My AI copied someone else's work. Is my business covered?

Start with who gets the letter

Operators tend to frame this question as a liability question when the first thing that matters is a much simpler one: who is visible. A rights holder monitoring for reuse of their catalogue does not see your model provider. They see your website, your brochure, your product listing, your published report with your logo on it. You are the party using the material commercially, and you are the party they can identify, so you are the party who receives the letter.

That matters because the cost of an infringement claim for a small business is very rarely the eventual judgment. It is the legal fees spent establishing that there is no case, the takedown and reprint of material already in circulation, and the time of whoever in your business has to manage it. Those costs land immediately and they land whether or not the claim was ever going to succeed. This is the same pattern we described in what an AI agent mistake actually costs a small business, and it is why the cover question is worth answering before the letter rather than after.

Intent is the second thing operators get wrong. In the United Kingdom, in the Netherlands, and across the European Union, primary copyright infringement is generally established without the claimant having to prove that you meant to copy. Your state of mind can matter to remedies, and it can matter to whether additional or flagrancy damages are available. It does not usually get you out of the claim itself. The sentence "we did not know, the AI produced it" is a true sentence that resolves less than it feels like it should.

Three policies, three different shapes of gap

An intellectual property claim arising from AI output can plausibly be pointed at three policies in a normal SME programme. Each of them has a specific reason for stopping short.

General liability, and the word "advertisement"

Most commercial general liability wordings contain a personal and advertising injury section, and most of those sections list infringement of copyright, trade dress or slogan as a covered offence. Read the qualifier that follows. In the common market forms, the offence is infringement in your advertisement. That phrase is doing an enormous amount of work.

If an AI tool wrote the copy on your own landing page and that copy reproduces someone else's protected text, you are arguably inside the section. If the same tool wrote a market report you delivered to a paying client, you are outside it, because a client deliverable is not your advertisement. If it generated an image that ships inside your product, you are outside it. If it wrote code now embedded in software you licence, you are outside it and probably outside several other things as well. Patent infringement and trade secret misappropriation are normally excluded from the section altogether.

Above all of that, a rising number of programmes now carry an AI exclusion that operates before any of these questions are reached. We walked through the wording of one such endorsement in the absolute AI exclusion decoded. If your programme carries one, the advertising injury analysis becomes academic.

Professional indemnity, and the exclusion nobody reads

For anything delivered to a client, professional indemnity is the natural place to look. It is also the policy where intellectual property is most commonly carved out. Many professional indemnity wordings exclude infringement of intellectual property rights outright. Others give it back at a sublimit well below the policy limit, or give back copyright and trade mark while continuing to exclude patent. Some sit in between by covering unintentional infringement only, which sounds helpful for an AI scenario and is worth testing carefully, because "unintentional" in an insurance wording is not always read the way an operator would read it.

The practical instruction is narrow and specific. Do not ask whether your professional indemnity covers intellectual property. Ask your broker to point to the clause, tell you the sublimit if there is one, and tell you whether it applies to material generated by a tool rather than drafted by a person. Our list of what to raise and how to phrase it is in what to tell your insurance broker about AI agents.

Media liability, the policy most SMEs do not have

The policy actually designed for this is media or multimedia liability, which covers content-related offences including copyright and trade mark infringement, defamation and misappropriation of ideas, whether the content is advertising or not. Publishers, agencies and broadcasters buy it as a matter of course. A twelve-person consultancy, a shop, or a software business generally does not, because until recently it did not produce content at a volume or velocity where the risk registered.

That is the part that changed. A business that generated four pieces of external content a month by hand in 2023 may be generating four hundred with assistance in 2026. The exposure did not appear because AI is dangerous. It appeared because output volume rose by two orders of magnitude while the insurance programme stayed the same shape.

What the vendor indemnity is actually worth

Several major AI vendors offer a copyright indemnity to paying customers, and operators frequently treat this as settling the question. It does not settle it, for four reasons that are worth knowing before you rely on it.

It is conditional. These indemnities commonly require that you left the provider's content filters and safety systems enabled, that you did not attempt to induce infringing output, and that the infringing material did not come from you in the first place through your prompts, your uploads or your fine-tuning data. A business that disabled a filter because it produced too many false refusals may have quietly stepped outside its indemnity months ago.

It is capped. Contractual indemnities in software agreements are frequently limited by reference to fees paid over some preceding period. For a business spending a modest amount per month on a tool, that cap can be smaller than the first legal invoice.

It has procedure attached. Most require prompt written notice and give the vendor conduct of the defence. Notifying late, or engaging your own solicitor first and telling the vendor afterwards, can forfeit it. This is the same failure pattern as late notification under an insurance policy.

It is a promise from a company, not a regulated product. An insurer's obligation to pay is backed by capital requirements and supervision. A vendor's indemnity is backed by that vendor. The distinction rarely matters and occasionally matters enormously.

None of this makes vendor indemnities worthless. They are genuinely useful and they should be part of your file. The point is that they are a term in a contract you should read alongside your policies rather than instead of them. Our contract review walkthrough is at how to review an AI vendor contract for liability gaps.

What EU law does and does not do here

Because so much AI regulatory news has landed in the past two years, operators reasonably assume some of it addresses this. It does not, in either direction.

The EU AI Act's general-purpose AI obligations applied from 2 August 2025 and sit on model providers, not on the businesses using their models. The copyright chapter of the General-Purpose AI Code of Practice, published in final form on 10 July 2025 in three chapters covering transparency, copyright, and safety and security, is likewise addressed to those providers. If your model provider is a signatory, that is a fact about your supply chain and a reasonable thing to record in your vendor file. It does not transfer a defence to you and it does not create one.

The revised Product Liability Directive, Directive 2024/2853, which Member States must apply from 9 December 2026, is the other instrument operators reach for, and it points the wrong way twice. It runs against providers of defective products rather than in favour of businesses facing claims, and its scope of damage covers death or personal injury, damage to property, and destruction or corruption of data. A rights holder alleging that their catalogue was reproduced has not suffered that kind of damage. Their claim proceeds under ordinary copyright law, exactly as it would have in 2019.

The one genuine regulatory intersection is transparency rather than intellectual property. Article 50 of the AI Act, which applies from 2 August 2026 and was not deferred by the Digital Omnibus, requires that certain AI-generated content be marked as such. That is a disclosure duty, not a licensing one. Complying with it does not make the underlying material yours to use. The fuller treatment of that distinction is on agentliability.eu, on Article 50 transparency and labelling.

Six questions that settle where you stand

Take these to whoever placed your insurance. Ask for answers by policy, section and clause, not as reassurance.

1. If a rights holder alleges that AI-generated material we published infringes their copyright, which policy responds, and does it respond outside our own advertising?
2. Does our professional indemnity exclude intellectual property infringement, sublimit it, or cover unintentional infringement only, and what does "unintentional" mean in that wording?
3. Does any policy in the programme carry an AI exclusion, and if so does it apply before or after the advertising injury section?
4. Are defence costs inside or outside the limit for whichever policy responds, and is there a separate sublimit for intellectual property defence?
5. Does the responding policy cover claims arising from material supplied to a client, as distinct from material used to promote us?
6. What would the position be for AI-generated code embedded in a product we licence, as opposed to text or images?

If the answers to questions one and five come back as "no" or "unclear", the honest position is that you have an uninsured exposure that scales with your content output. That is a decision to make deliberately rather than a gap to discover during a claim. What a first specialist submission looks like is set out in what an underwriter will ask about your AI agent, and the European market context sits on agentinsured.eu, on AI exclusions in cyber and errors and omissions policies.

What to keep on file, starting now

Whatever the coverage answer turns out to be, provenance evidence changes the cost of an infringement claim more than almost anything else a small business can do cheaply. Four records are worth keeping.

Which tool produced what, and when. A simple log tying each substantial published asset to the tool and the approximate date is enough. It establishes whether an item predates or postdates a given vendor indemnity and which contract terms applied.

Your settings. Screenshots or written confirmation that content filters and safety systems were enabled, refreshed when you change plans. This is the condition most vendor indemnities turn on and the one hardest to reconstruct after the fact.

What you fed in. If your prompts or your uploaded reference material contained third party content, that is often the actual source of the resemblance, and it is outside almost every vendor indemnity. Knowing this early changes how you respond to a letter.

Your review step. Evidence that a person reviewed material before publication, even briefly, supports the argument that infringement was not flagrant. It also happens to be the control an underwriter asks about first. Our broader documentation guidance is at documenting AI decisions for insurance purposes.

Questions

If my AI tool produces something that copies another company's work, is my business liable?

In most cases the business that published or supplied the output is the one a rights holder writes to, not the AI vendor. Copyright infringement in the United Kingdom, in the Netherlands and across the EU generally does not require intent, so the fact that a machine produced the material is not by itself a defence. It may affect damages and whether additional damages are available, but it does not remove the underlying claim. You are the visible party, you are using the material commercially, and you are the one who receives the letter.

Does general liability insurance cover AI copyright claims?

Usually only in a narrow slice. Most general liability wordings cover copyright, trade dress and slogan infringement under a personal and advertising injury section limited to infringement committed in your own advertisement. An AI-drafted marketing page may fall inside it. An AI-drafted report delivered to a client, an AI-generated image sold in a product, or AI-written code shipped inside software normally falls outside it. Patent and trade secret claims are typically excluded from that section, and a growing number of programmes carry an AI exclusion that sits above all of it.

Does my AI vendor's indemnity protect me?

It is a conditional contractual promise, not an insurance policy. Most vendor copyright indemnities require that you left content filters enabled, did not override safety behaviour, did not supply the infringing material yourself, and gave prompt notice with conduct of the claim. They are usually capped by reference to fees paid and generally do not respond to defence costs incurred before the vendor takes over. Worth reading closely, worth keeping evidence for, not a substitute for cover.

Does the EU AI Act or the Product Liability Directive help here?

Neither creates a route for you and neither creates one against you. The AI Act's general-purpose AI obligations applied from 2 August 2025 and sit on model providers, as does the copyright chapter of the General-Purpose AI Code of Practice published on 10 July 2025. The revised Product Liability Directive, applying from 9 December 2026, covers death or personal injury, damage to property, and destruction or corruption of data. An infringement claim is not that kind of damage and proceeds under ordinary copyright law.

What single question should I ask my broker?

Ask which policy responds if a rights holder alleges that AI-generated material published or supplied by your business infringes their copyright or trade mark, and whether it responds outside your own advertising. Ask for the answer by policy name, section and clause reference. If the answer is that the advertising injury section responds, ask specifically whether it responds to material supplied to a client rather than used to promote your business. That is the distinction most commonly missed.

Sources

1. Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (EU AI Act), OJ L, 12.7.2024. General-purpose AI model obligations applicable from 2 August 2025; Article 50 transparency obligations applicable from 2 August 2026.
2. European Commission. General-Purpose AI Code of Practice, final version published 10 July 2025, in three chapters: transparency, copyright, and safety and security. digital-strategy.ec.europa.eu.
3. Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force 27 July 2026. Annex III obligations from 2 December 2027, Annex I from 2 August 2028. Article 50 was not deferred. European Commission, AI Omnibus enters into force.
4. Directive (EU) 2024/2853 of the European Parliament and of the Council on liability for defective products, OJ L, 18.11.2024. National transposition deadline 9 December 2026. Scope of compensable damage covers death or personal injury, damage to property, and destruction or corruption of data.
5. Policy structure described in this article reflects the common shape of commercial general liability, professional indemnity and media liability wordings in the United Kingdom and European markets. No individual carrier form is cited. Wordings vary materially between insurers and between renewals, and the only reliable answer is the one read off your own schedule and policy document.