm is equally challenging, given the diffuse and indirect relationship between the use of individual works in training datasets and downstream model outputs.

These enforcement challenges have prompted proposals for innovative remedies tailored to AI systems, such as model disgorgement and machine unlearning (Feder Cooper et al., Reference Feder Cooper, Choquette-Choo, Bogen, Klyman, Jagielski, Filippova, Liu, Chouldechova, Hayes, Huang, Triantafillou, Kairouz, Mitchell, Mireshghallah, Jacobs, Grimmelmann, Shmatikov, Shumailov, Terzis, Barocas and Lee2024). Such measures would require developers to retrain models or otherwise modify them to remove the influence of specific protected works. While conceptually appealing as a means of restoring the status quo ante, these remedies raise serious concerns regarding proportionality, feasibility and social cost. Retraining complex models can generate high private and social costs, and certain unlearning methods may not fully eliminate the residual influence of specific works on model parameters or outputs.