Copyright and AI: Current EU Legal Framework and Exceptions

The conceptual foundations of copyright law in the EU have been discussed across various sources.¹,² This emerged from a long-term harmonisation and modernisation project to reform copyright law, culminating in the ECJ now playing a major role.³ The evolution of EU digital policy towards the EU Digital Single Market has also been discussed at length.⁴

Copyright grants persons exclusive rights over creative works, and may refer to almost any output or work produced by a creator, including text, music, film or book. Source code is similarly recognised in the EU as copyright protected.⁵

The current EU legal framework for copyright and related rights consists of a combination of regulations and over a dozen directives, including protections for computer programs (Directive 2009/24/EC) and databases (Directive 96/9/EC) (creating sui generis database rights to protect against extraction of substantial parts of databases). The Database Directive provides both copyright protection for the original arrangement of data and a sui generis right for substantial investment in databases, though this does not extend to the individual data elements themselves. The InfoSoc Directive (Directive 2001/29/EC) harmonises key rights and exceptions, establishing a closed list of exceptions to copyright infringement (e.g. quotation, teaching, parody). Article 2 of the InfoSoc Directive establishes an exclusive reproduction right for copyright holders, which grants to authors, performers, phonogram producers, film producers and broadcasting organisations, complete control to authorise, prohibit, license or refuse reproduction of their works.

The Digital Single Market (DSM) Directive (Directive (EU) 2019/790) was adopted in 2019 and applied from June 2021, as a further step and exists alongside pre-existing acquis.⁶ It modernised rules for platforms, news publishers, text and data mining. It alone has no specific focus on the AI sector, but was intended to make EU copyright law “fit for the digital age.”⁷ Importantly it contains the text and data mining exceptions which have become important for AI developers. Article 3 was a specific mandatory exception introduced to exempt acts of reproduction of copyrighted subject matter and extraction for the sui generis database right, made by research organisations in order to carry out text and data mining for scientific research purposes.⁸ Article 4 mirrored Article 3, but differed in that it was available to any beneficiary for any type of use, however, was subject to an express reservation of rightholders (through an opt-out or contract-out).⁹

The DSM Directive defines TDM very broadly as "any automated analytical technique aiming to analyse text and data in digital form to generate information such as patterns, trends and correlations."¹⁰ This definition is argued to be future-proof, capturing and regulating most areas of modern data-driven AI applications relying on machine learning (ML), such as natural language processing, image recognition, content filtering, and robotics.¹¹ Prior to the introduction of Articles 3 and 4, a number of EU Member States had already legislated and introduced their own TDM exceptions, using as a legislative basis the research exception or limitation in the InfoSoc Directive 2001/29.¹²

The EU AI Act was adopted in 2024 and entered into force on 1 August 2024. It contains provisions related to copyright, including Article 53(1) which requires developers of general-purpose AI and foundation models to disclose the training data sources and to verify that any copyright-protected content has been used in accordance with EU law. Notably Article 53(1)(c) of the AI Act requires AI providers to observe the reservation of rights under Article 4(3) of the DSM Directive when performing AI training. Recital 106 expands the scope of application to training outside the EU. Article 53(1)(d) of the AI Act states that certain transparency provisions must be observed by AI providers to the effect that they must disclose the works they have used for their training. Recital 106 also draws a direct link to the copyright rules in the DSM Directive, which requires developers of general-purpose AI models to comply with Article 4(3) of the DSM Directive.¹³

The EU's copyright harmonisation project exemplifies the fundamental tension between subsidiarity and internal market objectives within European constitutional architecture. Beginning with sector-specific directives as listed above in the 1990s and culminating in the DSM Directive (2019), harmonisation efforts have achieved only partial convergence due to persistent jurisdictional variations rooted in constitutional traditions—Germany's strong “Urheberpersönlichkeitsrechte” and France's “droit d'auteur” emphasis on creator personality are some examples.

The Charter of Fundamental Rights (Articles 11, 13, 17 CFEU) constrains reform options by requiring constitutional balance between copyright as property, freedom of expression, and artistic/scientific freedom, while Article 167 TFEU's cultural competence reservation protects Member State diversity in author protection approaches.

These constitutional limits preclude radical reforms like wholesale moral rights elimination or broad fair use adoption, as demonstrated by the AI Act's Article 53 provisions, which mandate transparency about training data without harmonising underlying exceptions, creating a patchwork of opt-out mechanisms that undermines Digital Single Market objectives while respecting the proportionality principle and institutional competence boundaries that define EU copyright law's evolutionary constraints.

As is relevant to AI in the EU, the notion of the authors intellectual creation and issues around reproduction of copyrighted works must be considered. These are key concepts as enforcement of copyright protection requires rights holders to establish that a work is in fact a product of the creator’s own free and creative choices and intellectual effort and reproduction of works.

In the EU, copyright exists when it passes a test of the ‘author’s own intellectual creation’, as developed by the ECJ decisions in Infopaq I and Infopaq II. The ECJ confirmed copyright exists even in very small excerpts of text (there, 11 words), if they constituted the ‘author’s own intellectual creation’. This required identifiable human authorship and could not be purely mechanical or automatic reproduction, involving intellectual effort or creativity and going beyond mere physical or mechanical labour, with creative decision-making. It required the ‘free and creative choices’ of the author and expression of the author’s personality through creative decisions in selecting, arranging or expressing.¹⁴

AI-generated outputs may be achieved in various forms. Most AI systems allow for such generation from one or more inputs, for example, text, images, audio, video or a combination of these media. Users (both human and autonomous) ‘prompt’ the AI model, with these inputs, which communicates the desired features of the output. The AI system then responds to these inputs by generating an output in the requested format (text, image, audio, video). Prompts typically describe a topic, theme, and/or subject that the user seeks to evoke, and may include the overall style, tone, and/or visual technique. Users may enter a prompt a single time or iteratively, refining it until the system generates an acceptable output. Prompts can also be automatically optimised or generated by generative AI. The use of autonomous AI ‘agents’ are one example where a generative AI system may create its own prompt for another generative AI system to produce an output. This typically involves no human actor during this intermediate step.

There is yet to be an EU case on whether purely AI-generated outputs are an author’s own intellectual creation. It is becoming standard practice that users are considered the rights holder of the AI outputs, save for any uses the AI developer may reserve to improve its software through further model training with user data.¹⁵ A US District Court considered this in the context of the US approach of ‘human authorship’.¹⁶ In that context the court confirmed that “human authorship is a bedrock requirement of copyright.”¹⁷

What is necessary to assess is the degree of human interaction in producing the AI model output. It is perceivable where there is a degree of human interaction, requiring creativity or intellectual effort, that an output may possibly fall within copyright protection for reasons it involved the author’s own intellectual creation.

AI has been claimed to regurgitate or memorise copyrighted works, and reproduce these as an AI output. This is a phenomenon arising from the model training process, where, given the right prompt, the AI model would output large portions of materials they were trained on.¹⁸ As discussed above, direct reproduction may violate Article 2 of the InfoSoc Directive. This was a question raised in the New York Times v OpenAI case before the US District Court, where the New York Times argued that OpenAI’s GPT LLMs had memorised copies of copyrighted works of the New York Times.¹⁹

More nuanced however, is style mimicry, where AI systems reproduce an author's distinctive creative choices without literal copying. Earlier this year, the Internet saw a flood of ’Studio Ghibli’-styled images produced with ChatGPT’s image generation functions. Users could upload images with an associated prompt like “turn it into a Studio Ghibli image”, which would return the image in (arguably) a distinctive style and creative choices of well-known Studio Ghibli films.²⁰ Increasingly popular are image generation techniques where such as generative adversarial networks (GAN) or fine-tuning of models through Low-Rank Adaptation (LoRA). Both techniques enable AI systems to systematically reproduce distinctive artistic elements that may constitute protected creative expression under EU copyright law.

In the context of photography, the CJEU in Painer clarified that intellectual creation is the author’s own “if it reflects the author’s personality” and that this is the case “if the author was able to express his creative abilities in the production of the work by making free and creative choices”.²¹ This was reiterated in the Football Dataco case, which confirmed that for an intellectual creation to be original, the author must have stamped it with his personal touch by making “free and creative choices” during its production.²²

EU copyright law operates under a closed list of exceptions and limitations to copyright, established primarily in the InfoSoc Directive and updated by the DSM Directive. The most relevant exceptions for AI are the text and data mining provisions in Articles 3 and 4 of the DSM Directive, which emerged in 2019.²³ In these Articles, two exceptions were recognised, namely, TDM for the purposes of scientific research,²⁴ and a general exception for TDM, subject to an ‘opt-out’ mechanism.²⁵

The TDM exceptions create a two-tiered system: firstly, a mandatory exception for research organisations and cultural heritage institutions for scientific research purposes, which rights holders cannot override. Secondly, a general exception for anyone, including commercial entities, subject to an ‘opt-out’ mechanism, where rights holders can expressly reserve their rights. For online content, reservation must be through machine-readable means, including metadata and terms and conditions of websites. Persons relying on the general exception must therefore have lawful access to the content.

The EU AI Act extends the application of the TDM exceptions to general-purpose AI model providers. By August 2025, GPAI providers must have implemented policies that identify and comply with TDM opt-outs.²⁶ Secondly, providers must disclose summaries of the content used to train their AI models, by a template issued by the European AI Office.²⁷

Several cases in the EU have offered insight as to what constitutes ‘machine-readable’, though it is yet to be concrete on its precise requirements. In 2023, the Hamburg District Court, in obiter, interpreted 'machine readable' and found that natural language reservations in website terms and conditions can qualify as "machine-readable," which is inconsistent with how the term has been defined in other EU legislation but is consistent with the non-legally binding Recitals to the DSM Directive.²⁸ In 2024, the Amsterdam District Court held that prohibitions on automated searches which only excluded specific AI bots (like GPTBot, ChatGPT-User, CCBOT, and anthropic-ai) did not constitute a rights reservation "in machine-readable means in an appropriate manner".²⁹

As a comment, AI companies have claimed the non-application or the limitation of TDM exceptions as a source of uncertainty and risk for European AI innovation.³⁰ This view has been noted by commentators as well, that if the TDM exception is not applied to AI training, AI innovation in Europe may stumble and fall even further behind in the global competition with countries that have more “liberal” copyright laws.³¹