City Hall seen from Söder Mälarstrand on Stockholm's south bank, as the tour boat MS Lux crosses Riddarfjärden (photographed August 12, 2019). Legora's press release for this round was datelined New York and Stockholm. This photo simply shows the city and has no direct connection to the funding. Photo: Manfred Werner (Tsui); Source: Wikimedia Commons; License: CC BY-SA 4.0.

On October 21, 2026, legal AI company Legora announced that it had closed a $550 million Series E round led by Atreides Management at a post-money valuation of $8.8 billion, up from $5.6 billion in its previous round. The company says its annual recurring revenue (ARR) has exceeded $200 million and that the United States is now its largest market by revenue. All of these operating figures come from the company itself and have not yet been independently verified by any third party.

Round, Valuation and Investors

According to a press release Legora issued simultaneously in New York and Stockholm on October 21, 2026, this is a Series E round of $550 million at a post-money valuation of $8.8 billion. The company's previous valuation was $5.6 billion. Same-day reports from Bloomberg, TechCrunch and Artificial Lawyer gave the same round, amount and valuation. TechCrunch added that the previous round was a Series D extension announced in April 2026, in which $50 million was added to a $550 million Series D at a valuation of $5.6 billion.

Atreides Management led the round. New investors include Baron Capital, Capital Group, Fidelity Management & Research Company, Glade Brook Capital Partners and J.P. Morgan. The company says all of its major existing investors also took part, including Accel, Benchmark, Bessemer Venture Partners, General Catalyst, ICONIQ, Insight Venture Partners, Menlo Ventures, Redpoint Ventures, Salesforce Ventures and Sands Capital. Artificial Lawyer's news brief left Menlo Ventures out of its list of existing investors. This article follows the company's press release.

According to the press release, the new money will go toward expansion in North America and toward the business in Europe and Asia-Pacific. In North America, Legora currently has offices in New York, Denver, Chicago, Houston, San Francisco, Toronto and Mexico City. The funds will also go into Legora aOS, its agentic platform for lawyers. Planned new products include agentic intake, horizon scanning and legal research. In the press release, Gavin Baker, managing partner and chief investment officer of lead investor Atreides, said that Legora has stayed operationally efficient while growing rapidly. This is the investor's own assessment.

Growth and Customer Figures Reported by the Company

All of the figures below come from Legora's press release. TechCrunch, Dealroom and other outlets repeated them, attributing them with "the company says." This article found no audited data or third-party statistics, so whether these figures can be independently verified still needs to be checked.

• ARR (annual recurring revenue): It took under 18 months to grow from $1 million to $100 million, then under 6 months to add another $100 million. It now exceeds $200 million. The company also claims this pace is faster than that of any enterprise software company that relies on a direct sales team, but did not explain what that comparison is based on.
• In-house legal customers: A year ago they were only a small part of the customer base. In the third quarter of 2026, they made up more than 40% of new customers.
• US market: The US is now the company's largest market by revenue. More than half of the AmLaw 50 (the top 50 US law firms by revenue, as ranked by The American Lawyer) are Legora customers. The company only opened its first US office in spring 2025.
• Company size: Founded in 2023, Legora launched its platform in October 2024. It has more than 1,000 employees across 18 offices and more than 140,000 legal professionals as users, working at more than 2,400 law firms and in-house legal teams in more than 80 markets.

In the press release, chief financial officer David Eckstein emphasized "healthy gross margins, high retention" and a cost structure that improves with scale. However, the company has not disclosed its gross margin, customer retention rate or profit and loss figures, so these metrics cannot currently be checked.

Comparison with Harvey's Funding

TechCrunch reported that Harvey, Legora's biggest competitor, announced a $550 million raise at a $15.5 billion valuation about a month earlier. Dealroom dates that round to September 2026. Harvey also said in March 2026 that its ARR exceeded $200 million. Based on these reports, the two companies' most recent rounds were the same size and their self-reported ARR figures are of the same order of magnitude, but Harvey's valuation is about $6.7 billion higher than Legora's. This article did not consult Harvey's official announcements, so the related figures rely on TechCrunch's reporting.

In a separate article the same day, Artificial Lawyer estimated that Legora has raised about $1.4 billion in total and Harvey about $1.8 billion. That article noted that its comparison table was compiled with the help of ChatGPT and that the earlier rounds might need correction, so it is only useful as a rough indication of scale. Dealroom also cited an August report by the Financial Times that Legora was then in talks with investors at a valuation above $10 billion. The final $8.8 billion falls below that level. This article has not checked the original Financial Times report.

The Midtown Manhattan skyline in New York, photographed looking north from around Wall Street (March 2009). New York is one of the datelines on Legora's press release for this round and one of the cities where it has a North American office. This photo simply shows the city and has no direct connection to the funding. Photo: David Shankbone; Source: Wikimedia Commons; License: CC BY 3.0.

References

1. Legora. Legora raises $550 million Series E at $8.8 billion valuation to accelerate growth. Press release, 2026-10-21.

2. Artificial Lawyer. Legora Raises $550m at $8.8Bn Valuation. 2026-10-21.

3. Dominic-Madori Davis. Legal AI startup Legora raises $550M Series E at $8.8B valuation. TechCrunch, 2026-10-21.

4. Yazhou Sun. Legal AI Startup Legora Hits $8.8 Billion Valuation With New Investment Round. Bloomberg, 2026-10-21 (paywalled; only the public summary was checked).

5. Artificial Lawyer. Legora vs Harvey – The Multi-Billion $$$ AI Battle. 2026-10-21.

6. Dealroom News. Legora raises $550M at $8.8B as legal AI becomes a two-horse race with Harvey. 2026-10-21.

7. Xishu Zhifa · Law, the art of the rules of the game

8. Compiled and published by Scholay, the all-in-one academic platform. If any content infringes your rights, please let us know and it will be taken down.

9. Also published on Ente Academic, a community for scholars in the age of intelligence

The Berlaymont building in Brussels is the headquarters of the European Commission. Implementing Decision (EU) 2026/2274 was signed in Brussels and dated 12 October 2026. This image shows the building itself. It is not a photograph taken when the decision was adopted, and the date it was taken has not been verified. Photo: Nuno Nogueira; source: Wikimedia Commons; licence: CC BY-SA 2.5.

On 14 October 2026, European Commission Implementing Decision (EU) 2026/2274 was published in the Official Journal of the European Union and entered into force the same day. It cites EN 18286:2026, developed by CEN and CENELEC, as the first harmonised standard supporting the Artificial Intelligence Act. Providers of high-risk AI systems may apply the standard on a voluntary basis and obtain a presumption of conformity with the Article 17 quality management system requirements it covers. The remaining harmonised standards have yet to be published.

Publication and entry into force of the implementing decision

Commission Implementing Decision (EU) 2026/2274 was adopted in Brussels on 12 October 2026 (document number C/2026/7073) and published in the L series of the Official Journal on 14 October 2026. Article 2 of the decision provides that it enters into force on the day of its publication in the Official Journal. Recital 6 explains that the presumption of conformity arising from compliance with a harmonised standard applies from the date on which the reference to that standard is published in the Official Journal. The annex to the decision lists only one standard: EN 18286:2026 Artificial intelligence – Quality management system for EU AI Act regulatory purposes.

According to the recitals of the decision, the Commission had previously used Implementing Decision C(2025) 3871 to request that the European Committee for Standardization (CEN) and the European Committee for Electrotechnical Standardization (CENELEC) draft harmonised standards in support of the AI Act. EN 18286:2026 corresponds to point 9 of Annex I of that request, namely the quality management system for providers of AI systems, including the post-market monitoring process. After an assessment carried out with the two bodies, the Commission concluded that the standard meets the requirements of the Act that it is intended to cover, and therefore cited it in the Official Journal. According to the Commission's standardisation page, the work was carried out by the two bodies' Joint Technical Committee JTC 21, and the draft standard prEN 18286 entered public enquiry on 30 October 2025. In its news release of 15 October, CEN-CENELEC noted that the day of publication in the Official Journal coincided with World Standards Day.

Timeline of EN 18286:2026 from public enquiry to citation in the Official Journal. Sources for the nodes: the public enquiry on 2025-10-30 is documented on the European Commission's standardisation page. Adoption on 2026-10-12, publication and entry into force on 2026-10-14, and the start of the presumption of conformity are documented in Implementing Decision (EU) 2026/2274. 2026-10-15 and 2026-10-19 are the publication dates of the CEN-CENELEC page and the European Commission explanatory page, respectively. This is an AI-generated illustrative chart. Its dates and labels have been checked one by one, and the spacing between nodes does not represent the actual length of time between them.

The Article 17 requirements covered by the standard

Article 17 of the AI Act requires providers of high-risk AI systems to put a quality management system in place. The system must be documented in a systematic manner in the form of written policies, procedures and instructions, and must cover at least 13 aspects: a strategy for regulatory compliance and the management of modifications; procedures for design, development, quality control, and testing and validation; the technical specifications and standards to be applied; data management; the risk management system referred to in Article 9; post-market monitoring under Article 72; the reporting of serious incidents under Article 73; communication with competent authorities, notified bodies and other relevant parties; record-keeping; resource management; and an accountability framework for management and staff. Paragraph 2 requires the implementation to be proportionate to the size of the provider. Paragraph 3 allows providers that are already subject to quality management obligations under sectoral legislation to incorporate these aspects into their existing systems. Paragraph 4 sets out special arrangements for financial institutions subject to EU financial services law.

According to the Commission's explanation, EN 18286 turns these requirements into an operational quality management system. Its clauses correspond to Article 17, and it is structured around the lifecycle of the AI system rather than around the organisation itself. CEN-CENELEC, for its part, says the standard turns the Article 17 requirements into concrete, auditable requirements that providers can apply directly. The text of the standard was not consulted for this article (it must be purchased from the standardisation bodies). For the specific clause structure, the official text prevails.

Article 113 of the Act determines when the Article 17 obligations begin to apply. According to the amended text compiled by artificialintelligenceact.eu (an unofficial compilation), they apply from 2 December 2027 to the high-risk systems listed in Annex III and from 2 August 2028 to the high-risk systems listed in Annex I. The Commission's explanation of 19 October says only that the standard was published before the high-risk requirements begin to apply. The specific dates should be confirmed against the original text of the amending regulation published in the Official Journal.

Scope and limits of the presumption of conformity

Article 40(1) of the Act provides that high-risk AI systems that conform to harmonised standards, or parts of them, whose references have been published in the Official Journal are presumed to conform to the requirements of Section 2 of Chapter Three of the Act, to the extent that those standards cover those requirements. For general-purpose AI models, they are presumed to comply with the corresponding obligations in Chapter Five. For EN 18286:2026 specifically, the Commission states that providers that implement the standard benefit from a presumption of conformity with the Article 17 requirements covered by the standard. This presumption has the following limits:

• Voluntary application: The Commission's standardisation page states that applying the standard remains voluntary and that providers may choose other frameworks to demonstrate compliance. The role of harmonised standards is to provide legal certainty.
• Limited to the requirements the standard covers: The presumption applies to the Article 17 quality management system requirements covered by EN 18286. It does not extend to other requirements such as risk management, data governance, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity. Of the ten areas in which the Commission requested standards, this decision cites only one: quality management.
• Partial application requires a separate explanation: Article 17(1), point (e), requires that, where the relevant harmonised standards are not applied in full or do not cover all the relevant requirements, providers set out in their quality management system the means they use to ensure compliance.
• Starting date: Under recital 6 of the decision, the presumption applies from the date on which the reference was published, namely 14 October 2026. The decision itself does not address the dates of application of the obligations laid down in Article 113.

One distinction matters here: EN 18286:2026 is currently the only standard for which a presumption of conformity has been published. In its explanation of 19 October, the Commission said more harmonised standards will follow, but it gave no timetable. Until harmonised standards in other areas are cited in the Official Journal, providers cannot invoke the Article 40 presumption for the corresponding requirements. Instead, they must show by other means how they meet the provisions of the Act.

Relationship with ISO/IEC 42001 and other systems

The Commission says EN 18286 is designed to build on existing international standards rather than replace them. Examples include ISO/IEC 42001 (AI management systems), ISO 9001 (quality management systems), and sectoral quality management systems such as ISO 13485 for medical devices. The standard explicitly allows providers in regulated sectors to integrate their management systems rather than run a separate one. Organisations that have not adopted ISO/IEC 42001 but plan to place high-risk AI systems on the EU market or put them into service can also use EN 18286 either to extend an existing quality management system or to build a new one that meets Article 17.

The two types of standard have different legal effects. The Commission describes EN 18286 as the only AI quality management system standard that confers a presumption of conformity. International standards such as ISO/IEC 42001 are not listed in the annex to this decision, and relying on them alone does not provide the presumption referred to in Article 40. However, existing systems can serve as a basis for implementing EN 18286. Based on the original texts cited above, the following checkpoints can be drawn up (they are not compliance advice and have not been verified through an actual audit):

• Applicable version: The version cited in the Official Journal is EN 18286:2026. The number and title listed in the annex to the decision prevail.
• Precondition: The presumption is relevant only to the Article 17 obligations of providers of high-risk AI systems. Whether a system is high-risk must first be determined under Article 6 of the Act and Annexes I and III.
• Record the scope of application: State in the quality management system documentation whether the standard is applied in full. Where it is applied only in part, explain how the remaining requirements are met, as required by Article 17(1), point (e).
• Track subsequent citations: Whether harmonised standards in other areas have taken effect should be determined from implementing decisions published later in the Official Journal.

References

1. European Commission. Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 on the harmonised standards for high-risk AI systems drafted in support of Regulation (EU) 2024/1689. OJ L, 2026/2274, 14.10.2026. ELI: http://data.europa.eu/eli/dec_impl/2026/2274/oj

2. European Commission. First harmonised standard supporting the AI Act published in the Official Journal. 2026-10-19.

3. CEN-CENELEC. First ever European standard on AI published in the OJEU. 2026-10-15.

4. European Commission. Standardisation of the AI Act. The page is undated.

5. Regulation (EU) 2024/1689: Article 17: Quality Management System; Article 40: Harmonised Standards and Standardisation Deliverables. Unofficial compiled text from artificialintelligenceact.eu.

6. Xishu Zhifa · Law is the art of the rules of the game

7. This information was compiled and published by the Scholay One-Stop Academic Platform. If it infringes your rights, please let us know and it will be taken down.

8. This information is also published on Ente Academic, a community for scholars in the age of intelligence.

On October 21, 2026, Judge Eumi K. Lee of the U.S. District Court for the Northern District of California, San Jose Division, heard argument on the cross-motions for summary judgment in the case brought by eight music publishers, including Concord, against Anthropic (Case No. 5:24-cv-03811-EKL). The hearing lasted about 4 hours 43 minutes. The dispute centered on whether training Claude on lyrics, and outputs that reproduce lyrics, qualify as fair use, and on the claim that copyright management information (CMI) was removed. The judge did not indicate a leaning from the bench. As of a search on October 24, no written ruling appeared on the docket.

Background of the Suit and Prior Rulings

On October 18, 2023, eight publishers sued Anthropic in the U.S. District Court for the Middle District of Tennessee: Concord Music Group, Capitol CMG, Universal Music Corp., Songs of Universal, Universal Music – MGB NA, Polygram Publishing, Universal Music – Z Tunes and ABKCO Music. They asserted four claims: direct infringement, contributory infringement, vicarious infringement, and removal or alteration of CMI (17 U.S.C. § 1202). An exhibit to the complaint listed about 500 musical works, and the amended complaint lists 499. On June 24, 2024, the Tennessee court found that it lacked personal jurisdiction over Anthropic and transferred the case to the Northern District of California. The Northern District's case page records a filing date of June 26, 2024, and on August 21 of that year the case was reassigned to Judge Lee. The above consists of the plaintiffs' allegations and procedural facts and does not represent any finding by the court on whether infringement occurred.

Three earlier rulings bear on the issues at this hearing. First, on January 2, 2025, the court entered a stipulation between the parties (ECF No. 291). Under it, Anthropic would maintain the copyright “guardrails” already in place in its existing models and apply consistent guardrails to the inputs and outputs of new models and products, and the publishers may give written notice if they find the guardrails failing. This was the result of negotiation between the parties; the court did not bar Anthropic from training on lyrics. Second, on March 25, 2025, the court denied the motion for a preliminary injunction because the publishers had not shown irreparable harm (ECF No. 321, without prejudice), and it stated that it was not addressing whether the infringement claims could succeed. Third, in March 2025 the court dismissed the secondary infringement and CMI claims with leave to amend (ECF No. 322). After the publishers amended their complaint, the court denied Anthropic's motion to dismiss on October 6, 2025 (ECF No. 461). It found that the guardrail-related allegations were enough to plausibly infer “knowledge” and that Anthropic may profit from the outputs. It also found that the allegations about the use of a scraping tool called “Newspaper” were enough to support the mental-state element of the CMI claim. The court further explained that at the motion-to-dismiss stage it must provisionally accept the plaintiffs' non-conclusory allegations as true, and that Anthropic's factual defenses could be re-examined at later stages.

A separate case should be distinguished. On January 28, 2026, Concord, Universal Music Publishing Group, ABKCO and others filed a new suit against Anthropic in the same court (Case No. 5:26-cv-00880). That suit alleges that Anthropic downloaded pirated songbooks via BitTorrent and used them for training, and it involves more than twenty thousand works. It is a lawsuit independent of the 2024-numbered case discussed in this article, and the description above likewise consists of the plaintiffs' allegations.

Issues in the Parties' Summary Judgment Motions

The publishers filed a motion for partial summary judgment on March 23, 2026 (ECF No. 594), asking the court to find two things. First, Anthropic copied the 499 works in training and in outputs, establishing the prima facie elements of direct infringement. Second, this copying is not fair use. The motion states that, according to the publishers' own investigation, Claude generated verbatim or near-verbatim lyrics for all 499 works when asked for them directly. It argues that the output lyrics substitute for licensed channels such as LyricFind, Musixmatch and Genius, eroding the markets for lyric licensing and derivative-work licensing. It also argues that “new” lyrics generated by Claude dilute the market, citing the reasoning in Kadrey v. Meta and a U.S. Copyright Office report on this point. In addition, the motion says the publishers have already licensed AI companies such as Udio and Klay Vision for training use, so a market for AI training licenses already exists. All of the above are the plaintiffs' contentions.

Anthropic filed its motion for summary judgment and opposition to the plaintiffs' motion on April 20, 2026 (ECF No. 686), and its reply on September 8 (ECF No. 801). Its argument has four parts. First, training Claude on lyrics is a transformative use that is fair use as a matter of law, as shown by two cases from the same court, Bartz v. Anthropic and Kadrey v. Meta. Anthropic concedes, however, that there is a genuine factual dispute over whether non-verbatim outputs that quote lyrics are fair use. Second, outputs are triggered by user prompts, so Anthropic should not bear direct infringement liability. The motion states that a sample of about five million (500 ten-thousand) prompts and outputs was drawn from the six months before and after the suit was filed. In that sample, more than 83% of the prompts that led to reproduction of the lyrics at issue came from the publishers themselves or their agents. Third, the DMCA claim fails. The works at issue are musical works as a whole, Anthropic scraped only the lyrics, and the publishers have not shown that the “Newspaper” tool actually removed CMI from the works at issue. Fourth, the publishers submitted registration deposit copies for only 13 works and lack a baseline for comparison for the remaining 486, so they should not obtain summary judgment on the “copying” element.

The secondary infringement claims have changed. According to Anthropic's motion, the publishers gave notice on the evening of April 19, 2026 that they would no longer pursue the contributory and vicarious infringement claims. They filed a notice of voluntary dismissal the next day (Dkt. 685). The parties disagree on how those claims should end: Anthropic asks that they be resolved by “entry of judgment,” so that the same issues cannot be raised again in the second case. This article could not verify from the public filings it reviewed how the court subsequently handled the dismissal. The motions were originally set for hearing on July 15, 2026, and were actually heard on October 21.

Highlights of Reporting on the October 21 Hearing

In an on-the-scene report on October 21, Courthouse News reporter Carly Nairn wrote that publishers' counsel Matthew Oppenheim said Claude reproduces protected lyrics, sometimes verbatim. He focused on two kinds of output. The first is “derivative” or mash-up content that quotes or splices together fragments of the original lyrics. The second is “synthetic” songs written to imitate a particular singer's style. He argued that the synthetic songs compete with human works and dilute the music market, saying “it couldn't do that if those lyrics weren't in the database.” Judge Lee pressed him on this logic: would the publishers then have a monopoly over lyrical style, so that no one, including AI, could create new works in the style of older ones without paying a license fee? Oppenheim responded that “copyright is essentially a monopoly.”

The same report states that Anthropic's counsel Sonal Mehta argued that it is users who ask for lyrics or request “a song like Taylor Swift,” so Anthropic is implicated at most in secondary liability. She argued that the model learns from vast amounts of text rather than specifically extracting lyrics, and that the “synthetic” songs Claude generates are new content that will not displace human works. She said “there is no evidence in the record that the music industry is facing devastation.” She also cited expert opinion that Claude has not negatively affected lyric licensing or licensed lyrics platforms such as Genius and LyricFind. All of the above are statements made in court by counsel for the parties, not findings of the court.

The website Chat GPT Is Eating the World quoted the docket's hearing minutes on October 23. According to those minutes, the court heard argument from both sides that day, and the hearing lasted a total of 4 hours 43 minutes. Because time ran out, the remaining Daubert motions concerning both sides' expert witnesses were continued to October 30 at 1 p.m., to be heard by Zoom video. The parties were also ordered to submit two sets of paper copies in the specified manner by October 26. The court's case page further shows that a clerk's notice regarding hearing matters (ECF No. 918) was entered on October 23, along with the parties' filings requesting hearing transcripts (ECF No. 914–916). This article did not review the specific contents of ECF No. 918.

Case Status as of the Search Date

Courthouse News reported that after several hours of argument, Judge Lee took the motions under submission without indicating her view on summary judgment. As of a search on October 24, 2026, the latest filings listed on the court's case page end on October 23, and none of them is a written ruling on the parties' summary judgment motions. The questions at the hearing and counsel's statements reflect only the parties' positions and the issues the judge is focused on, and no outcome can be inferred from them. Likewise, the analysis in the 2025 denial of the motion to dismiss was only a pleading-stage determination and is not a finding of fact. Under Rule 56 of the Federal Rules of Civil Procedure, the court may grant summary judgment only on issues where there is no genuine dispute of material fact; any unresolved issues are left for later proceedings. The next scheduled event is the continued Daubert hearing on October 30.

References

1. U.S. District Court, Northern District of California. Concord Music Group, Inc. et al v. Anthropic PBC, Case No. 5:24-cv-03811-EKL, case page (accessed 2026-10-24). cand.uscourts.gov

2. N.D. Cal., 5:24-cv-03811-EKL, Stipulation and Order re Preliminary Injunction, ECF No. 291 (entered 2025-01-02). CourtListener RECAP

3. N.D. Cal., 5:24-cv-03811-EKL, Order Denying Motion for Preliminary Injunction, ECF No. 321 (2025-03-25). CourtListener RECAP

4. N.D. Cal., 5:24-cv-03811-EKL, Order Denying Motion to Dismiss First Amended Complaint, ECF No. 461 (2025-10-06). CourtListener RECAP

5. N.D. Cal., 5:24-cv-03811-EKL, Plaintiffs' Motion for Partial Summary Judgment, ECF No. 594 (filed 2026-03-23, redacted version). Text hosted by Music Ally

6. N.D. Cal., 5:24-cv-03811-EKL, Anthropic PBC's Motion for Summary Judgment and Opposition to Publishers' Motion for Partial Summary Judgment, ECF No. 686 (filed 2026-04-20). CourtListener RECAP

7. N.D. Cal., 5:24-cv-03811-EKL, Anthropic's Reply in Support of Motion for Summary Judgment, ECF No. 801 (filed 2026-09-08). CourtListener RECAP

8. Carly Nairn. Music labels clash with Claude over copyrighted lyrics. Courthouse News Service, 2026-10-21. courthousenews.com

9. Judge Lee concludes marathon hearing on summary judgment in Concord Music v. Anthropic I; sets 2d hearing to continue Daubert hearing on Oct. 30, 1 PM. Chat GPT Is Eating the World, 2026-10-23. chatgptiseatingtheworld.com

10. Murray Stassen. UMG sues Anthropic for $3bn over ‘brazen’ copyright infringement of 20,000+ songs. Music Business Worldwide, 2026-01-28. musicbusinessworldwide.com

11. Xishu Zhifa · Law is the art of the rules of the game

12. Compiled and published by Scholay, the one-stop academic platform. If this content infringes your rights, please let us know and it will be taken down.

13. Also published on Ente Academic, a community for scholars in the age of intelligence

The front façade and dome of the Munich Palace of Justice (Justizpalast), near Karlsplatz in Munich (photographed on 26 August 2010). The building is the seat of the Bavarian Ministry of Justice, whose website published the press release on the judgment in this case. The image shows the building itself, not the courtroom where the case was heard. Photo: Pixelteufel; source: Wikimedia Commons; license: CC BY 2.0.

On 31 July 2026, the Munich I Regional Court in Germany delivered its first-instance judgment in GEMA v. Suno (Case No. 42 O 763/25), largely granting the claims brought by GEMA, the music copyright collective management organization, against the AI music generation service Suno. The court held that the “memorization” of songs in model parameters constitutes reproduction, that the text and data mining exception does not cover storage within the model, and that Suno’s US fair use defense fails. The judgment is not yet final and may be appealed.

Facts of the Case and the Judgment

The plaintiff, GEMA, is Germany’s music copyright collective management organization. In this case it asserted rights in six works: “Atemlos durch die Nacht,” “Rasputin,” “Big in Japan,” “Forever Young,” “Daddy Cool,” and the chorus of “Mambo No. 5 (A little bit of).” Infringement of the lyrics themselves was outside the scope of this case. The defendant, Suno, is a US-domiciled provider of an AI music generation service, and users in Germany can access its US-hosted website. The models at issue are versions v3.5 and v4. The court found as fact that Suno’s training data included these works, and that Suno used “stream ripping” technology to extract and copy them from YouTube. In doing so, Suno circumvented the “rolling cipher,” a technical protection measure YouTube uses to prevent the downloading of audio and video.

GEMA argued that the works were reproduced during training and “memorized” by the model, that the generated outputs constituted further infringement, and that the infringing acts took place in both the United States and Germany. When gathering evidence, GEMA entered only the original lyrics, the music style and the song title in the input field, without specifying melody, harmony, rhythm or arrangement. To obtain the outputs at issue for each work, it entered the same prompt between 4 and 176 times; for “Atemlos durch die Nacht” it took 176 times. Suno raised several defenses. It argued that the works at issue are not protected and cannot be recognized in the outputs. It said the model’s weights and parameters are merely patterns learned from the training data and do not contain the training data, and that any similarity in the outputs resulted from prompts narrowing the scope of generation. It argued that training took place in the United States, so US law should apply and the training is protected by fair use, which German courts have no authority to review. It also argued that the outputs came from prompts the plaintiff repeatedly adjusted, so the users’ conduct broke the chain of attribution. Finally, it argued that even if German law applied, the text and data mining exception would protect it.

The court largely granted GEMA’s claims and ordered Suno to stop three types of conduct. The first is reproducing the works in the United States to train AI music models. The second is storing the works in the models in Germany in the form of parameters or other data structures. The third is communicating the works to the public in Germany by providing the models and the music generation application, together with reproducing and communicating to the public adaptations of the works in the outputs. For “Atemlos durch die Nacht,” “Rasputin,” “Daddy Cool” and the chorus of “Mambo No. 5,” Suno must disclose the extent of its use and its revenue (for acts in Germany, from 1 July 2023 onward), and the court declared that Suno is liable for damages. The court also authorized GEMA to publish the operative part of the judgment in the Süddeutsche Zeitung within six weeks after the judgment becomes final, at Suno’s expense. Suno must also pay pre-litigation attorney’s fees of EUR 5,049.70. The remaining claims were dismissed. The court denied Suno’s requests to stay the proceedings and to refer questions to the Court of Justice of the European Union for a preliminary ruling. The court’s press release states that the judgment is not yet final (nicht rechtskräftig). According to commentary published by Legal500, Suno has announced an appeal.

Memorization in Model Parameters and the Reproduction Right

The court followed the three-stage analysis it had used in an earlier case involving a language model (as described in the WIPO informal summary). The first stage is collecting data and building the training corpus. The second stage is analyzing the data, annotating it with metadata and training the model. The third stage is the user prompting the trained model and receiving outputs. For the claim concerning “reproduction within the model,” the court held that the second stage is the relevant one.

Citing information technology research, the court noted that training data may be retained in a model and can be extracted in the form of outputs, a phenomenon known as “memorization.” During training, the model does not merely extract information from the data; the trained parameters also take on the content of the training data. The court compared the songs in the training data with their reproductions in the outputs and found the songs complex enough and long enough to rule out coincidence. It therefore held that the works at issue are contained in reproducible form in the v3.5 and v4 models stored on servers in Germany. As the WIPO summary puts it, the model parameters encode the content of the works, not merely extracted information or patterns. Accordingly, this memorization constitutes reproduction within the meaning of Section 16 of the German Copyright Act.

The editorial headnotes to the full judgment (margin nos. 262–279) summarize this standard as follows. If a work can be recognizably reproduced through simple, open-ended prompts, it has already been fixed in tangible form, which constitutes reproduction; indirect perceptibility is enough. The fact that a work cannot be seen directly in the model does not affect the reproduction right, though it may bear on whether “making available” is established. Suno’s argument that the parameters represent only statistical patterns and do not store training data was therefore rejected. Legal500’s commentary likewise treats this point as the case’s main interpretation of the concept of “reproduction” in generative AI.

Scope of the Text and Data Mining Exception

Section 44b of the German Copyright Act corresponds to Article 4 of the EU Directive on Copyright in the Digital Single Market. It defines text and data mining as the automated analysis of works to obtain information such as patterns, trends and correlations. The court acknowledged that this exception applies to AI training in principle and can cover the reproductions needed in the first stage to build the training corpus. However, those reproductions were not at issue in this case. What was at issue were the reproductions retained within the model in the second stage, and the court held that these fall outside the exception.

The court reasoned that text and data mining concerns “mere information,” and the statistical correlations a model learns from data are information of this kind. Memorization, by contrast, goes beyond analysis, because the work itself is absorbed into the model parameters. Reproduction within the model does not serve further data analysis, so it is not a “reproduction for the purposes of text and data mining.” It also affects authors’ interest in being paid. The court further noted that applying the exception by analogy would place all the risks of memorization on rightholders. That would be inconsistent with the premise in Recital 17 of the Directive that “the harm to rightholders would be only minimal.” Article 53(1)(c) and (d) of the EU Artificial Intelligence Act, which has applied since 2 August 2025, does not change this conclusion.

Section 44b(2) also requires the user to have lawful access to the works. The editorial headnotes to the full judgment (margin nos. 308–310) state that there is no lawful access where a work is obtained by circumventing an effective technical protection measure. Whether a protection measure is “effective” does not depend on whether it can actually prevent circumvention. In this case Suno circumvented YouTube’s rolling cipher, so this fact is also relevant to whether the exception can apply.

The three-stage analysis used by the Munich I Regional Court in GEMA v. Suno (Case No. 42 O 763/25) and the court’s findings at each stage, compiled from the full text of the judgment and the WIPO IP Judges Forum informal case summary. All provisions cited in the figure refer to the German Copyright Act. AI-generated diagram; the text in the figure has been checked item by item against the main text.

Communication to the Public, Liability for Outputs, and the Fair Use Defense

On “making available” (Section 19a, which requires that members of the public be able to access the work from a place and at a time of their own choosing), the court dismissed GEMA’s claim. GEMA could not show that every prompt would call up the works at issue: it took up to 176 identical prompts to obtain a single output, which does not amount to access at a time chosen by the user. Instead, the court granted the injunction under the general right of communication to the public in Section 15(2) (an innominate right not listed in the statute). As the editorial headnotes (margin nos. 372–379) summarize, providing the model and the music generation application in itself gives the public a way to access the memorized works. As long as simple, open-ended prompts can reach the works, this is a direct act of communication, regardless of whether the works are actually retrieved.

As for the outputs, the court held that, despite differences from the originals, at least one protected original element of each work could be recognized in the outputs. This constitutes reproduction and communication to the public of adaptations (Sections 16 and 23), and the two do not need to be distinguished. Liability lies with Suno, not with users. The prompts were simple and open-ended, giving only lyrics and style, while Suno selected the training data, trained and operated the model, and is responsible for the model architecture and its memorization; it was therefore the model that determined the content of the outputs. The court also held that the liability exemption in Article 6 of the EU Digital Services Act does not apply, because these outputs are the model operator’s own information, not third-party information provided by users.

For the reproductions made during training in the United States, the court found that it had jurisdiction under Section 131 of the German Collective Management Organizations Act. It applied US law under the lex loci protectionis principle in Article 8(1) of the Rome II Regulation, and ascertained US law of its own motion under Section 293 of the German Code of Civil Procedure. Drawing on US Supreme Court precedents including Warhol, Campbell and Sony, the court examined each of the four fair use factors and found that all of them weighed against Suno. The outputs are substantially similar to the originals, with no transformation of content; the use has a commercial purpose; and circumventing technical protection measures shows a lack of good faith. The court distinguished this case from Bartz v. Anthropic and Kadrey v. Meta. In those cases, the training data was not made available to users through outputs, or not to a substantial extent. Here, by contrast, simple prompts alone produced recordings substantially similar to the originals. On this basis, the court issued an injunction under 17 U.S.C. § 502(a) and declared liability for damages under § 504(a). In this part of the judgment, the outputs served only as evidence that the training reproductions took place; they were not themselves the subject of the claims under US law.

As for commentary, an article by Luca Guidobaldi published by Legal500 (20 October 2026) argues that the judgment’s understanding of “reproduction” differs from the approach taken by the High Court of England and Wales in November 2025 in Getty Images v. Stability AI ([2025] EWHC 2863 (Ch)). The article also describes this as the first time such principles have been applied to music. Readers should keep the limits of this judgment in mind. It is a first-instance judgment that can be appealed. Its conclusions rest on six works, two model versions (v3.5 and v4), and the output evidence submitted by the plaintiff. Its assessment of US fair use reflects how a German court ascertained and applied foreign law in this particular case.

References

1. Munich I Regional Court (Landgericht München I), 42nd Civil Chamber: Judgment (Endurteil) in GEMA v. Suno, Case No. 42 O 763/25, 31 July 2026. Full text on the Bavarian legal information platform: https://www.gesetze-bayern.de/Content/Document/Y-300-Z-BECKRS-B-2026-N-17961?hl=true

2. Bavarian Ministry of Justice / Munich I Regional Court: Pressemitteilung 16 vom 31.07.2026 – Urteil GEMA gegen SUNO (Case No. 42 O 763/25), 31 July 2026. https://www.justiz.bayern.de/gerichte-und-behoerden/landgericht/muenchen-1/presse/2026/16.php

3. WIPO Lex: Munich I Regional Court (Landgericht München I), Germany [2026]: GEMA v Suno, Case No. 42 O 763/25 (judgment information page; page date not given). https://www.wipo.int/wipolex/en/judgments/details/3890

4. WIPO: 2026 WIPO IP Judges Forum Informal Case Summary – Munich I Regional Court (Landgericht München I), Germany [2026]: GEMA v Suno, Case No. 42 O 763/25 (informal case summary; publication date not given). https://www.wipo.int/wipolex/en/text/600716

5. Luca Guidobaldi: GEMA v. Suno: A New European Precedent On The Relationship Between Generative AI And Copyright, Legal 500, 20 October 2026. https://www.legal500.com/intelligence/germany/intellectual-property/gema-v-suno-a-new-european-precedent-on-the-relationship-between-generative-ai-and-copyright

6. Xishu Zhifa · Law is the art of the rules of the game

7. Compiled and published by Scholay, the all-in-one academic platform. If you believe this content infringes your rights, please let us know and it will be taken down.

8. Also published on Ente Academic, a community for scholars in the age of intelligence

In March 2025, the Cyberspace Administration of China (CAC), the Ministry of Industry and Information Technology, the Ministry of Public Security, and the National Radio and Television Administration jointly issued the Measures for Labeling Artificial Intelligence-Generated and Synthesized Content (Guoxinbantongzi 〔2025〕 No. 2). The Measures took effect on September 1, 2025, and the supporting mandatory national standard GB 45438-2025 took effect on the same day. The Measures consist of fourteen articles. They set out rules for explicit and implicit labels on generated and synthesized content. They also extend verification, notification, and declaration obligations to content dissemination platforms, app distribution platforms, and users who publish content.

Scope of Application and Nature of the Document

Article Two of the Measures limits their application to “network information service providers falling under the circumstances specified in the Provisions on the Administration of Algorithmic Recommendations for Internet Information Services, the Provisions on the Administration of Deep Synthesis of Internet Information Services, and the Interim Measures for the Administration of Generative Artificial Intelligence Services.” The Measures do not create a separate definition of covered entities. Instead, they adopt the service types already defined by these three departmental rules. Article Three defines “AI-generated and synthesized content” as text, images, audio, video, virtual scenes, and other information generated or synthesized using artificial intelligence technology.

The Measures were issued as a notice dated March 7, 2025, and were published on China Cyberspace, the CAC website, on March 14. In a Q&A with reporters, a CAC official described them as a “normative document” that refines the labeling requirements already contained in the three rules above. The Q&A also states that where other provisions govern news publishing, film and television production, literary and artistic creation, or similar activities, “those provisions shall apply.” The Measures work together with the mandatory national standard Cybersecurity Technology — Labeling Method for Artificial Intelligence-Generated and Synthesized Content (GB 45438-2025, released February 28, 2025). The Measures set out the responsibilities and obligations of each party. The standard specifies concrete labeling methods, such as text, corner marks, voice, rhythm, and metadata. According to the Q&A, the two documents provide a transition period of about 6 months and both took effect on September 1, 2025.

Explicit and Implicit Labels

Article Three distinguishes two types of labels. Explicit labels are presented in the content or in the interface of an interactive setting through text, sound, graphics, or other means, and users can clearly perceive them. Implicit labels are added to file data through technical measures, and users cannot easily perceive them.

Explicit labeling (Article Four) applies to the services covered by the first paragraph of Article Seventeen of the Deep Synthesis Provisions. These are services that may cause public confusion or misidentification, such as intelligent dialogue and intelligent writing, synthetic human voices and voice imitation, face generation and swapping, and immersive realistic scenes. The Measures set placement requirements for each medium:

• Text: a text prompt or a general symbol prompt at the beginning, at the end, or at an appropriate position in the middle.
• Audio: a voice prompt or an audio rhythm prompt.
• Images: a prominent prompt at an appropriate position.
• Video: prompts on the opening frame and around the playback area.
• Virtual scenes: a prompt on the opening frame.

Where a service offers download, copy, or export functions, the exported files must also contain explicit labels that meet these requirements.

Implicit labeling (Article Five) applies to all service providers covered by the Measures, not only to the services in the first paragraph of Article Seventeen. Under Article Sixteen of the Deep Synthesis Provisions, providers must add “production element information” to file metadata. This includes attribute information identifying the content as generated or synthesized, the service provider's name or code, and a content number. Digital watermarks are “encouraged” rather than mandatory. The Q&A explains why: adding implicit labels to text and adding digital watermarks to multimedia files still pose technical difficulties or may increase costs for companies, so neither is made mandatory.

Obligations of Platforms, Providers, and Users

Article Six sets out most of the obligations at the dissemination stage. Platforms that provide network information content dissemination services must first check file metadata for implicit labels. They must then add a prompt around the published content based on which of three situations applies:

• Metadata identifies the content: if the metadata clearly identifies the content as generated or synthesized, the platform tells the public that the content “is” generated or synthesized.
• The user declares the content: if the platform finds no implicit label but the user declares the content as generated or synthesized, the platform tells the public that the content “may be” generated or synthesized.
• The platform detects traces: if there is neither an implicit label nor a user declaration, but the platform detects explicit labels or other traces of generation or synthesis, the platform identifies the content as “suspected” generated or synthesized content.

In all three situations, the platform must also write “dissemination element information” into the metadata, such as the dissemination platform's name or code and a content number. In addition, platforms must provide labeling functions and remind users to declare on their own initiative whether the content they publish contains generated or synthesized content.

The obligations of other parties appear in later articles. When reviewing an app for listing or launch, an app distribution platform must require the app to state whether it provides generation or synthesis services. If it does, the platform must verify its labeling-related materials (Article Seven). Service providers must explain their labeling methods and styles in their user service agreements (Article Eight). They must also submit labeling-related materials when completing procedures such as algorithm filing and security assessments (Article Twelve). If a user asks for content without explicit labels, the provider may supply it after setting out the user's labeling obligations and usage responsibilities in the user agreement. In that case, the provider must retain logs, including information on the recipient, for no less than six months as required by law (Article Nine).

On the user side, Article Ten requires users who publish generated or synthesized content through network information content dissemination services to declare it on their own initiative and to use the labeling functions provided by the platform. The second paragraph of the same article sets out prohibitions that apply to “any organization or individual.” No one may maliciously delete, tamper with, forge, or conceal labels. No one may provide tools or services that help others do so. No one may use improper labeling methods to harm the lawful rights and interests of others. Based on these provisions, the Q&A explains that if a user obtains content without explicit labels from a provider, the user must still declare the content and add explicit labels before publishing it to the public.

On liability, Article Thirteen provides that violations of the Measures are handled by the competent cyberspace, telecommunications, public security, and radio and television authorities, each within its own remit, under the relevant laws, administrative regulations, and departmental rules. The Measures themselves do not set out any separate penalties.

Linkages with Two Departmental Rules

The Measures cite the Provisions on the Administration of Deep Synthesis of Internet Information Services more directly than any other higher-level rule. These Provisions are Order No. 12 of the CAC, the Ministry of Industry and Information Technology, and the Ministry of Public Security, and took effect on January 10, 2023. Their Article Sixteen requires providers to “take technical measures to add labels that do not affect users' use” to content they generate or edit. Article Five of the Measures turns this into a specific requirement for implicit labels in metadata and lists the information those labels must contain. Article Seventeen of the Provisions requires services that may cause public confusion or misidentification to be “prominently labeled.” Article Four of the Measures specifies where explicit labels must be placed for text, audio, images, video, and virtual scenes. Article Eighteen of the Deep Synthesis Provisions prohibits using technical means to “delete, tamper with, or conceal” labels. Article Ten of the Measures builds on this by adding “forge” to the list. It also prohibits providing tools or services that help others commit these acts and using improper labeling methods to harm others' rights and interests. Article Thirteen of the Deep Synthesis Provisions already requires app distribution platforms to verify the security assessments and filing status of deep synthesis apps. Article Seven of the Measures extends this verification to labeling-related materials.

The Interim Measures for the Administration of Generative Artificial Intelligence Services are Order No. 15 of seven departments, including the CAC, and took effect on August 15, 2023. They address labeling in only one sentence, in Article Twelve: providers shall “label generated content such as images and videos” in accordance with the Deep Synthesis Provisions. The labeling Measures expressly list text, images, audio, video, virtual scenes, and similar content as objects of labeling. They also add requirements for the dissemination stage that earlier provisions did not spell out. These include verification and tiered prompts by content dissemination platforms and declarations that users must make on their own initiative. Article Seventeen of the Interim Measures provides for algorithm filing and security assessment procedures. Through Article Twelve of the labeling Measures, these procedures are now linked to the submission of labeling materials.

References

1. Cyberspace Administration of China, Ministry of Industry and Information Technology, Ministry of Public Security, and National Radio and Television Administration: Notice on Issuing the Measures for Labeling Artificial Intelligence-Generated and Synthesized Content (Guoxinbantongzi 〔2025〕 No. 2), China Cyberspace, March 14, 2025.

2. Official of the Cyberspace Administration of China: Q&A with Reporters on the Measures for Labeling Artificial Intelligence-Generated and Synthesized Content, China Cyberspace, March 14, 2025.

3. Cyberspace Administration of China, Ministry of Industry and Information Technology, and Ministry of Public Security: Provisions on the Administration of Deep Synthesis of Internet Information Services (Order No. 12), China Cyberspace, December 11, 2022.

4. Cyberspace Administration of China and six other departments: Interim Measures for the Administration of Generative Artificial Intelligence Services (Order No. 15), China Cyberspace, July 13, 2023.

5. State Administration for Market Regulation and Standardization Administration of China: GB 45438-2025 Cybersecurity Technology — Labeling Method for Artificial Intelligence-Generated and Synthesized Content, National Standards Full-Text Public System, released February 28, 2025, effective September 1, 2025.

6. Xishu Zhifa · Law is the art of the rules of the game

7. Compiled and published by Scholay Academic One-Stop Platform. If this infringes your rights, please let us know and it will be taken down.

8. Also published on Enter Scholar, a community for scholars in the age of intelligence.

The Daniel Patrick Moynihan United States Courthouse (500 Pearl Street) at Foley Square in Manhattan, New York, which houses the U.S. District Court for the Southern District of New York. Photo: Ken Lund; source: Wikimedia Commons; license: CC BY-SA 2.0.

On December 27, 2023, The New York Times Company sued Microsoft and OpenAI in the U.S. District Court for the Southern District of New York (Case No. 1:23-cv-11195), alleging that they used Times articles without permission to train models and reproduced its reporting in chat and search products. In 2025 the court dismissed some of the claims, while the core infringement claims proceeded; in September 2026 the parties filed motions for summary judgment, and the fair use question remains to be decided.

Filing of the Suit and the Plaintiff's Claims

On December 27, 2023, The New York Times Company filed suit in the U.S. District Court for the Southern District of New York. The case is captioned The New York Times Company v. Microsoft Corporation et al., Case No. 1:23-cv-11195. It is presided over by District Judge Sidney H. Stein, with discovery and related matters referred to Magistrate Judge Ona T. Wang. The defendants include Microsoft Corporation and several OpenAI-affiliated entities, including OpenAI, Inc., OpenAI LP, and OpenAI OpCo LLC. The plaintiff filed its First Amended Complaint in August 2024 (ECF No. 170); the court explained in its opinion that the amended version added works at issue but raised no new legal theories or causes of action. On August 21, 2026, the plaintiff filed a Third Amended Complaint (MDL ECF No. 1677).

The following are the plaintiff's allegations, which the court has not found to be true. The complaint alleges that OpenAI's GPT-series models copied and used millions of copyrighted Times articles in training, citing as an example at least 1600 ten-thousands (sixteen million) unique records from the Times in the Common Crawl dataset. On the output side, the plaintiff alleges that GPT-4, when prompted, can output large portions of its reporting nearly verbatim, listing numerous examples in Exhibit J; that search-integrated products such as Bing Chat and ChatGPT's Browse with Bing display excerpts and paraphrases of the original text far longer than traditional search results, diverting readers from the Times website; and that the models also misattribute to the Times content it never published. On this basis the complaint asserts six causes of action: direct infringement, vicarious infringement, contributory infringement, violation of Section 1202 of the Digital Millennium Copyright Act (DMCA) concerning copyright management information, common-law unfair competition by misappropriation, and federal trademark dilution, and asserts that the defendants should be liable for “billions of dollars” in statutory and actual damages.

The Defendants' Principal Defenses

At the motion-to-dismiss stage, the two defendants challenged only some of the claims; apart from the statute of limitations issue, the core direct infringement claim was not targeted for dismissal. OpenAI filed a partial motion to dismiss on February 26, 2024 (ECF Nos. 51 and 52), arguing that direct infringement claims based on training conduct in 2019 and 2020 were barred by the three-year statute of limitations, and challenging the contributory infringement, DMCA, and unfair competition claims. The motion also directly questioned the origins of Exhibit J: OpenAI said the Times “paid someone to hack OpenAI's products,” and that only after “tens of thousands of attempts,” exploiting a bug and using deceptive prompts that violated the terms of use, did it obtain these “highly anomalous” outputs, adding that “normal people do not use OpenAI's products in this way.” According to Reuters, a lawyer for the Times responded that what OpenAI called “hacking” was simply using OpenAI's products. Microsoft also moved to dismiss the contributory infringement, DMCA, and unfair competition claims, among others.

In the summary judgment stage, the defendants' defenses center on fair use. In its memorandum in support of its motion filed on September 4, 2026 (public version, ECF No. 1496), OpenAI argues that pre-training on news works, aimed at distilling broad patterns of human language and facts about the world from massive amounts of text, is a highly transformative use; that the works at issue are primarily factual; and that pre-training has caused no legally cognizable market harm. Citing the analysis of the plaintiff's expert, the memorandum states that verbatim regurgitation is extremely rare, at rates between 0.000002% and 0.00011%. It also argues that the Browse feature's extraction of factual information from articles is fair use or was impliedly licensed, and that the DMCA claims cannot succeed. Microsoft filed a motion the same day (ECF No. 1473) asking the court to enter judgment in its favor on all claims against Microsoft in the Times' Third Amended Complaint; its memorandum (ECF No. 1585) asserts that both model training and Copilot's web retrieval feature (web grounding) are transformative.

The Court's Procedural Rulings to Date

All of the court's rulings so far have been procedural; it has made no merits determination on whether there was infringement or whether the use constitutes fair use. On March 26, 2025, Judge Stein first issued a brief order on the motions to dismiss, and on April 4 issued an opinion setting out his reasoning (ECF No. 514), addressing together the three cases brought by the Times, the Daily News, and the Center for Investigative Reporting (CIR). Key points relevant to the Times case include: OpenAI's request to exclude, on statute of limitations grounds, claims based on conduct more than three years before the filing of suit was denied, because the defendant had failed to show that the plaintiff had discovered, or with reasonable diligence should have discovered, the infringement at that time; both defendants' requests to dismiss the contributory infringement claim were denied; the unfair competition by misappropriation claim was dismissed with prejudice; and the DMCA Section 1202(b)(1) claim against OpenAI and the Section 1202(b)(3) claims against both defendants were also dismissed, but “without prejudice,” leaving the plaintiff the possibility of reasserting them.

On April 3, 2025, the U.S. Judicial Panel on Multidistrict Litigation (JPML) centralized multiple copyright suits against OpenAI as In re: OpenAI, Inc., Copyright Infringement Litigation (MDL No. 3143), transferring them to the Southern District of New York for coordinated pretrial proceedings before Judge Stein, under Case No. 1:25-md-03143. The panel found that these cases overlap substantially on factual questions such as model training, and that centralization would reduce duplicative discovery and inconsistent pretrial rulings. Since then, the Times case has proceeded in the same proceeding alongside cases brought by other news organizations and authors' class actions.

ChatGPT user conversation logs have been a major point of contention in discovery. On May 13, 2025, Judge Wang ordered OpenAI to preserve and segregate output logs that would otherwise be deleted, including data users requested be deleted or that must be deleted under privacy regulations (ECF No. 551); according to Bloomberg Law, Judge Stein overruled OpenAI's objection to that order at a hearing on June 26, 2025. On November 7, 2025, Judge Wang ordered OpenAI to produce to the news plaintiffs the full sample of 2000 ten-thousands (twenty million) de-identified ChatGPT conversations, reasoning that even logs not containing Times works could be relevant to OpenAI's fair use defense; on January 5, 2026, Judge Stein overruled OpenAI's objection and upheld that order (MDL ECF No. 1087).

In 2026, the U.S. Supreme Court held in Cox Communications, Inc. v. Sony Music Entertainment that “material contribution” is not a valid theory of contributory infringement liability. On that basis, OpenAI moved under Rule 12(c) of the Federal Rules of Civil Procedure to dismiss the related claims, and the Times and other news plaintiffs subsequently agreed to withdraw, with prejudice, their contributory infringement claims based on that theory with respect to end-user infringement. On August 6, 2026, Judge Stein issued a memorandum order (ECF No. 1449) confirming that withdrawal; as for the Times' and the Daily News' request to amend in order to pursue Microsoft for contributory liability under new theories such as inducement, the court denied leave, finding that the litigation was at a late stage and the plaintiffs had failed to show good cause.

Major procedural milestones in The New York Times v. Microsoft and OpenAI, with dates compiled from public court filings (see References). AI-generated schematic.

Summary Judgment Motions and the Schedule Ahead

On September 4, 2026, the parties filed cross-motions for summary judgment, asking the court to rule on fair use and other issues without a trial. The public redacted version of the news plaintiffs' joint memorandum was entered on the docket on September 17 (MDL ECF No. 1977-1). It asks the court to find that the defendants engaged in unauthorized copying at five stages: acquiring the articles (which the plaintiffs say often involved circumventing paywalls or violating industry norms and terms of use), training the models, Microsoft's use of the Bing index to supply retrieved content for real-time answers, the outputs of Microsoft's products, and the two companies' provision of copies to each other in their partnership. It also asks the court to find that statutory damages can be calculated separately for each infringed article. The memorandum cites the defendants' internal documents and data; for example, the plaintiffs say Microsoft's records show that, compared with traditional Bing search, click-through rates from Copilot to domains associated with the Times and the Daily News fell by 83% to 93%. These are the plaintiffs' interpretations of the evidence, which await the defendants' response and the court's review.

On September 1, 2026, the U.S. Department of Justice filed a statement of interest in the multidistrict litigation (MDL ECF No. 1682), taking the view that training large language models on written works is “highly transformative,” while noting that at the output stage, if a model reconstructs and disseminates the original work, the use may not be transformative. The statement of interest represents the government's position and is not binding on the court.

Under the schedule approved by Judge Stein on September 24, 2026, oppositions to summary judgment are due October 23, 2026, amicus briefs are due October 30, and replies are due November 20. As of this article's verification date (October 23, 2026), the court has not yet ruled on fair use, and the trial date remains to be verified. Until the court rules, the statements in the complaint and the parties' motions are only the parties' allegations.

References

1. U.S. District Court for the Southern District of New York: The New York Times Company v. Microsoft Corporation et al., No. 1:23-cv-11195, Complaint, ECF No. 1, 2023-12-27. CourtListener docket

2. U.S. District Court for the Southern District of New York: No. 1:23-cv-11195, First Amended Complaint, ECF No. 170, August 2024. Original PDF

3. U.S. District Court for the Southern District of New York: No. 1:23-cv-11195, OpenAI Memorandum in Support of Motion to Dismiss, ECF No. 52, 2024-02-26. Original PDF

4. Reuters: OpenAI says New York Times 'hacked' ChatGPT to build copyright lawsuit, 2024-02-27. Article link

5. U.S. District Court for the Southern District of New York: No. 1:23-cv-11195, Opinion on Motions to Dismiss, ECF No. 514, 2025-04-04. Original PDF

6. U.S. Judicial Panel on Multidistrict Litigation: In re: OpenAI, Inc., Copyright Infringement Litigation, MDL No. 3143, Transfer Order, 2025-04-03. Original PDF

7. U.S. District Court for the Southern District of New York: No. 1:23-cv-11195, Output Log Preservation Order, ECF No. 551, 2025-05-13. Original PDF

8. Bloomberg Law: OpenAI Fails To Pare Back Order To Preserve User Data in IP Suit, 2025-06-26. Article link

9. U.S. District Court for the Southern District of New York: No. 1:25-md-03143, Order Upholding the Discovery Order for 2000 ten-thousands (twenty million) Logs, ECF No. 1087, 2026-01-05. Original PDF

10. U.S. District Court for the Southern District of New York: No. 1:23-cv-11195, Memorandum Order, ECF No. 1449, 2026-08-06. Original PDF

11. U.S. Department of Justice: Statement of Interest of the United States, No. 1:25-md-03143, ECF No. 1682, 2026-09-01. Original PDF

12. U.S. District Court for the Southern District of New York: No. 1:23-cv-11195, OpenAI Memorandum in Support of Motion for Summary Judgment (public version), ECF No. 1496, 2026-09-04. Original PDF

13. U.S. District Court for the Southern District of New York: No. 1:23-cv-11195, Microsoft Notice of Motion for Summary Judgment, ECF No. 1473, 2026-09-04. Original PDF

14. U.S. District Court for the Southern District of New York: No. 1:23-cv-11195, Microsoft Memorandum in Support of Motion for Summary Judgment, ECF No. 1585, entered 2026-09-17. Original PDF

15. U.S. District Court for the Southern District of New York: No. 1:25-md-03143, News Plaintiffs' Memorandum in Support of Motion for Summary Judgment (public redacted version), ECF No. 1977-1, 2026-09-17. Original PDF

16. U.S. District Court for the Southern District of New York: Order Extending the Summary Judgment Briefing Schedule, 2026-09-24. Original PDF

17. Xishu Zhifa · Law is the art of the rules of the game

18. Information compiled and published by Scholay, a one-stop academic platform; if there is any infringement, please let us know and it will be taken down.

19. Information also published on Enter Scholar, a community of scholars for the intelligent era

The U.S. Copyright Office's Copyright and Artificial Intelligence report series currently lists three volumes on its website: Volume 1 addresses digital replicas (July 31, 2024), Volume 2 addresses the copyrightability of AI-generated content (January 29, 2025), and Volume 3 addresses generative AI training (pre-publication version released May 9, 2025). The reports are policy studies and recommendations provided to Congress, not legislation. As of October 23, 2026, the final version of Volume 3 had still not been released.

The James Madison Memorial Building of the Library of Congress, which houses the U.S. Copyright Office. Photo: ajay_suresh; source: Flickr; license: CC BY 2.0.

Nature of the Reports and Release Status

The Copyright Office launched a dedicated study of artificial intelligence in early 2023. It published a notice of inquiry in the Federal Register on August 30, 2023 (88 Fed. Reg. 59942), and by December 2023 it had received more than 1 ten-thousand public comments. The reports were written under Section 701(b) of Title 17 of the United States Code, which gives the Register of Copyrights the duties to “conduct studies” and to “advise Congress on copyright matters.” They are not laws, regulations, or court decisions. Volume 3 states in its introduction that the report does not express views on specific cases and offers only an analytical framework.

According to the Copyright Office's topic page, Volume 1, Digital Replicas (Part 1: Digital Replicas), was released on July 31, 2024. Volume 2, Copyrightability (Part 2: Copyrightability), was released on January 29, 2025. Volume 3, Generative AI Training (Part 3: Generative AI Training), was made public as a “pre-publication version” on May 9, 2025. The website says the early release responded to congressional inquiries and stakeholder interest, that the final version “will be published in the future,” and that no substantive changes to the analysis or conclusions are expected. As of a search on October 23, 2026, the website still offered only the pre-publication version of Volume 3, so everything in this article concerning Volume 3 is based on that version. Strictly speaking, the volumes of the series released in 2025 are Volumes 2 and 3; Volume 1 was released in 2024.

Official statements are inconsistent about whether further volumes will follow. The January 29, 2025 announcement of Volume 2 said that the report was being “issued in three parts.” However, a footnote in the pre-publication version of Volume 3 states that infringement liability for outputs and transparency requirements will be discussed in “Part 4.” As of the search date, the website did not list a Volume 4, and its release date and contents are unknown.

AI-generated illustration. A timeline of the U.S. Copyright Office's Copyright and Artificial Intelligence report series and related events. Dates were compiled from public information on the U.S. Copyright Office website, the decision of the D.C. Circuit Court of Appeals, the U.S. Supreme Court docket, and Congress.gov, as of October 23, 2026.

AI Training and Fair Use

Volume 3 first sets out which steps in generative AI development implicate reproduction and other exclusive rights, discussing data collection and curation, model training, retrieval-augmented generation (RAG), and outputs in turn. The report concludes that multiple stages of generative AI development use works in ways that implicate copyright owners' exclusive rights. The key question is whether these acts of prima facie infringement can be excused as “fair use.”

The report analyzes the four statutory factors. Under the fourth factor (the effect on the market for the work), it separately discusses lost sales, “market dilution,” and lost licensing opportunities. Its overall assessment is that outcomes in individual cases cannot be predicted in advance. Many uses in AI training are “likely to be transformative,” but whether they are fair depends on which works were used, where they came from, the purpose of the use, and what controls were placed on outputs. If a model is used for purposes such as analysis or research, its outputs are unlikely to substitute for the expressive works used in training. But “making commercial use of vast troves of copyrighted works to produce expressive content that competes with them in existing markets, especially where this is accomplished through illegal access,” goes beyond established fair use boundaries.

These are the Copyright Office's analytical views on current law, and courts are not bound by them. The report also states that its analysis is limited to the circumstances and public information available at the time. It notes that the technology and markets continue to change rapidly, and that the Office will keep monitoring developments to determine whether its conclusions need revision.

Copyrightability of Generated Content

Volume 2 concludes that the copyrightability questions raised by AI can be resolved under existing law, without legislative change. Specifically, using AI to assist human creativity, rather than replace it, does not affect a work's eligibility for protection. A human author's original expression in a work is protected, even if the work also contains AI-generated material. Content generated purely by AI, or content whose expressive elements a human did not sufficiently control, is not protected by copyright. Whether a human contribution is sufficient to constitute authorship must be determined case by case.

On prompts, the report finds that, given how generally available technology currently works, prompts alone do not provide enough control to make the user the author of the output. Prompts are essentially instructions that convey unprotectable ideas. On the other hand, where a human author's work is perceptible in AI output, or where a human has creatively selected, arranged, or modified the output, those portions can still be protected. The report also finds that the case for creating copyright or special (sui generis) protection for AI-generated content has not been made. It states that the Office will issue supplementary registration guidance and update the relevant portions of the Compendium of U.S. Copyright Office Practices (Compendium).

The related court case is Thaler v. Perlmutter. In his registration application, applicant Stephen Thaler listed the AI system he developed, the “Creativity Machine,” as the sole author of the visual work A Recent Entrance to Paradise, and listed himself only as the owner of the rights. The Copyright Office refused registration on the basis of the human authorship requirement. The U.S. Court of Appeals for the District of Columbia Circuit issued its decision on March 18, 2025 (No. 23-5233, opinion). The court held that the Copyright Act of 1976 requires a work to be authored in the first instance by a human being, and it upheld the refusal of registration. Thaler then petitioned the U.S. Supreme Court for a writ of certiorari (No. 25-449), which the Court denied on March 2, 2026 (docket page). That application listed AI as the sole author, which differs from the scenarios of “humans creating with the help of AI” that are the focus of Volume 2.

Licensing, Transparency, and Legislative Discussion

The fifth part of Volume 3 is devoted to training licenses. The report observes that some voluntary direct and collective licensing agreements have emerged, and that some AI systems have been trained entirely on licensed or public domain works. This shows that voluntary licensing is feasible in at least some contexts. Examples include high-value content that can be licensed in relatively large volumes (popular music, stock photography) and fields with a limited number of rightsholders. However, the report also acknowledges that the growth of licensing markets does not, by itself, prove that voluntary licensing can meet all training needs. The report says that antitrust concerns raised by collective licensing are outside the Copyright Office's expertise, and it encourages the U.S. Department of Justice to provide guidance, including on whether an antitrust exemption is needed.

On government intervention, the report finds that compulsory licensing for AI training has clear drawbacks and could lock in rates and industry practices. Where voluntary licensing truly does not work, extended collective licensing (ECL) is a less interventionist option. On “opt-out” mechanisms, the report finds that requiring rightsholders to opt out affirmatively is inconsistent with the basic principle that use requires consent. An opt-out mechanism might preserve some degree of control only if Congress were to consider creating an exception for AI training in the future. The report also notes in a footnote that merely complying with platform-level signals such as robots.txt is not sufficient. Its ultimate recommendation is to let licensing markets continue developing without government intervention for now. If market failure is shown for specific types of works in specific contexts, targeted interventions such as ECL could then be considered.

On transparency, the pre-publication version of Volume 3 makes no specific transparency recommendations. In describing the EU's Artificial Intelligence Act, the report mentions the Act's transparency requirements and says the issue will be discussed further in Part 4, which has yet to be released. Requirements such as training data disclosure obligations therefore cannot currently be described as recommendations the Copyright Office has already made.

The three volumes take different positions on legislation. Volume 2 expressly does not recommend legislative change. Volume 3 finds that government intervention now would be “premature,” given the relatively rapid growth of voluntary licensing and the general lack of stakeholder support for amending the law. Only Volume 1 makes a legislative recommendation to Congress: to enact a new federal law protecting everyone from harm caused by the knowing distribution of unauthorized digital replicas. In Congress, Senator Coons, together with Blackburn, Klobuchar, and Tillis, introduced S.1367, the NO FAKES Act of 2025, on April 9, 2025. The bill would create a federal right in an individual's voice and visual likeness and has been referred to the Senate Judiciary Committee. At the time of the search, the congressional website showed the bill still at the “Introduced” stage. Available public materials are insufficient to establish a direct relationship between this bill and Volume 1.

References

1. U.S. Copyright Office. Copyright and Artificial Intelligence (topic page, accessed October 23, 2026).

2. U.S. Copyright Office. NewsNet Issue 1048: Part 1 Digital Replicas release announcement, 2024-07-31.

3. U.S. Copyright Office. Copyright and Artificial Intelligence, Part 2: Copyrightability, 2025-01-29.

4. U.S. Copyright Office. NewsNet Issue 1060: Part 2 release announcement, 2025-01-29.

5. U.S. Copyright Office. Copyright and Artificial Intelligence, Part 3: Generative AI Training (Pre-Publication Version), 2025-05-09.

6. U.S. Court of Appeals for the D.C. Circuit. Thaler v. Perlmutter, No. 23-5233, 2025-03-18.

7. Supreme Court of the United States. Docket No. 25-449, Thaler v. Perlmutter (petition for certiorari denied 2026-03-02).

8. Congress.gov. S.1367 - NO FAKES Act of 2025, introduced 2025-04-09.

9. Xishu Zhifa · Law: the art of the rules of the game

10. Compiled and published by Scholay Academic One-Stop Platform. If this content infringes your rights, please let us know and it will be taken down.

11. Also published on Enter Scholar, a community for scholars in the age of intelligence

The sign at the main entrance of the FDA's White Oak campus in Silver Spring, Maryland, with Building 21 behind it (photographed in 2010). Photo: U.S. Food and Drug Administration (FDA); source: Wikimedia Commons; license: work of the U.S. federal government, public domain.

On October 20, 2026, Rick Abramson, director of the U.S. FDA's Digital Health Center of Excellence, said at a medical device industry conference in Boston that generative AI medical devices may need to undergo competency assessment the way physicians do, and said the FDA intends to draft policy guidance within a few months. So far, this approach appears only in a discussion paper released in August and in officials' remarks at the event. It has not yet become draft guidance or a rule in effect.

Abramson's Conference Remarks

According to an on-site report by MedCity News reporter Arundhati Parmar on October 20, Abramson took part in a panel discussion that day at The MedTech Conference, hosted in Boston by the industry association AdvaMed. The moderator was Geeta Pamidimukkala, AdvaMed's vice president for technology and regulatory affairs. A radiologist by training, Abramson is currently director of the Digital Health Center of Excellence (DHCoE) within the FDA's Center for Devices and Radiological Health (CDRH).

He used radiology to illustrate why the old approach falls short. A traditional AI device takes a chest X-ray as input and outputs a binary signal such as “pneumothorax present/absent,” so the evidence requirements are relatively straightforward. For generative AI, both the inputs and the outputs are unbounded text, which he called an “unbounded evaluation space,” and the FDA “does not yet have methods for this kind of evidence demonstration.” He said such devices behave “more like me, the physician, than like a heart valve or a defibrillator”: a physician's knowledge, clinical judgment, communication skills, and ability to stay within safety boundaries are assessed over a long period, and no one requires a physician to first look at every chest X-ray they might encounter over their career.

On next steps, Abramson said the FDA “intends to move toward policy and to draft policy,” that the discussion paper is “not just an academic paper,” and that the current administration has made this work a priority at the level of both the Secretary of Health and Human Services (HHS) and the White House. He gave no specific date, saying only “not weeks, and certainly not years,” and said he expects a draft policy guidance to be released within a few months, followed by another round of public comment. All of the above are oral statements made by an official at the conference and are quoted from media reports. This article did not find a transcript of the remarks published by the FDA.

Scope and Nature of the August Discussion Paper

The document Abramson referred to is the FDA's “Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback,” released on August 18, 2026. Led by DHCoE, it collected comments on Regulations.gov under docket number FDA-2026-N-7874, with a deadline of October 19. According to the FDA press release, the paper addresses four areas: risk assessment, premarket evaluation, postmarket monitoring, and other topics such as foundation models and agentic AI systems.

The paper targets “generative AI-enabled medical devices,” meaning products that are themselves medical devices and that use generative AI, not all AI used in healthcare settings. It proposes a two-axis risk framework: one axis looks at how independent the device's activity is, and the other looks at the potential consequences of relying on erroneous output. According to a summary of the paper by the law firm Crowell & Moring, the activity axis has four tiers: informational and not directing action (such as providing a risk score for future cardiovascular events), informational but directing action (such as strongly worded advice to go to the emergency department), taking action under the supervision of healthcare professionals, and taking action fully autonomously. The consequence axis acts as a modifier. Even when both involve placing orders autonomously, prescribing antibiotics for confirmed strep throat does not carry the same risk as initiating a thrombolytic therapy order in a stroke protocol.

The premarket section is the “physician-like” approach Abramson described. The FDA press release says this competency assessment scheme is “at a high level inspired by how physicians are trained and evaluated,” and that it consists of two parts: non-clinical device benchmarking and clinical validation. The law firm's analysis further notes that what is evaluated is the device as configured for actual deployment and as ultimately delivered to users, not the foundation model in isolation. Clinical validation may take the form of retrospective evaluation, shadow deployment, or standardized patient interactions, up to prospective clinical studies or randomized controlled trials, chosen according to risk.

The paper states its legal nature clearly. The FDA page declares that it is for discussion only, does not constitute draft or final guidance, does not propose or implement changes in regulatory policy, and does not express CDRH's expectations regarding evidence for future marketing submissions. Nor does the paper address whether these ideas fall within the FDA's existing statutory authority or would require new legislative authorization.

Timeline related to the FDA's discussion paper on generative AI medical devices. The dashed line indicates a date that has not been set, and the spacing between nodes is not proportional to time. Drawn by this site with Graphviz code (rendered via QuickChart); sources: FDA press release (2026-08-18), AMA letter (2026-10-16), and MedCity News report (2026-10-20).

Relationship to Existing Device Regulatory Pathways

This paper has not changed the current rules. The FDA explains on its AI medical devices page that it does not regulate “AI itself.” Instead, it regulates medical devices under the Federal Food, Drug, and Cosmetic Act (FD&C Act). The definition of a device includes software, except for certain software functions excluded under Section 520(o) of the Act. AI products that are devices still go through established pathways such as 510(k) premarket notification, De Novo classification, or premarket approval (PMA). Products that involve algorithm updates may submit a plan under the finalized “Predetermined Change Control Plan” (PCCP) guidance together with their marketing submission. The FDA says that as of September 2026, more than 1600 AI medical devices had been authorized for marketing in the United States.

The discussion paper mainly addresses the methods for “demonstrating safety and effectiveness,” not legal classification or market pathways. MedCity News described competency assessment as a departure from how the FDA has evaluated software as a medical device (SaMD) for twenty years; this is the reporter's characterization. The law firm's analysis notes that the postmarket monitoring envisioned in the paper (periodic re-benchmarking, sampled review by clinicians, and monitoring for performance degradation) may be built around PCCPs. The U.S. Chamber of Commerce also stressed in its submitted comments that the two-axis framework should be used only for risk management and evidence expectations and should not become a de facto new classification system. In its view, device classification, substantial equivalence determinations, and market pathways should still be governed by existing regulations.

Feedback from Physician and Industry Groups

John Whyte, chief executive officer of the American Medical Association (AMA), wrote to Abramson on October 16. The letter broadly supports the FDA's exploration of a competency assessment approach based on “benchmarking plus clinical validation,” but sets out two principles. First, regulatory flexibility must not come at the cost of lowering the “reasonable assurance of safety and effectiveness.” Second, physicians' expertise should be used to set standards, not to serve as a backstop safety net. The AMA argues that if physicians are the reference point, accountability should come along with that comparison: “Neither the probabilistic nature of generative AI outputs nor the inability to test every possible scenario should allow responsibility to be diffused among clinicians, patients, deploying organizations, foundation model developers, or other participants in the ecosystem.” The AMA also explicitly opposes lowering premarket evidence requirements on the grounds that postmarket monitoring will be strengthened, out of concern that this would shift risk and legal liability onto physicians. It also argues that agentic systems require a higher degree of testing and review.

Industry groups focus more on predictability and compliance burden. The U.S. Chamber of Commerce's October 19 comments support the two-axis approach but ask the FDA to provide objective criteria for placing devices on the axes, along with examples across clinical domains. The Chamber argues that evaluation should focus on performance on specific tasks for specific intended uses rather than on “competency” in general. It recommends developing benchmarks jointly with standards organizations such as AAMI, IEEE, HL7, and ISO, and it contends that low-risk and moderate-risk devices should be able to accept binding postmarket monitoring plans in exchange for a lighter premarket burden. The Consumer Technology Association (CTA), in comments submitted the same day, calls postmarket monitoring the most important and most difficult part of the entire framework. It recommends building on the existing PCCP framework rather than creating a separate one, and asks the FDA to confirm that agentic systems performing non-device functions such as medical record documentation and scheduling are not subject to device regulation. Both groups recommend addressing agentic AI separately.

Several matters remain undetermined: the specific release date of the draft guidance, whether the formal text will keep the “competency assessment” design, and how the disagreement between physician groups and industry groups over the premarket evidence threshold will be resolved. The figure of “more than 300 comments” comes from Abramson's remarks at the event; this article did not check the public docket item by item.

References

1. U.S. Food and Drug Administration. FDA Seeks Public Feedback to Inform Regulatory Approach for Generative AI-Enabled Medical Devices. 2026-08-18.

2. U.S. Food and Drug Administration. Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback. 2026-08-18. Docket No. FDA-2026-N-7874.

3. U.S. Food and Drug Administration. Artificial Intelligence-Enabled Medical Devices. The page does not show a publication date; accessed 2026-10-23.

4. Arundhati Parmar. FDA Official Believes GenAI-enabled Tools Will Need to Be Assessed Like a Physician. MedCity News, 2026-10-20.

5. John Whyte, American Medical Association. Letter to Rick Abramson re: Considerations for the Regulation of Generative AI-Enabled Medical Devices. 2026-10-16.

6. U.S. Chamber of Commerce. Re: Docket No. FDA-2026-N-7874 – Considerations for the Regulation of Generative AI-Enabled Medical Devices. 2026-10-19.

7. Consumer Technology Association. CTA Comments - FDA Gen AI Discussion Paper 2026. 2026-10-19.

8. Crowell & Moring LLP. FDA Proposes GenAI Medical Device Regulatory Framework: What Manufacturers Need to Know. 2026-09-03.

9. Xishu Zhifa · Law: the art of the rules of the game

10. Compiled and published by Scholay, a one-stop academic platform. If this infringes your rights, please let us know and it will be taken down.

11. Also published on Enter Scholar, a community for scholars in the age of intelligence.

The Phillip Burton Federal Building & United States Courthouse (450 Golden Gate Avenue, San Francisco). The U.S. District Court for the Northern District of California, which is hearing this case, is located in this building. Photo: Marincyclist; source: Wikimedia Commons; license: CC BY-SA 4.0.

In January 2023, three illustrators sued Stability AI, Midjourney, and DeviantArt in the U.S. District Court for the Northern District of California, alleging that the companies used their works without permission to train image-generation models (Case No. 3:23-cv-00201-WHO). Across two rounds of rulings on motions to dismiss, Judge William Orrick allowed the copyright infringement claims and a trademark-law claim against Midjourney to proceed, and dismissed the DMCA claims. These are procedural rulings, not findings of infringement. As of October 2026, the case remains in the pretrial stage.

Plaintiffs, Defendants, and the Allegations in the Complaint

Plaintiffs Sarah Andersen, Kelly McKernan, and Karla Ortiz filed a proposed class action on January 13, 2023, against defendants Stability AI Ltd., Stability AI, Inc., Midjourney, Inc., and DeviantArt, Inc. On January 31 of the same month, the case was randomly reassigned to Judge William H. Orrick. The plaintiffs' core allegation runs as follows: the LAION dataset scraped roughly 5 billion (50 亿) images from the internet, Stability AI used those images to train Stable Diffusion, and the other defendants' products were built on that model. That, the plaintiffs say, is why those products can generate images “in the style of” a particular artist when given the artist's name. All of the above are the plaintiffs' statements in the complaint, and the defendants dispute their accuracy.

Runway AI was not among the original defendants. In the First Amended Complaint (Dkt. No. 129), the plaintiffs added it as a new defendant, alleging that it took part in training and releasing Stable Diffusion 1.5. They also added seven new plaintiffs: Hawke Southworth, Grzegorz Rutkowski, Gregory Manchess, Gerald Brom, Jingna Zhang, Julia Kaye, and Adam Ellis. The August 2024 ruling noted that these additions had been made without prior leave of court. However, because the defendants suffered no substantial prejudice as a result, the court permitted the plaintiffs to keep them in the Second Amended Complaint.

What the Two Rulings on the Motions to Dismiss Kept and Discarded

The first ruling, issued on October 30, 2023 (ECF No. 117), addressed motions to dismiss from three groups of defendants, as well as DeviantArt's special motion to strike under California's anti-SLAPP statute. The court granted most of the motions to dismiss and kept only Andersen's direct copyright infringement claim against Stability AI. She had plausibly alleged that her works were scraped into the training set and used for training, and whether the copying occurred at the training stage or at run time could not be determined at this stage. The claim was limited to her 16 registered groups of works. McKernan's and Ortiz's works had not been registered with the Copyright Office, and their counsel stated in court that no copyright claims would be pursued on their behalf, so their copyright claims were dismissed with prejudice. The direct infringement, vicarious infringement, DMCA Section 1202 (removal or alteration of copyright management information), and right of publicity claims against DeviantArt and Midjourney, as well as the breach of contract claim against DeviantArt, were all dismissed with leave to amend. The California unfair competition law claim was also dismissed, and the court held that the portion based on copyright infringement was preempted by the Copyright Act. The court also denied the motion to strike the class allegations and deferred ruling on the anti-SLAPP motion.

The second ruling, issued on August 12, 2024 (ECF No. 223), reviewed the First Amended Complaint. According to the ruling's conclusions, all of the defendants' motions to dismiss the Copyright Act claims were denied, including the motions directed at the induced infringement claims against Stability AI and Runway. Midjourney's motion to dismiss the Lanham Act (the U.S. federal trademark statute) claims was also denied. Five plaintiffs brought these claims, alleging false endorsement and vicarious trade dress infringement, based on a list of roughly 4,700 artists that Midjourney's CEO had posted on Discord. The DMCA claims were dismissed in their entirety without further leave to amend. The unjust enrichment claim was dismissed, but with one final opportunity to amend. The breach of contract and implied covenant of good faith claims against DeviantArt were dismissed without leave to amend. On DMCA Section 1202(b), the court adopted the reasoning of Judge Jon Tigar of the same court in Doe 1 v. GitHub, holding that such claims require the copy to be “identical” to the original work. The complaint did not allege that Stable Diffusion had ever output an image identical to any plaintiff's work. The court also acknowledged that the question remains unsettled.

Note: “Kept” means only that a claim survived review at the pleading stage and may proceed to later stages of the case. It does not mean the court found infringement.

The “Compressed Copies” Theory and Discovery

The allegation that “the model contains compressed copies” is one of the plaintiffs' most contested claims. The 2023 ruling found the original complaint unclear on this point and required the plaintiffs to define what they meant by “compressed copies.” If the plaintiffs meant that the model contains mathematical or statistical methods from which training images can be reconstructed algorithmically, they had to say so and plead plausible facts. The theory built on this allegation, that “the model itself is a derivative work,” was likewise dismissed. At the hearing, the parties also disputed how much could be determined from the public code alone. The plaintiffs said they needed information that Stability AI had not made public. Stability AI responded that the only non-public material was the weights files, which had nothing to do with the “compressed copies” question.

The First Amended Complaint added allegations about how training images are retained in the model and how they are called up at run time. It cited two kinds of material. The first was public remarks by Emad Mostaque, then CEO of Stability AI, to the effect that 100,000 GB (10 万 GB) of images had been compressed into a 2 GB file that could “recreate” any one of those images. The second was academic papers showing that Stable Diffusion can generate images that are very similar, or even identical, to some training images. The plaintiffs also pointed out that components such as the weights files are not available for everyone to inspect. The 2024 ruling addressed two theories. Under the “model theory,” the trained model is itself an infringing copy or derivative work. Under the “distribution theory,” distributing the model amounts to distributing the works. The court held that both theories depend on whether the plaintiffs' works exist in some form in the model as it is distributed and run. At this stage, the claims could proceed even if the works exist as algorithmic or mathematical representations fixed in a medium different from that of the originals.

This conclusion rests on the standard of review for motions to dismiss. Under Rule 12(b)(6) of the Federal Rules of Civil Procedure, the court first assumes that the complaint's factual allegations are true and examines only whether the allegations are “plausible.” The ruling states that whether the evidence supports each theory, and whether the plaintiffs must choose among the theories, will be addressed at the summary judgment stage. Whether a fair use defense succeeds must likewise be tested against the evidence. On the model's reproduction of training images, Stability AI calls this a bug while the plaintiffs say it happens by design, and the court said this dispute is “to be tested at a later date.” Procedurally, the court did not find that the model contains copies of the works. It only allowed this theory to proceed to discovery. There, the parties will produce training data and technical materials about the model, and the court will assess the theory at the summary judgment stage.

Proceedings After 2024

According to the plaintiffs' January 2026 motion, the court ordered discovery to begin on October 29, 2024 (ECF No. 240), and the plaintiffs filed the Second Amended Complaint two days later (ECF No. 238). On November 21, 2024, the plaintiffs voluntarily dismissed all DMCA claims in the Second Amended Complaint (ECF No. 241), and McKernan and Southworth withdrew from the litigation as a result. According to that filing, the defendants agreed that if the Ninth Circuit rejects the “identicality” requirement in Doe 1 v. GitHub, they will not cite this dismissal as a reason to oppose a request by the plaintiffs to have the claims heard again. The outcome of that appeal has yet to be verified.

On January 12, 2026, citing material newly disclosed in discovery, the plaintiffs sought leave to file a Third Amended Complaint (ECF No. 376). It added two new direct infringement allegations: that DeviantArt copied the plaintiffs' works to develop DreamUp, and that Midjourney downloaded and used the DataComp xLarge dataset, which contains the plaintiffs' works. The defendants did not oppose the motion, and the court granted it on February 25, 2026 (ECF No. 429). The court also allowed Stability AI and Midjourney to temporarily keep the names of non-public training datasets under seal. The plaintiffs filed that complaint on February 27 (ECF No. 431). These additions are the plaintiffs' allegations, and the court has not yet reviewed them on the merits.

On scheduling, a February 2, 2026 order (ECF No. 409) set the fact discovery cutoff at June 1, 2026, with trial set for before June 1, 2027. On September 28, 2026, Orrick granted the plaintiffs' motion to modify the schedule again (ECF No. 759). The docket entry states that hearings on dispositive motions and class certification must be held by September 29, 2027. The new trial date has yet to be verified. Discovery disputes are ongoing. On September 1, 2026, the plaintiffs filed a motion for discovery sanctions against DeviantArt (ECF No. 730), which is being handled by Magistrate Judge Lisa J. Cisneros. On October 19, a stipulation between the parties resolving that motion was approved (ECF No. 778); its specific terms have yet to be verified. As of the docket check on October 22, 2026, the court had not ruled on whether infringement occurred, on fair use, or on class certification.

AI-generated schematic: key procedural milestones in Andersen v. Stability AI (January 2023 to September 2026). The court's orders and the CourtListener docket are authoritative for dates and docket numbers.

References

1. U.S. District Court for the Northern District of California, Andersen v. Stability AI Ltd., Case No. 3:23-cv-00201-WHO, Order on Motions to Dismiss and Strike (ECF No. 117), October 30, 2023. CourtListener archived PDF

2. U.S. District Court for the Northern District of California, Andersen v. Stability AI Ltd., Case No. 3:23-cv-00201-WHO, Order Granting in Part and Denying in Part Motions to Dismiss First Amended Complaint (ECF No. 223), August 12, 2024. CourtListener archived PDF

3. Plaintiffs' counsel, Plaintiffs' Notice of Voluntary Dismissal (ECF No. 241), Case No. 3:23-cv-00201-WHO, November 21, 2024. CourtListener archived PDF

4. Plaintiffs' counsel, Motion for Leave to File Third Amended Complaint (ECF No. 376), Case No. 3:23-cv-00201-WHO, January 12, 2026. CourtListener archived PDF

5. U.S. District Court for the Northern District of California, Order Granting Unopposed Motion for Leave to File Third Amended Class Action Complaint and Granting in Part Motions to Seal (ECF No. 429), Case No. 3:23-cv-00201-WHO, February 25, 2026. CourtListener archived PDF

6. U.S. District Court for the Northern District of California, Order Granting in Part Plaintiffs' Motion to Modify Case Schedule (ECF No. 409), Case No. 3:23-cv-00201-WHO, February 2, 2026. CourtListener archived PDF

7. CourtListener, Andersen v. Stability AI Ltd., 3:23-cv-00201 (N.D. Cal.) docket, accessed October 22, 2026. Docket page

8. U.S. District Court for the Northern District of California, Andersen et al v. Stability AI Ltd. et al case page. Court website

9. Xishu Zhifa · Law is the art of the rules of the game

10. This information was compiled and published by the Scholay one-stop academic platform. If it infringes your rights, please let us know and it will be taken down.

11. This information is also published on Enter Scholar, a community for scholars in the age of intelligence.

Exterior of the Beijing Internet Court building, photographed on October 20, 2025. Photo: N509FZ; source: Wikimedia Commons; license: CC BY-SA 4.0.

On April 23, 2024, the Beijing Internet Court delivered its first-instance judgment in Yin Mouzhen v. a Beijing Intelligent Technology Company et al., a personality rights dispute, case number (2023) Jing 0491 Min Chu No. 12142. A voice actor's recordings had been turned into an AI text-to-speech product and sold to the public. The court held that as long as an AI voice can be identified as the person by the general public or by the public within a certain scope, it falls within the scope of protection of that person's voice rights and interests, and ordered two companies to jointly and severally compensate economic losses of 25 ten-thousand yuan. The judgment has taken effect and was later included in the People's Court Case Database.

From Audiobook Recordings to an AI Voiceover Product

According to the facts found in the judgment, Yin Mouzhen works professionally in voiceover and broadcasting. In 2019, a certain (Beijing) culture and media company (the “Culture Company”) commissioned her, through an agency, to record two audio works at a recording fee of 90 yuan per hour; the engagement agreement provided that the rights in the recorded works belonged to the Culture Company. On May 10, 2019, the Culture Company signed a Data Authorization and Use Agreement with a certain software (China) company (the “Software Company”), providing it with recording data that included her recording of Chuanyue zhi Huang Mou Tianxia; the Software Company paid a usage fee of 20040.33 yuan for this recording of about 50 hours.

Using only this one recording as material, the Software Company employed artificial intelligence technology to develop a text-to-speech product, which it sold through a cloud service platform operated by a Shanghai network technology company. On January 28, 2022, a Beijing intelligent technology company (the “Intelligent Technology Company”) signed an online service sales contract with a Beijing technology development company, under which the latter placed orders with the Software Company; the order included this product. The Intelligent Technology Company called the product directly through an application programming interface (API), without any technical processing, and launched it as a voice product in the AI voiceover software it operated. The platform page showed a play count of 3256728530.

In May 2023, Yin Mouzhen discovered that several voiceover works online used her voice, and through screening and tracing she identified the Intelligent Technology Company's platform. The court docketed the case on June 12, 2023, and subsequently, at the plaintiff's request, added four other companies as co-defendants. The plaintiff asked that the relevant products be taken down, that the Intelligent Technology Company and the Software Company apologize in writing, and that the five defendants jointly and severally compensate economic losses of 50 ten-thousand yuan and emotional damages of 10 ten-thousand yuan. The court held two public hearings, on December 12, 2023 and April 23, 2024, and pronounced judgment on April 23, 2024. During the proceedings, the two companies stated that they had taken the relevant products down in February 2024, which the plaintiff acknowledged in court. Neither side appealed after the judgment was pronounced, and the judgment took effect.

Key dates in the case, compiled from Judgment (2023) Jing 0491 Min Chu No. 12142 and publicly available information in the People's Court Case Database. AI-generated illustration.

Determining the Identifiability of an AI Voice

The first point in dispute was whether a voice processed by AI still counted as Yin Mouzhen's voice. The legal basis is Article One Thousand Twenty-Three, Paragraph Two of the Civil Code: “The protection of a natural person's voice shall be governed, mutatis mutandis, by the relevant provisions on the protection of portrait rights.” Article One Thousand Eighteen defines a portrait as “the external image of a specific natural person by which that person can be identified”; on this basis the judgment reasoned that a voice, like a portrait, is protected by law on the premise that it is identifiable.

The court's explanation proceeded on two levels. The first concerned voices in general: a voice is intangible and invisible, and less identifiable than a portrait, so a specific person can usually be recognized only after repeated or long-term listening; for people in professions such as voiceover, identifiability can be established as long as listeners within a certain scope can map the voice one-to-one to the person. The second concerned AI voices: the key is whether a specific natural person can still be identified, and as long as the general public or the public within a certain scope can identify the person by timbre, intonation and pronunciation style, that natural person's voice rights and interests “extend to that AI voice.”

The defendants had argued otherwise. The Software Company contended that identifiability should be judged by what the general public knows, and that it would be difficult to identify the plaintiff from an AI-processed voice; the Intelligent Technology Company contended that the AI-synthesized voice carried a watermark that severed its connection to the natural person's voice. The court rejected these defenses on the basis of two specific facts: the Software Company had used only the plaintiff's voice to develop the product; and when the court used the product to perform text-to-speech in the courtroom, the resulting voice was “highly consistent” with the plaintiff's timbre, intonation and pronunciation style.

In its press release on the judgment, the Beijing Internet Court summarized this standard as follows: the determination of identifiability “should comprehensively consider how the actor used the voice, and take whether ordinary listeners in the relevant field can identify the person as the criterion.” The adjudicative gist distilled when the case entered the database is: for a voice processed by artificial intelligence technology, where the general public or the public within a certain scope can identify a specific natural person by timbre, intonation and pronunciation style, the voice falls within the scope of protection of that natural person's voice rights and interests; use without permission constitutes infringement.

The Authorization Chain and the Liability of the Five Defendants

The second point in dispute was authorization. The court distinguished between two kinds of rights: under the engagement agreement, the Culture Company enjoyed copyright and other rights in the sound recordings, and could also use the plaintiff's name and likeness in distributing them, but this did not include licensing third parties to subject her voice to artificial intelligence processing. The Software Company held a Data Authorization Letter stating that the plaintiff granted it an unrestricted, perpetual, worldwide, royalty-free, irrevocable license to use her voice to create synthetic or derivative voices; but the court found that this letter had not been signed by the plaintiff herself. It had been signed on her behalf by the original agency, without her knowledge, and she did not recognize it.

The Software Company argued that the agency's conduct constituted apparent agency. Because the authorization letter was signed before the Civil Code took effect, the court applied Article One Hundred Seventy-One of the General Provisions of the Civil Law and held that the agency relationship had ended once the original engagement agreement was fully performed, and that the Software Company had no evidence of any appearance of authority to sign the letter on her behalf. Moreover, AI processing of a voice could significantly affect the plaintiff's personal and property interests, yet the Software Company had not reasonably examined whether the signing party was authorized. Apparent agency therefore was not established.

The judgment found that all five defendants had used the plaintiff's voice without permission, infringing her voice rights and interests; but liability was differentiated according to fault:

For compensation, the court applied fault-based liability (Article One Thousand One Hundred Sixty-Five of the Civil Code) and joint and several liability for joint infringement (Article One Thousand One Hundred Sixty-Eight). The Intelligent Technology Company did not know that the product was unauthorized, bought it at a reasonable price and called it directly without processing; the court held that it had “reasonable reliance” on the product being lawfully authorized. The products sold by the distributor and the cloud platform had a lawful source, and they likewise bore no fault. As for apologies, the plaintiff sought written apologies only from the Intelligent Technology Company and the Software Company; the court found this remedy commensurate with the manner and scope of the infringement and granted it (Article One Thousand). The request to cease the infringement was no longer upheld, because the products had already been taken down.

Neither side offered evidence of losses or gains, so the court set compensation at its discretion at 25 ten-thousand yuan under Article One Thousand One Hundred Eighty-Two. The factors it considered included: the AI voice still reflected the plaintiff's vocal characteristics and could to some extent substitute for her voice, costing her transaction opportunities; the aesthetic experience a voice provides is an important determinant of the market value of such products; the Software Company used only the plaintiff's voice to develop the product, valuing the timbre, rhythm and pronunciation style that had proven themselves in the voiceover market; and the product's play count. The defendant said the play count on the page was manually entered projected data; the court found that the defendant had not adequately rebutted it, and that it had entered the figure knowing users would treat it as real data, so the court accepted the figure. Damages for emotional harm were not awarded because the plaintiff had not proven serious emotional harm (Article One Thousand One Hundred Eighty-Three).

Another detail concerns a settlement agreement. On September 25, 2023, the plaintiff signed a settlement agreement with the Culture Company, receiving compensation of 3.5 ten-thousand yuan and agreeing to withdraw the suit; but the plaintiff did not subsequently apply to withdraw, and the Culture Company and the Software Company proposed a new settlement plan, stating that the new agreement would prevail where it conflicted with the original one. The court held that both sides had expressed an intention to overturn the original agreement, so it could not bind the adjudication of this case. The case acceptance fee of 3300 yuan was borne by the Culture Company and the Software Company.

The authorization and transaction chain from the voice actor's recordings to end users' videos: red marks the defendants ordered to pay joint and several compensation, and blue marks the defendants found to be without fault and not liable for compensation. Drawn from the facts found in the judgment; company names follow the anonymized designations used in the judgment. AI-generated illustration.

Lessons for Voice Authorization and the Limits of the Judgment

After the judgment was pronounced, the presiding judge, Zhao Ruigang, vice president of the Beijing Internet Court, said that a voice, as a personality right and interest, is personal and exclusive to the individual: “authorization of a sound recording does not mean authorization to turn the voice into AI; using, or licensing others to use, the voice in a sound recording without the right holder's permission constitutes infringement.” A China Daily report reposted on the Beijing Internet Court's English website also quoted him as reminding companies to be cautious when using AI to process or generate voices and images, and stressing the need to obtain the consent of the persons concerned.

From the judgment's reasoning, three points directly relevant to voice data and voice products can be drawn (the following is this article's summary, not legal advice). First, the object of authorization: copyright and neighboring rights in a sound recording are distinct from the personality right and interest in a voice, and obtaining a recording does not mean obtaining permission to turn the voice into AI. Second, the source of authorization: the judgment denied the validity of an authorization letter signed on the person's behalf and, on the ground that AI processing can significantly affect the person's interests, required the developer to verify that the authorization truly came from the person. Third, downstream positions: the purchaser, the distributor and the cloud platform were exempted from compensation because of reasonable reliance, but they were likewise found to have infringed, the relevant products were taken down, and the purchaser was also ordered to apologize in writing.

The judgment also has clear limits. It is a first-instance judgment that took effect because neither side appealed, and after being selected for the People's Court Case Database it serves as a reference for similar cases. The facts of the case were rather unusual: the product was developed using only the plaintiff's recordings, and the in-court comparison showed a high degree of consistency. The judgment does not directly address synthetic voices trained on a mix of several people's voices, or those that do not use the person's recordings but merely sound similar in style; identifiability still has to be judged on the facts of each case. The 25 ten-thousand yuan figure was a discretionary amount set when neither side offered evidence of losses or gains, and should not be treated as a general compensation standard.

References

1. Beijing Internet Court. Civil Judgment (2023) Jing 0491 Min Chu No. 12142. April 23, 2024 (full-text PDF hosted by the third-party website cnipcase.com, not published on the court's official website).

2. Beijing Internet Court WeChat official account. Nation's First AI-Generated Voice Personality Rights Infringement Case Decided at First Instance. Publication date to be verified.

3. China Court Network (reposted by Zhongshan Court Network). Yin Mouzhen v. a Beijing Intelligent Technology Company et al., Personality Rights Dispute. March 20, 2025.

4. Supreme People's Court (reposted by Sina Finance). Reference Case Entered into the Database: Yin Mouzhen v. a Beijing Intelligent Technology Company et al., Personality Rights Dispute, database entry number 2025-07-2-474-001. March 20, 2025.

5. China Daily (reposted on the Beijing Internet Court English website). AI-generated voice mimicry infringes on rights. April 24, 2024.

6. China Daily (reposted on the Beijing Internet Court English website). Court hears nation's first AI voice rights case. December 13, 2023.

7. Zhang Xuehong. AI-Generated Voices Fall Within the Scope of Protection of Natural Persons' Voice Rights and Interests. Legal Daily, May 4, 2024, page 4.

8. Gazette of the Supreme People's Court. Civil Code of the People's Republic of China (continued). Publication date to be verified.

9. Xishu Zhifa · Law is the art of the rules of the game

10. Compiled and published by Scholay, the one-stop academic platform; if this infringes your rights, please let us know and it will be taken down.

11. Also published on EnterScholar, a community of scholars for the intelligent age

The Measures for the Administration of Personal Information Protection Compliance Audits (Cyberspace Administration of China Order No. 18) were promulgated on February 12, 2025 and took effect on May 1, 2025. The Measures and their annex, the Guidelines for Personal Information Protection Compliance Audits, set out detailed rules for Articles Fifty-Four and Sixty-Four of the Personal Information Protection Law. Processors must conduct audits regularly, and those processing the personal information of more than 1000 wan (ten million) individuals must do so at least once every two years. In three categories of circumstances, regulators may require processors to engage a professional institution to conduct an audit.

A server room at the European Organization for Nuclear Research (CERN), photographed on January 14, 2009. It is used only to illustrate a data-processing setting. Photo: Torkild Retvedt; source: Flickr; license: CC BY-SA 2.0.

Basis in Higher-Level Law and Scope of Application

Compliance audits are not a new obligation created by the Measures. Article Fifty-Four of the Personal Information Protection Law (adopted on August 20, 2021 and effective from November 1, 2021) provides that personal information processors shall regularly audit whether their processing of personal information complies with laws and administrative regulations. Article Sixty-Four applies where departments performing personal information protection duties find that processing activities carry relatively high risks or that a personal information security incident has occurred. In those cases, the departments may summon the processor's legal representative or principal person in charge for a regulatory interview, or require the processor to engage a professional institution to conduct a compliance audit. The processor shall then rectify as required and eliminate hidden risks. Article One of the Measures names the Personal Information Protection Law, the Regulations on Network Data Security Management and other laws and administrative regulations as its legal basis. The CAC's press release describes the Measures as providing detailed rules on how audits are conducted, how audit institutions are selected, how often audits take place, and what obligations processors and professional institutions bear.

Under Article Two, the Measures apply to personal information protection compliance audits carried out within the territory of the People's Republic of China. A compliance audit is defined as a supervisory activity that reviews and evaluates whether a personal information processor's processing activities comply with laws and administrative regulations. Article Nineteen excludes state organs and organizations authorized by laws and regulations to perform public-affairs management functions. The Measures were deliberated and adopted at the Cyberspace Administration of China's 15th office meeting of 2024 on May 20, 2024. They were promulgated on February 12, 2025 and published on the China Cyberspace website on February 14. Article Twenty provides that they take effect on May 1, 2025.

Exterior of the Great Hall of the People in Beijing. The Personal Information Protection Law was adopted by the Standing Committee of the National People's Congress on August 20, 2021. Photo: Arian Zwegers; source: Flickr; license: CC BY 2.0.

Self-Initiated Audits and Commissioned Audits

The Measures distinguish between two ways of initiating an audit. In the first, the processor initiates the audit itself. Article Three provides that audits are conducted regularly either by the processor's internal body or by a professional institution it engages. In other words, a self-initiated audit can still be carried out by an outside institution. Article Four provides that processors handling the personal information of more than 1000 wan (ten million) individuals shall conduct an audit at least once every two years. For processors below this scale, the Measures set no separate frequency. The “regularly” requirement in Article Three and in Article Fifty-Four of the Personal Information Protection Law applies instead. The official texts do not explain how the number of individuals is to be calculated or when the first two-year cycle begins.

In the second, the processor engages a professional institution at a regulator's request. Under Article Five, the national cyberspace authority and other departments performing personal information protection duties (collectively referred to in the Measures as “protection authorities”) may require a processor to engage a professional institution to conduct an audit in any of the following circumstances: they find that processing activities carry relatively high risks, such as seriously affecting individuals' rights and interests or seriously lacking security measures; processing activities may infringe the rights and interests of a large number of individuals; or a personal information security incident occurs that results in the leakage, tampering, loss or destruction of the personal information of 100 wan (one million) or more individuals or of the sensitive personal information of 10 wan (one hundred thousand) or more individuals. This requirement may not be imposed more than once for the same security incident or risk.

Processors required to undergo an audit must also fulfill a set of procedural obligations. They must provide necessary support to the professional institution and bear the audit costs (Article Eight). They must select a professional institution as the protection authority requires and complete the audit within the prescribed time, which may be reasonably extended with approval in complex cases (Article Nine). Once the audit is complete, they must submit an audit report signed by the professional institution's principal person in charge and by the person in charge of the compliance audit, and bearing the institution's official seal (Article Ten). They must also rectify as required and submit a report on the rectification within 15 working days after it is completed (Article Eleven). Whichever approach is used, Article Six requires reference to the annexed Guidelines for Personal Information Protection Compliance Audits.

Article Twelve assigns responsibility for audits within the organization. Processors handling the personal information of 100 wan (one million) or more individuals shall designate a person in charge of personal information protection to oversee compliance audit work. Processors that provide important internet platform services, have a very large number of users and operate complex types of business shall establish an independent body composed mainly of external members to supervise compliance audits. These two requirements connect, respectively, to Article Fifty-Two (person in charge of personal information protection) and Article Fifty-Eight (independent supervisory body for large platforms) of the Personal Information Protection Law. Articles Sixteen to Eighteen further cover supervision and inspection by the protection authorities and complaints and reports. They also provide that violations of the Measures are handled in accordance with the Personal Information Protection Law, the Regulations on Network Data Security Management and other laws and regulations.

Obligations of Professional Institutions

The Measures impose four sets of requirements on professional institutions that undertake audits. Article Seven requires them to have audit capability, with audit personnel, premises, facilities and funds commensurate with their services. It also encourages them to obtain certification, which is carried out in accordance with the Regulations of the People's Republic of China on Certification and Accreditation. Article Thirteen requires them to abide by laws and regulations, act with honesty and integrity, and make professional judgments fairly and objectively. They must keep confidential, in accordance with the law, any personal information, trade secrets and confidential business information obtained in performing their duties, and promptly delete the relevant information after the audit ends. Article Fourteen prohibits them from subcontracting audits to other institutions. Article Fifteen provides that the same professional institution and its affiliates, or the same person in charge of a compliance audit, may not audit the same audit subject three or more consecutive times.

After the Measures took effect, the CAC answered reporters' questions on implementation matters on May 27, 2025, and described the supporting arrangements. The Secretariat of the National Cybersecurity Standardization Technical Committee has issued the Cybersecurity Standard Practice Guide — Requirements for Personal Information Protection Compliance Audits, which standardizes the audit process, audit content and methods, audit evidence, working-paper templates and report templates. The CAC Data and Technology Support Center, the China Cybersecurity Review, Certification and Market Regulation Big Data Center, and Beijing CESI Certification Co., Ltd. (3 organizations in total) have filed their certification rules with the Certification and Accreditation Administration, and professional institutions may apply to them for certification. Audit personnel are divided into three levels, namely junior, intermediate and senior, and the Cyber Security Association of China has compiled key points for evaluating their competency. These are supporting documents, not provisions of the Measures themselves.

Key Items in the Audit Guidelines

The annexed Guidelines for Personal Information Protection Compliance Audits contain twenty-seven items in total, which list key review matters by processing stage. The items cover the legal basis for processing; processing rules and notification; joint processing; entrusted processing; transfers of personal information resulting from mergers, divisions and similar events; provision to other processors; automated decision-making; public disclosure of personal information; image collection and personal identification equipment in public places; processing of personal information that has already been made public; sensitive personal information; personal information of minors under the age of fourteen; provision outside the country; the right to deletion and the protection of other individual rights; internal management systems; security technical measures; education and training; performance of duties by the person in charge of personal information protection; personal information protection impact assessments; and security incident contingency plans and emergency response. The last two items concern platform rules and personal information protection social responsibility reports for large platforms. Item fifteen sets numerical thresholds for cross-border provision. For example, if a processor other than a critical information infrastructure operator has, since January 1 of the current year, cumulatively provided outside the country the personal information (excluding sensitive personal information) of 100 wan (one million) or more individuals, or the sensitive personal information of 1 wan (ten thousand) or more individuals, the audit examines whether the processor has passed a security assessment organized by the national cyberspace authority.

The item most directly relevant to AI applications is item nine, “Use of automated decision-making to process personal information,” which contains seven review points: the transparency of automated decision-making and whether its results are fair and just; whether the processor notified individuals in advance of the types of personal information processed and the possible impacts; whether a personal information protection impact assessment was conducted in advance; whether safeguard mechanisms allow individuals to refuse, through convenient means, decisions made through automated decision-making that significantly affect their rights and interests, and to require the processor to explain them; whether information push services and commercial marketing also offer options not targeted at personal characteristics, or a convenient way to refuse; whether effective measures are taken to prevent unreasonable differential treatment in transaction terms based on consumers' preferences, transaction habits and similar factors; and other matters that may affect transparency or the fairness and justice of results. These review points correspond mainly to Article Twenty-Four of the Personal Information Protection Law. They also relate to Article Fifty-Five, which lists “using personal information for automated decision-making” among the circumstances that require a prior impact assessment. Article Seventy-Three of the same law defines automated decision-making as the activity of using computer programs to automatically analyze and assess an individual's behavioral habits, hobbies and interests, or economic, health or credit status and the like, and to make decisions.

In terms of structure, the Measures themselves contain only twenty articles. They mainly address who conducts audits, how often audits are conducted and how audit institutions perform their duties. The question of “what to audit” is addressed mainly in the annexed Guidelines. Most review points in the Guidelines correspond to provisions of the Personal Information Protection Law, so the Guidelines read more like existing obligations rewritten as an audit checklist. The specific audit procedures and evidence requirements are set out in the practice guide mentioned above. This account of how the provisions relate to one another is the author's own analysis.

References

1. Cyberspace Administration of China: Measures for the Administration of Personal Information Protection Compliance Audits (Cyberspace Administration of China Order No. 18), promulgated on February 12, 2025, published on the China Cyberspace website on February 14, 2025, effective from May 1, 2025.

2. China Cyberspace website: Cyberspace Administration of China Promulgates the Measures for the Administration of Personal Information Protection Compliance Audits, February 14, 2025.

3. China Cyberspace website: Answers to Reporters' Questions on Matters Concerning the Implementation of the Measures for the Administration of Personal Information Protection Compliance Audits, May 27, 2025.

4. Standing Committee of the National People's Congress: Personal Information Protection Law of the People's Republic of China, adopted on August 20, 2021, effective from November 1, 2021.

5. Xishu Zhifa · Law is the art of the rules of the game

6. This information was compiled and published by Scholay, a one-stop academic platform. If it infringes any rights, please let us know and it will be taken down.

7. Also published on Enter Scholar, a community for scholars in the age of intelligence