Intellectual-property governance for AI-enabled work

Define the output and rights question

Start with the artifact being created: an internal summary, software code, marketing image, product concept, research synthesis, or client deliverable. Ask which materials entered the workflow, what the AI did, what people added, where the result will be used, and what consequence follows from an incorrect rights assumption.

Separate different questions. Permission to access material is not necessarily permission to reuse it. Ownership, infringement, confidentiality, contractual restrictions, attribution, trademark, patent, database rights, and model-service terms may require different evidence and expertise. Applicable law varies by jurisdiction and context.

The World Intellectual Property Organization publication Generative AI: Navigating Intellectual Property provides guiding principles and a checklist for organizations adopting generative AI. It is educational guidance, not a legal determination for a particular output.

Sources: [1]

Build the IP provenance envelope

Create one entry per material source. Record the title or system, owner where known, acquisition route, license or permission basis, confidentiality status, version, access date, extracted portion, transformation, and intended use. Add the model or service used, relevant account or plan, retention setting where verified, and applicable contractual terms.

For the output, record human edits, factual verification, similarity or code-origin checks appropriate to the medium, attribution decisions, restricted elements, and unresolved issues. Link to governed evidence rather than copying confidential material into the envelope. Define who may approve internal use, external publication, client delivery, or commercial reuse.

The NIST AI RMF Core includes third-party software, data, supply-chain, and infringement risks within mapping and governance. The framework is voluntary and does not replace jurisdiction-specific legal review.

Sources: [2]

Worked artifact: a synthetic campaign illustration

Imagine a synthetic marketing team creating an event illustration with a generative tool. The prompt references the event theme and brand palette, while a designer uploads two licensed internal photographs and a mood board containing third-party images of unclear status.

The provenance envelope identifies the internal photographs and their limited campaign license, flags the mood-board items as reference-only, records the tool account and terms reviewed on the access date, and stores the generated candidates. The designer selects one candidate, redraws several elements, and removes a mark resembling a third-party logo.

Before external release, the reviewer finds that one uploaded photograph permits editorial use but not advertising. The team removes that source, regenerates the composition, and retains the original and replacement lineage. The envelope records the failed disposition rather than describing the final image as automatically clear of rights risk.

The release authority approves the revised campaign for the specified channel and period only. Reuse in product packaging requires a new review. The example is synthetic and does not establish that any particular generation, edit, or check is legally sufficient.

Route uncertainty instead of inventing certainty

Define triggers for specialist review: unclear source ownership, confidential inputs, client-owned materials, distinctive characters or marks, substantial code, patent-sensitive concepts, high-value commercial release, or conflicting contract terms. Preserve the question and affected material until resolved.

Do not ask a model to decide whether its own output infringes rights. It may help organize the evidence or identify questions, but the conclusion needs authoritative sources and accountable human judgment. Likewise, absence of an obvious match does not establish freedom to operate.

Verify the envelope against the actual workflow

Sample released outputs and trace them back to inputs, permissions, tool configuration, edits, and approval. Check whether users bypass approved tools, paste material from personal accounts, or omit sources that were visible only during browsing. Test whether a release can be stopped when evidence is incomplete.

Reopen review after changes to source material, intended use, model, provider terms, account configuration, jurisdiction, or distribution channel. Retain version history so later reviewers can distinguish the approved artifact from subsequent edits.

This method makes provenance and decision ownership visible. It does not provide legal advice, establish ownership, or certify that an output is non-infringing. Two Prune can observe evidence navigation and risk judgment in controlled simulations; it does not clear customer intellectual property.