Searching Internal Documents with RAG: How Copyright Risk Changes with the Type of Material

Hello, I'm Noriaki Asato, Representative Attorney at LegalAgent.

When you have AI search your company's internal knowledge, what you need to check depends on the materials you feed into it. Whether the search targets daily reports and meeting minutes your company wrote, commercially available professional books you purchased, or proposals sent by business partners makes a major difference to how the use is positioned under the Copyright Act. When introducing RAG (retrieval-augmented generation), it is important to start by sorting the materials you have on hand before rushing to select a tool.

RAG is a mechanism in which, when a generative AI answers a question, it searches a prepared database for relevant passages and constructs its answer based on that context. If you put internal rules, contract templates, purchased books and the like into the database, the AI can answer questions about the latest internal information it was never trained on, while showing the sources it referred to. However, problems such as missed hits during retrieval, outdated information, incorrect summaries and mismatched sources persist, so introducing RAG does not necessarily guarantee accurate answers. And behind the convenience, the basic rules of copyright law on how others' works are copied and used are always in play.

The Processing Flow and the Rights Involved in Building the Database

The legal analysis of RAG becomes clearer when divided into three stages following the flow of data. For example, in a RAG system that uses vector search, the first stage converts the text of contracts, meeting minutes, books and web articles into numerical data and stores it in a search database. Because this process temporarily reproduces the original text, the question arises whether it constitutes "reproduction" under the Copyright Act. The second stage searches the database in response to a user's question, extracts the passages that match, and incorporates them into the input (prompt) to the generative AI. The third stage is where the AI reads the search results, generates an answer and presents it to the user; the point to look at is how much of the original material's expression is output as is. The database-building stage is treated as an act of reproduction, and the answer-output stage as a question of using generated output, and the applicable provisions are checked in line with the specific operations and purpose of each stage.

First, at the database-building stage, Article 30-4 of the Copyright Act is relevant. This provision states that where the purpose is not to enjoy, or have others enjoy, the thoughts or sentiments expressed in a work (enjoyment), the work may be used to the extent necessary, and information analysis under Item 2 of that Article is a representative example. The Agency for Cultural Affairs' "General Understanding on AI and Copyright" (Japanese), published on March 15, 2024, organizes the relationship between generative AI and copyright into the "development and training stage" and the "generation and use stage," and includes a separate explanatory item on RAG. That document points out that reproduction and other uses of works can occur in the course of creating a database in which the content of works contained in existing databases or on the internet is converted into vectors.

On that basis, the Agency for Cultural Affairs takes the position that where reproduction and other uses in creating such a database are not for the purpose of outputting the creative expression of the work at the time an answer is generated, Article 30-4 may apply as a use without the purpose of enjoyment. Conversely, if the purpose is to output all or part of the creative expression of existing works at the time of generation, that Article does not apply. Even for a search database, the purpose of use is checked based on the actual circumstances. If, in addition to the purpose of information analysis, there is also a purpose of letting people enjoy creative expression, the use falls outside the provision. It should also be kept in mind that even with a non-enjoyment purpose, use that exceeds the extent necessary in light of the purpose, or use that unreasonably prejudices the interests of the copyright holder, is not permitted.

Requirements for Minor Use at the Output Stage and Preventing the Original Text from Slipping In

Even where Article 30-4 does not apply, for example because the original creative expression is reflected at the answer-output stage, the Agency for Cultural Affairs' view is that Article 47-5, Paragraph 1, Item 1 or 2 of the Copyright Act may apply. Article 47-5 permits uses incidental to acts that create new knowledge or information through computer information processing, such as providing search results or providing the results of information analysis.

However, use under Article 47-5, Paragraph 1 is limited to use that is minor in light of the proportion and volume of the portion of the work used, the precision of its display and similar factors (minor use). In addition, it must be carried out "incidentally" to the acts listed in each Item. Where the main purpose is to provide the creative expression of the original work itself, the use falls outside the limitation on rights. Under the Agency for Cultural Affairs' framework as well, Article 47-5, Paragraph 1 does not apply to use that exceeds the limits of minor use, and it becomes necessary to consider obtaining the copyright holder's permission or whether another limitation on rights, such as quotation, applies. Even if it takes the form of a summary, a summary whose main purpose is to provide creative expression is not covered. Further prerequisites are that the work in question has been made public or made available for transmission, that the implementation standards set by Cabinet Order are met, and that the use is kept within the extent necessary for the purpose. Use with knowledge that the work has been made available to the public in infringement of copyright, and use that unreasonably prejudices the interests of the rights holder, are excluded.

In addition, reproduction and public transmission in creating the database could fall under the limitation on rights as preparatory acts provided for in Article 47-5, Paragraph 2. Here too, however, the basic premise is that the use falls within the scope of that Paragraph, meets the implementation standards, and is carried out to the extent necessary to prepare for lawful minor use. Preparatory acts are also subject to limits on their subject matter and scope, and cases that unreasonably prejudice the interests of the rights holder are excluded.

In actual operation, even if you think you have instructed the AI to summarize, the answer may output the text of the original material almost verbatim. A simple standard such as "it's fine as long as it is not a word-for-word match" does not hold. Because copyright infringement can become an issue if creative expression substantially remains, it is important to check case by case whether the use stays within the bounds of minor use, in terms of the proportion used, the volume and the precision of display. As practical measures, design approaches such as having the AI summarize rather than pasting the retrieved original text directly, making it possible to log the sources and the volume of output, and stopping display when output of the original text exceeds a set limit and then confirming permission or the legal basis for use can be considered. That said, there is no common safe standard such as "it's lawful within a certain number of characters." Including cases where the original text could be reconstructed by repeating small excerpts, the company should check against the cumulative volume of output and the original purpose of use.

Checking Rights According to the Type of Material Fed In

Materials fed into RAG are treated differently in law depending on their source. First, even for materials created in-house, check whether the company has legitimate copyright or authority to use them. For documents written by employees, check whether they meet the requirements for works made for hire under Article 15 of the Copyright Act; for deliverables commissioned from outside parties, check how rights were handled in the service agreement. If the company has the necessary authority and the document does not contain anyone else's creative expression, there is no need to obtain additional permission from third parties regarding the copyright in that document. Confidentiality and personal information should be checked separately. However, if the materials include records of discussions with business partners or revised drafts received from the other party, they carry the same issues as materials provided by other companies.

Purchased books and practical guides are works in which third parties hold the rights. Scanning a whole book into a database and having it output chapter by chapter is a typical example of use that easily exceeds the bounds of minor use. Even tables of contents and headings are protected if they are creative, so a standard such as "item names and headings can be used freely" cannot be relied on. The text of statutes itself is not protected under Article 13 of the Copyright Act, but the commentary in practical guides is protected. Even a summary raises copyright issues if the original creative expression remains, so the requirements of Articles 30-4 and 47-5 must be checked. The safe approach is to confirm the rights for each book and then check each use according to the volume used and the degree to which it is reflected in the output. The same applies to web articles: even public information that anyone can view is still a copyrighted work, and many sites restrict scraping and secondary use in their terms of use, so it is essential to check the lawfulness of how the material was obtained and the scope of what is stored. Whether a website's terms of use have formed a contract, and whether its provisions are valid, are issues to be assessed separately. Even where a website displays a prohibition on AI use, this should be distinguished as a contractual matter, and the application of Article 30-4 should be determined in light of each of its requirements.

Proposals and quotations received from other companies involve not only copyright but also contractual confidentiality obligations and restrictions on use for other purposes. Feeding a business partner's materials into your own RAG and reusing them to consider other matters or for everyday searches can be a breach of contract even if the copyright analysis is clear. You need to check the contractual terms agreed when you received the materials. When handling documents that contain personal information, also check issues under the Act on the Protection of Personal Information (APPI), such as specifying the purpose of use, supervising contractors, and restrictions on provision to third parties in foreign countries. Access controls should also be built into the design so that confidential information is not disclosed to internal users without authorization.

Risks of Internal Use and of Providing External Services

Even with the same RAG system, risk manifests differently depending on whether it is operated as a search tool used only by internal employees or provided as a service to customers. Even for internal use, check the actual processing steps, including reproduction and provision to employees and transmission of data to external AI services. As long as the system is used as part of the company's business, it does not fall under the exception in Article 30 of the Copyright Act permitting private use by individuals. Nor is the reasoning that "internal use carries a low risk of becoming known outside" a basis for legal exemption. That said, neither Article 30-4 nor Article 47-5 contains wording that makes "being limited to internal use" an independent requirement, and the basic framework of judging based on the purpose and manner of use does not itself change between internal and external use.

When providing a service externally, if answers to customers include third-party works beyond the bounds of minor use, claims for injunctions or damages against the service provider can become an issue, depending on who is regarded as the user, the degree of involvement and other factors. Furthermore, when adding purchased books or materials provided by other companies to the search targets, you must check whether their licenses are limited to internal use. Incorporating materials licensed on the premise of personal or internal use into the database of a service for the general public raises breach of contract issues separate from copyright infringement. For external provision, the review should extend to the contractual terms and the allocation of responsibility for output. Even if disclaimers or indemnities have been agreed with users, this does not extinguish third-party copyrights or make infringing acts lawful.

The first practical task for the person considering introducing RAG is to sort the materials planned for input into four types: "created in-house," "purchased materials," "web-sourced," and "provided by other companies." If you skip this sorting and start from the idea of "loading all internal knowledge wholesale," you will later have to carve out and revisit just the treatment of purchased books and other companies' materials, which doubles the work. After sorting, check the terms of use and license conditions for purchased and web materials, and for materials provided by other companies, check the contracts in place at the time of receipt for confidentiality clauses and restrictions on use for other purposes. The output design, such as whether search results will be summarized for output and how much of the original text will be displayed, also needs to be decided jointly by the developers and the legal team from an early stage. Because the assessment of minor use depends on the volume of output and the precision of display, the system's output specifications themselves bear directly on the legal assessment. If there are future plans to offer the system as an external service, it is desirable to confirm, from the stage of internal-only trial operation, whether the license terms of the data providers can be switched to terms that also accommodate external provision. If you try to switch later and find that the license at purchase was limited to internal use, changes to design and operation, such as obtaining additional permissions or excluding the affected materials, may become necessary.

Considering the handling of internal knowledge like this together with the design of information management makes it easier to avoid rework. Please also refer to Organizing Knowledge Management and Generative AI, Copyright and Training Data.

Frequently asked questions

Is storing internal documents in a RAG database permitted under the Copyright Act?

It is thought that Article 30-4 of the Copyright Act may apply as a use without the purpose of enjoyment. Reproduction and similar acts accompanying the creation of a database that is not intended to output the creative expression of the work when generating answers can be carried out under that provision without the right holder's permission. However, use with the purpose of outputting creative expression, use exceeding the extent necessary, and use that unreasonably prejudices the interests of the right holder are not permitted.

Is use permitted even if the RAG system's generated answers include expression from the original works?

It is understood that this may be permitted if it qualifies as minor use under Article 47-5, Paragraph 1 of the Copyright Act. The use must be incidental to the creation of new knowledge through computer information processing and must remain minor in light of the proportion and volume of the portion used and the precision of its display. Where the main purpose is to provide the creative expression itself, or the use exceeds the limits of minor use, it falls outside the scope of the limitation on rights.

Is a RAG system used only for internal business exempt as private use under the Copyright Act?

It is unlikely to qualify for the private use exception. As long as it is used for the company's business, it does not fall within the exception under Article 30 of the Copyright Act, which permits private use by individuals. Even for internal use, the processing steps must be checked, including transmission of data to external AI services and provision to employees, and the reasoning that internal use carries a low risk of becoming known externally is not a basis for legal exemption.