Generative AI, Copyright and Training Data Checkpoints: Practical Issues for Developers and Users
Hello, I'm Noriaki Asato, Representative Attorney at LegalAgent.
"Japan's Copyright Act has a provision permitting AI training, so any data can be used freely as long as it is for training." When advising on generative AI and copyright, I sometimes come across this understanding. It is true that Japan's Copyright Act contains a limitation on rights permitting uses for purposes such as information analysis, and there is room for the use of copyrighted works to be permitted under certain conditions. However, it is premature to leap from there to "anything goes as long as it is AI training." The legal issues and contractual constraints to be considered differ at each stage: the training stage, the model provision stage, the output generation stage and the output use stage.
The questions we actually receive also divide according to the stage of use. "May we use text and images on the internet to train our own model?" is a matter for the training stage, while "May we use illustrations and text created by AI on product packaging or in advertising?" and "Who is responsible if an output closely resembles another company's work?" are matters for the output use stage. Even within the same use of generative AI, the statutory provisions to refer to and the contract clauses to check are different.
The areas of law to be considered are not limited to the Copyright Act either. The terms of use of data sources, non-disclosure agreements, the Act on the Protection of Personal Information (APPI), and the protection of portrait rights and publicity rights are also intertwined. Because official views and court decisions can change the information needed for a judgment, the basic approach is for companies to make their judgments at the point when they actually use AI, in light of the latest official views and practice.
The Difference Between the Training Stage and the Output Use Stage
Copyright issues surrounding generative AI broadly fall into two categories: "use of training data" and "use of generated outputs."
Use of training data refers to using materials such as text, images and program code for pre-training or fine-tuning AI models, evaluating models, adjusting prompts and the like. Article 30-4 of Japan's Copyright Act permits use to the extent deemed necessary where there is no purpose of personally enjoying, or causing another person to enjoy, the thoughts or sentiments expressed in the work. However, whether the purpose and manner of use satisfy those requirements, and whether the proviso "where it would unreasonably prejudice the interests of the copyright owner" applies, are judged case by case. The provision may not apply where an intention to enjoy the work coexists, and input into RAG (retrieval-augmented generation) or prompts is not automatically regarded as lawful.
Use of outputs, on the other hand, means adopting text, images, code and other materials generated by AI in the company's own business or in publications released externally. At this stage, the questions are whether the output is similar to the creative expression in an existing work, and whether it was created in reliance on the existing work. Merely entering a specific author's name or character name in a prompt does not automatically establish infringement, and mere similarity in style or ideas does not immediately constitute infringement. The question is examined based on the specific circumstances, such as what instructions and materials the user provided and through what process the output was obtained.
In practice, moreover, the contractual framework of each service's terms of use is added on top of what the law permits. Whether input data is diverted to the vendor's training, whether opting out of training is possible, to whom rights in generated materials belong, and whether indemnification is available if a third party issues an infringement warning, are set out differently for each service. "Is it permitted by law?", "Is it allowed under the contract?", "Can we explain it to business partners and customers?" and "Is it acceptable as a business risk?" are separate questions, and it is essential to check them separately.
Distinguishing Data You Have from Data You May Use
Precisely because the success of AI use depends on the quality and quantity of data, friction over rights tends to arise.
Feeding past internal knowledge, contracts and development materials into AI can sometimes improve productivity. However, if that data includes third-party copyrighted works or confidential information disclosed by business partners, there may be rights-based or contractual restrictions on training and reuse. Even information that can be viewed publicly on the internet does not justify ignoring a site's terms of use or technical restrictions, and if materials entrusted by customers are put into the company's own AI training simply because they are on hand, this may constitute use outside the contractual purpose or a breach of confidentiality obligations. The data that exists on hand and the data that may be fed into AI are two different things.
Similar care is needed on the output side. AI tools sometimes output expression extremely close to existing works. The fact that a tool permits commercial use of generated materials does not guarantee that they do not infringe existing third-party copyrights. Nor does copyright automatically arise in every output generated by AI.
If a company bans AI entirely out of fear of risk, staff may start using it secretly on personal accounts, which can actually make the company's actual usage invisible. Conversely, if it is left to the discretion of staff, data with uncertain rights clearance may end up being used in publications. The need for clear rules suited to each stage of training data, input data and outputs stems from the aim of avoiding these two extreme failures.
Steps from Classifying Data to Internal Review
In practice, checks begin with classifying the data to be used. Organize it into categories such as data created by the company itself, data received from customers, data on the public web and datasets purchased from outside. If everything is treated simply as "data," materials subject to different rights constraints get mixed together and proper checks cannot be made.
Next, check how the data was obtained and the conditions of use. Confirm the route by which it was acquired and whether the terms of use or license provisions restrict commercial use.
Then identify the purpose for which the data will be used. The nature of the risk changes depending on whether it will be used to train the foundation model itself, incorporated into RAG for internal search, used to summarize particular documents, or merely referred to temporarily within a prompt. When sending customer information or confidential materials to an external AI service, check whether the provider stores the data or uses it to improve its models.
Prepare in advance for the aftermath of receiving an infringement claim. Determine whether the terms of use contain an indemnity clause and its conditions of application, procedures for promptly stopping use of and deleting problematic outputs, and a policy for recording prompts and the generation process. If no records remain at all, it will be difficult to explain internally and externally how a work was created.
At the same time, put in place employee training and a review system before publication. Use concrete examples to make staff aware that they should not casually use expression closely resembling famous characters, other companies' trademarks, existing brand copy or third-party source code. In particular, for outputs with a large external impact, such as advertising, logos, taglines and code built into products, setting up a process in which the legal, IP, public relations and business divisions check them in advance increases effectiveness.
How Risks Differ Depending on Your Position in the Transaction
For an AI developer, the central checkpoint is to accurately understand the sources and license terms of training datasets and the rights status of evaluation data. Be prepared to show concretely, for each dataset, the conditions of acquisition and the reasons for your judgment when investors or partners ask for the basis of legality.
For an AI provider, it is essential to set out clearly in the service's terms of use whether input data is used for training and whether opting out is possible, the retention period for input data and logs, to whom rights in generated materials belong, and the scope of indemnification against third-party infringement claims. If the service is provided while these points remain vague, explanations given during sales may contradict the terms of use, which can develop into secondary disputes with user companies over where responsibility lies.
For an AI user, in addition to internal rules, check the purpose of use and confidentiality obligations in contracts relating to customer materials and manuscripts from outside writers, and thoroughly follow a procedure for checking whether outputs resemble other companies' existing works when using them in advertising, product UIs or materials for customers.
Transactions involving outsourcing also require careful arrangements. Where a production company or writer uses AI to create deliverables, the ordering party will want the contract to settle whether AI may be used, to whom rights in generated materials belong, and how liability is allocated in the event of infringement. For the contractor as well, there is practical benefit in clarifying in the contract in advance the permitted scope of use and review procedures, so that production work is not held up by excessive prohibitions.
Making Judgments Based on the Specific Use
AI is useful for the initial step of picking out clauses on training use, outputs and cross-border transfers from terms of use and listing the items to check. When reaching a conclusion on copyright, however, do not rely on its answer alone; a person checks the creative expression, similarity, reliance and actual production process of the images or text concerned.
Answering only "can it be used or not" overlooks the conditions under which it can be used and the alternatives. Break down which data, for what purpose, is put into which environment and how far the outputs are used, and reflect this in contracts, internal policies, production procedures and explanations to customers.
The legal framework and interpretations concerning generative AI and copyright should be monitored continuously, including the Agency for Cultural Affairs' study materials and court decisions in Japan and abroad. Even when referring to answers from AI tools, make individual judgments by comparing your company's actual usage with the latest official views.
At LegalAgent, we go beyond one-off legality assessments and support the organization of practice within the following frameworks, linked with day-to-day contract review and the preparation of internal rules.
Services connected to this topic