Ken McConkey, Esquire

Experienced | Knowledgeable | Effective

Tag: SaaS

Who Owns AI-Generated Content? Where U.S. Copyright Law Stands in 2026
Your marketing team produced a quarter’s worth of blog images in an afternoon. Your engineers shipped a feature with an AI coding assistant. Someone rewrote the landing page copy over lunch. Nobody stopped to ask whether you own any of it.

The bottom line: you probably own less than you think, and what you do own turns entirely on what a human actually contributed. That isn’t a close question anymore, with no split in the U.S. Circuit Courts and the Copyright Office’s own guidance pointing in the same direction. The Supreme Court declined to take it up on March 2, 2026.

What You Actually Own

U.S. copyright protects works of human authorship. Material an AI system generates, without meaningful human creative control over its expressive elements, isn’t protected by copyright at all. Not by you, not by the AI vendor, not by the model. It’s unowned from the moment it exists.

That doesn’t make AI output worthless, and it doesn’t stop you from using it commercially. It means the raw output carries no copyright you can enforce against a competitor who lifts it. Whatever protection you get attaches to the human contribution: the text a person wrote, the edits a person made, the creative selection and arrangement of AI-generated pieces into something larger.

Looking at Oklahoma law, for example, businesses have no separate state copyright protections. And regardless of which state your business operates in, Copyright is exclusively federal. 17 U.S.C. § 301 preempts state-law rights equivalent to it, though contract, trade secret, and right-of-publicity claims aren’t preempted and can still matter in an AI-content dispute.

Where the Copyright Office Has Drawn the Line

The Copyright Office’s refusal letters are more useful than the abstract rule, because they show you the line applied to real facts. Three are worth knowing.

Zarya of the Dawn. A graphic novel combining the author’s own written text with Midjourney-generated images. The Office split it. The author’s text, and her selection, coordination, and arrangement of the written and visual elements, were registered. The Midjourney-generated images were not, because they were “not the product of human authorship.” Prompts, the Office reasoned, work more like suggestions than orders, since you can’t predict what the system hands back.

Théâtre D’opéra Spatial. Jason Allen’s award-winning image, refused even though he’d run more than 600 prompts before settling on an output. The problem wasn’t that Allen didn’t work hard enough. It’s that Midjourney “does not interpret prompts as specific instructions to create a particular expressive result.”

SURYAST. The Copyright applicant fed his own photograph and Van Gogh’s The Starry Night into the AI image generator, then picked a number controlling how strongly thestyle transferred. Copyright refused by the Office. Even with a copyrightable input, the AI system decided where elements landed and what colors applied, and “selecting a single number for a style filter is the kind of de minimis authorship not protected by copyright.”

The registration guidance itself, published at 88 Fed. Reg. 16190, adds an obligation many people miss. If your work contains more than a de minimis amount of AI-generated material, you have to disclose it and describe what the human contributed. Already registered something without disclosing? File a supplementary registration and correct the record.

The Framework the Office Applies Now

In January 2025 the Office published Copyright and Artificial Intelligence, Part 2: Copyrightability. It’s the document your team should be working from, and here is what it says.
- Prompts alone aren’t enough. “Based on the functioning of current generally available technology, prompts do not alone provide sufficient control.” A longer, more elaborate prompt doesn’t change the analysis, which is worth passing along to anyone on your team convinced their prompt engineering amounts to authorship.
- Using AI as a tool costs you nothing. “The use of AI tools to assist rather than stand in for human creativity does not affect the availability of copyright protection for the output.” Removing an object from a photo, cleaning up audio: assistive, and fine.
- Your own expression survives. Feed your copyrightable work in, and whatever of your expression is still perceptible in the result is still yours.
- Creative selection, coordination, arrangement, and modification of AI material are protectable, as to what the human actually did.
The Office also declined to recommend new legislation, concluding that “the case has not been made for additional copyright or sui generis protection for AI-generated content.” I’d expect that to hold for a while as Congress has shown no indication of addressing the question, and the Office just spent two years explaining why nothing new is needed.

Testifying to the Senate Judiciary IP Subcommittee on May 12, 2026, Register of Copyrights Shira Perlmutter said the Office “has to date registered more than 7,000 claims that include AI-generated materials where those materials have been disclaimed.” Works built with AI get registered all the time. They get registered because the applicant disclosed the AI material and claimed only the human part.

The Courts Agree

Stephen Thaler applied to register an image naming his AI system as the author. The Office refused. On March 18, 2025, the D.C. Circuit affirmed: “As a matter of statutory law, the Copyright Act requires all work to be authored in the first instance by a human being.” Thaler v. Perlmutter, 130 F.4th 1039 (D.C. Cir. 2025). The reasoning is structural, not philosophical. The Act measures the copyright term by “the life of the author,” passes termination rights to a widow, widower, or surviving children, and requires transfers signed by the owner. None of that works if the author is a machine.

The line worth keeping is the court’s own caveat: “the human authorship requirement does not prohibit copyrighting work that was made by or with the assistance of artificial intelligence.” Using AI isn’t the disqualifier. Letting AI do the authoring is.

The Supreme Court denied certiorari on March 2, 2026. Thaler v. Perlmutter, No. 25-449. The same answer had already landed on the patent side, where the Federal Circuit held that an inventor has to be a natural person. Thaler v. Vidal, 43 F.4th 1207 (Fed. Cir. 2022).

The Part Nobody Has Answered

Pure AI output isn’t protected. Substantial human authorship is. Where the line falls between those two is still anyone’s guess, and no court has ruled on it.

Allen v. Perlmutter, No. 1:24-cv-02665 (D. Colo.), is the case to watch. Cross-motions for summary judgment were fully briefed in January 2026 and it’s still pending. It’s the first real chance for a federal court to say how much iterative prompting, curation, and editing adds up to authorship. My guess is the court affirms the Office and says very little about the middle, which would leave everyone roughly where they are now. Worth watching regardless.

The evidentiary standard is undeveloped too, so nobody knows what proof of human creative contribution a court will want to see. And here’s the one that catches people, a work that isn’t copyrightable can still infringe somebody else’s copyright. Having no protection in your output says nothing about your exposure.

What a Registrable AI-Assisted Work Looks Like

Put the negative rules together and a usable path falls out. Nothing about AI in your workflow blocks registration. What blocks it is a deliverable where you can’t point to what the human did.

The safest version looks like this. A person writes, drafts, photographs, or designs something copyrightable. AI assists somewhere in the process, or generates components. A person then selects among outputs, arranges them, and edits them in ways that add original expression. On the application you claim the human contribution, describe it, and disclaim the AI-generated material. What you get is a registration covering the human layer, which is narrower than a registration covering everything, and considerably better than nothing.

Zarya of the Dawn is the model here, not the cautionary tale it usually gets cited as. The author walked away with a registration covering her text and her arrangement. She lost the images. That’s the trade, and for most business content it’s a perfectly acceptable one.

What to Do About It

Read your AI vendor’s output clause for what it actually says. OpenAI’s consumer Terms of Use, under the Content section, assign you “all our right, title, and interest, if any, in and to Output.” Those two words, “if any,” are doing real work. If the output isn’t copyrightable, the assignment conveys nothing, because there’s nothing to convey. It’s a promise not to claim the material against you, not a warranty that you own it.

Let me point you to another example in the OpenAI consumer Terms of Use. Look under the Content section at the paragraph titled, “Ownership of content.” It reads, “Due to the nature of our Services and artificial intelligence generally, output may not be unique and other users may receive similar output from our Services. Our assignment above does not extend to other users’ output….” That provision certainly supports another perspective on why you must be vigilant when incorporating AI-generated content into your company’s “hopefully” proprietary assets.

Assume a competitor can lawfully copy anything you generated purely with AI, or received the same or similar output from their AI tool. That should change what you build with AI and what you don’t. A logo, a mascot, a signature illustration style, anything whose value depends on nobody else being able to use it, needs real human authorship in it, and you need to be able to prove it. Keep the drafts, the prompt histories, the redlines, the version history. Reconstructing that record two years into a dispute is expensive and unconvincing.

Disclose AI material on registration applications, and do it accurately. A knowing misstatement of material fact can put the registration itself at risk, and the registration is the asset you need in order to sue. Candor costs almost nothing; claim the human contribution, disclaim the rest.

Fix your IP assignment language. This is the one that occurs most often in SaaS and professional services agreements, and it’s the easiest to miss, because the clause looks fine until you read it against this rule. Most assignment clauses transfer works of authorship the person creates. If your contractor hands you AI output with thin human involvement, there may be no work of authorship to assign, and you’ve paid for a deliverable nobody owns. Address AI-assisted deliverables expressly, add a disclosure obligation, and get a warranty about the human contribution.

Know whether you’re dealing with an employee or a contractor. Everything above assumes a contractor, because that’s where the assignment clause trap lives. A different rule applies to your own people.

If your employee creates the work within the scope of employment, and there’s enough human authorship to support a copyright, you own it automatically as a work made for hire under 17 U.S.C. § 201(b). No assignment needed, no signature required. But work made for hire only decides who owns a copyright that already exists. It doesn’t create one. An employee’s purely AI-generated output is exactly as unowned as a contractor’s, work made for hire or not. The question isn’t whose payroll the creator is on. It’s whether a human did enough for there to be a copyright to own.

One Question to Put to Your Team This Week

Pick the ten most commercially valuable pieces of content your company produced this year and ask two things about each: did AI make it, and can you prove what the human did? Where the answer runs yes and no, that asset isn’t protected, and any decision you’ve made assuming otherwise needs revisiting.

The law here is more settled than the headlines suggest. What isn’t settled is the middle, and a ruling out of Colorado could move it one direction or the other before the year is out.

This post is provided for general informational purposes only and does not constitute legal advice. Reading this post does not create an attorney-client relationship. Contact Ken McConkey to discuss your company’s specific circumstances.
September 19, 2026
NDA Essentials, Part 1: The Provisions That Actually Get Negotiated
The non-disclosure agreement (“NDA”) is the contract most companies sign fastest and read least. It shows up early, it is short, someone calls it standard, and it gets signed so the real negotiation can start. Then, unless you have overriding confidentiality provisions in a later definitive agreement, it governs your business’s confidential information for the next three to five years.

The takeaway: an NDA is a real contract with real teeth, and about nine provisions in it do all of the work. This discussion covers those nine common provisions at a high level, and each one gets its own post later in this series.

NDAs come in one of two formats, unidirectional or bidirectional. While it is not unusual to have a vendor or customer provide you with their unidirectional NDA template, I recommend against using such a one-direction NDA unless your business will be disclosing absolutely no confidential information. NDAs in technology and SaaS deals tend to be mutual (bidirectional), as both sides disclose and both sides receive. Every position you take against the other side’s confidential information gets taken against yours, which is why you must stay aware of what restrictions and obligations you are placing on the other party as they are also being placed upon you.

1. What Counts as Confidential Information

Two drafting approaches, failing in opposite directions. A marking requirement protects only what is marked as confidential, which is clean on paper and problematic in practice, because people forget to mark a Slack message, a screen share, or a whiteboard photo as confidential. Conversely, a catch-all definition covers anything a reasonable person would understand to be confidential from its nature and the circumstances of disclosure, which protects the discloser and leaves the recipient with no reliable way to know what is restricted.

2. The Exclusions

Four carve-outs are standard: information already publicly available through no fault of the recipient, information the recipient already knew free of any duty, information from a third party free of any duty, and information independently developed without use of or reference to what was disclosed. The negotiation is rarely about whether these are present in the NDA. It is about which party carries the burden of proving one of the exclusions, and whether the words “or reference to” survive in the independent-development carve-out.

Compelled disclosure is where I part company with a lot of forms. A subpoena or regulatory demand often gets drafted as a fifth exclusion, which strips the information of protection the moment a court asks for it. This topic belongs in its own provision as a permitted disclosure: prompt notice where notice is lawful, cooperation in seeking protective treatment, and no more disclosed than the law requires.

3. The Permitted Purpose

“Solely to evaluate a potential business relationship between the parties” is one line, and the entire use restriction hangs on it. Draft it too narrowly and your ordinary operations breach the agreement. Draft it too broadly and it’s near unenforceable and useless.

This clause could matter more than the definition of confidential information and gets a fraction of the attention. The part that is missed by many people is that if the evaluation succeeds and the parties sign an MSA, an NDA limited to evaluating a potential relationship no longer authorizes use of that information to perform the contract. Either the MSA’s confidentiality provision takes over cleanly, or the NDA’s purpose has to cover performance under the later definitive agreement. You must understand the NDA does not exist in a vacuum. It must work with your other agreements. You don’t want conflicting provisions or gaps in coverage.

4. Who Is Allowed to See Confidential Information

A need-to-know standard applied to a defined group: employees, affiliates, officers, directors, advisors, contractors, sometimes financing sources. There are two common points of contention; whether affiliates are included and whether those recipients must be bound by written obligations at least as protective as the NDA.

The provision that makes the rest enforceable is the one making the receiving party responsible for any breach by any party it has communicated your confidential information to, as if it had breached itself. Without it, your remedy could run against an individual contractor instead of the company that handed them the file.

5. The Standard of Care

The common standard is reasonable care, and in no event less than the care the recipient uses for its own confidential information of like importance. Both halves matter, because a company with weak internal security has a very low bar for its own information.

There is a reason to care beyond the contract. State law tends to define trade secrets by the methods used to protect them from public disclosure. For example, information qualifies as a trade secret under the Oklahoma Uniform Trade Secrets Act only if it is “the subject of efforts that are reasonable under the circumstances to maintain its secrecy,” 78 Oklahoma Statutes § 86(4)(b). Your NDAs, and your actual practice under them, are much of what proves that element later. A confidentiality program that exists only in your contract file is not evidence of much.

6. Two Time Components: Term and Duration

These are different time components, and confusing them is one of the most common errors in short-form NDAs. The “term” dictates how long new disclosures are covered. The “duration” controls how long the recipient has to protect what was already disclosed. A two-year term with a three-to-five-year survival period is common.

What commonly gets left out is the trade secret carve-out: obligations as to trade secrets continue for as long as the information remains a trade secret under applicable law. Without a specific trade secret carve-out, a fixed expiration date in your NDA reads as your own agreement that trade secret protection ends on a date certain, an awkward position to hold while arguing you made reasonable efforts to maintain secrecy.

8. Remedies and Injunctive Relief

Nearly every NDA states that breach will cause irreparable harm for which money damages are inadequate, and that the disclosing party may obtain injunctive relief without posting a bond. Keep the clause. But do not rely on it as some courts have ruled that where parties have contractually agreed that any breach would constitute irreparable harm, that stipulation without more is insufficient to support an irreparable harm finding. See Dominion Video Satellite, Inc. v. EchoStar Satellite Corp., 356 F.3d 1256 (10th Cir. 2004).

The damages disclaimer is also worth your consideration. If your NDA waives indirect, incidental, and consequential damages, look hard at what is left, because loss from disclosure of confidential information is very often exactly the category just waived. Accept a broad waiver, lose your injunction, and you are holding an agreement with no effective remedy in it.

9. The Residual Clause

Most common in enterprise and SaaS forms, and the provision people are most likely to sign without reading. A residuals clause lets the receiving party use information retained in the unaided memory of individuals who had authorized access. In a technical evaluation, that covers a great deal.

It is not automatically unacceptable, and it is sometimes necessary, since you cannot ask an engineer to forget an architecture. If you accept one, narrow it: unaided memory only, no intentional memorization, no license under any patent or copyright, no use to develop a competing product, and customer data, pricing, and source code excluded outright.

Also Worth Thinking About
- No license, no warranty as to accuracy or completeness, and no obligation to proceed with any transaction. Three sentences that keep an evaluation from turning into an implied deal.
- The Defend Trade Secrets Act notice, 18 U.S.C. § 1833(b)(3), when the agreement is with an employee or an individual contractor. Omit it and you cannot recover exemplary damages or attorney fees under the DTSA against that person.
- Governing law and venue, which decide how much the nine provisions above are actually worth to you.
The Fastest Way to Get This Wrong

Sign the counterparty’s form because it is only four pages. Length has nothing to do with risk here. Four pages that give away your permitted purpose, your remedies, and your residuals will cost you more than forty pages of a well-built MSA. Read your own template against these nine provisions and find out which side of each one you are on.

Part 2 of this series will discuss the definition of confidential information: marking requirements, catch-all standards, the oral-disclosure follow-up nobody actually performs, and how to write a definition your own team can follow.

This post is provided for general informational purposes only and does not constitute legal advice. Reading this post does not create an attorney-client relationship. Contact Ken McConkey to discuss your company’s specific confidentiality agreements.
August 28, 2026
MSA, SOW, or Both? Structuring SaaS Commercial Contracts Correctly
Most SaaS companies eventually end up with some combination of a Master Services or Subscription Agreement (“MSA”) and a Statement of Work (“SOW”), often without ever deciding on purpose which document is supposed to do what. That usually happens by accident: an early customer needed a signed contract fast, so a single document covered everything, and each deal since has been a variation on that first one. It works until it doesn’t, usually right when a dispute or a new professional-services engagement exposes the gaps. Some companies call the SOW an Order Form or Commercial Agreement. Still others designate an SOW for professional services only and use a separate Order Form or Commercial Agreement for product purchases or subscriptions. For simplicity, this post uses “SOW” to refer to all of these documents, regardless of what your company calls them.

What an MSA Actually Does

The MSA is the overall governing document for the relationship. It sets the terms that should stay constant across every engagement with a given customer: limitation of liability, indemnification, intellectual property ownership and license grants, confidentiality, term and termination, and terms dictating how disputes get resolved. It also incorporates or references other supporting documents that carry the operational detail, typically a Data Processing Agreement (“DPA”) for personal data handling and a Service Level Agreement (“SLA”) for uptime and support commitments. Once an MSA is signed, it should not need to be renegotiated every time the relationship changes (i.e. additional services/products are added, or a subscription is renewed, etc.).

What an SOW Actually Does

The SOW carries the deal-specific detail: scope of work, deliverables, timeline, fees, and any engagement-specific assumptions or acceptance criteria. A well-drafted SOW does not restate liability caps, indemnification, or IP ownership; it incorporates the MSA by reference and leaves those terms where they belong. That separation is what lets a SaaS company add a new project, a new module, or a new phase of implementation without reopening the entire contract.

When You Need Both

If the product involves a recurring subscription plus periodic professional services, onboarding, custom integration work, implementation, or training, you need both documents. The MSA governs the relationship and the risk allocation; each SOW governs a discrete piece of work under that umbrella. This structure lets you sign a new SOW in days instead of weeks, because the terms that actually take time to negotiate are already settled.

When a Single Order Form Is Enough

Not every deal needs a freestanding SOW. A self-serve subscription with no custom implementation or professional services can often be handled with an MSA plus a short order form specifying the plan, term, and price. Reserve the full SOW structure for engagements that involve actual scoped work, deliverables, or a project timeline.

Where SaaS Companies Typically Get Tripped Up

Three recurring problems show up again and again:
1. An SOW that includes its own liability or indemnification language that conflicts with the MSA, creating ambiguity about which terms actually control.
2. An SOW signed for an early pilot or proof of concept with no MSA in place at all, so there is no governing framework once the relationship expands.
3. No order-of-precedence clause specifying which document controls if the MSA and an SOW conflict, which turns a drafting oversight into a battle of contracts with no clearly stated winner. Most well-drafted MSAs default to the MSA controlling unless the SOW expressly says otherwise, so state that default in your own template rather than leaving it for a judge to decide.
A Note on Execution

All 50 states are covered by the federal ESIGN Act, and each state also has its own laws recognizing electronic signatures and records as legally effective, so executing MSAs and SOWs through AdobeSign, DocuSign or a similar platform is enforceable. However, that is not a substitute for good contract structure. A clean order-of-precedence clause and clear incorporation-by-reference language matter regardless of how the documents get signed.

A Practical Starting Point

Review your current templates for three things: a clear order-of-precedence clause, proper incorporation of the DPA and SLA by reference rather than restating their terms, and a standard SOW template that pulls its liability and IP terms from the MSA rather than reinventing them each time. Getting this structure right once saves renegotiation on every deal after.

This post is provided for general informational purposes only and does not constitute legal advice. Reading this post does not create an attorney-client relationship. Contact ME to discuss your company’s specific contract structure.
August 18, 2026