Downloading AI Models Just Got More Complicated
In a previous article, I examined the Getty Images litigation: a dispute between Getty Images (a global media company) and Stability AI (an AI startup, creating generative AI models like ‘Stable Diffusion’). The litigation raised copyright, trade mark and passing-off issues, arising from the development and operation of Stable Diffusion.
Commentaries, including my own, have seen this somewhat as a battle: the creatives versus the machines. However, one of the most important copyright issues left for determination (after Getty trimmed down its case) was a secondary infringement one, which is what, arguably, turns Getty into an interesting case for the wider corporate world. In some ways, the most important readers of this case are the entrepreneurs, investors, law firms, banks, and other companies who have spent the last few years writing AI into their operations.
Getty alleged that Stability AI committed secondary copyright infringement by importing, possessing or distributing the Stable Diffusion AI model in the UK, relying on establishing that the model itself constituted an ‘infringing copy’.
Secondary infringement arises, under Sections 22-23 of the Copyright, Designs and Patents Act 1988 (‘CDPA’), where someone imports into the UK, otherwise than for private and domestic use, an article which is, and which he knows or has reason to believe is, an infringing copy. This extends to possessing the infringing copy in the course of business, selling or letting for hire that infringing copy, and exhibiting or otherwise distributing it.
Stripping it back, there are four elements at play:
The defendant has performed one of these acts (importing, possessing, distributing),
They have done so in relation to an ‘article’,
The article concerned constitutes an ‘infringing copy’,
The defendant knew, or had reason to believe that, the article was an infringing copy.
Those questions have to be answered in sequence. For a business trying to work out its exposure, each element asks a different question, and each answer may differ depending on how the business obtains, deploys and controls its AI systems.
The Doors Into AI
For present purposes, there are several materially different ways in which a business can obtain access to an AI model, and the categories are not necessarily clear-cut. The technical architecture, however, matters because secondary infringement under sections 22 and 23 is concerned with what article, if any, the defendant imports, possesses or deals with.
SaaS/API access: Most companies using a tool like Harvey, or ChatGPT, or similar, never receive a copy of the AI model. Instead, their role is to send a request to remote computing infrastructure used by the provider, and get a response. In a conventional software-as-a-service (‘SaaS’) arrangement, the relevant software remains remotely hosted. It is not supplied to the customer. An application programming interface (‘API’) is an interface through which one software system can request functionality or data from another. This allows you to ask the question, and the model to respond, without there ever being a direct interaction. APIs are commonly used to provide these remote AI services. The model weights themselves are never transferred to the customer.
Self-Hosting: Alternatively, a business can download a copy of an AI model’s actual weights (most of the time, already built and trained), and run it on their own infrastructure either on-premises, or in a cloud environment. Model weights are learned numerical parameters, produced through training, and they influence how information is processed and transformed into an output. Some Stable Diffusion models, for example, have been distributed on an ‘open-weight’ basis, allowing third parties to obtain and run model weights. According to some 2026 industry estimates, more than half of enterprises with significant AI usage are now running at least one workload on a self-hosted model, rather than a commercial API.
A middle category: Managed inference services, dedicated cloud deployments and other hybrid arrangements can allocate infrastructure and control in different ways that won’t fit into a clear categorised box. A customer might supply its own model, or model artifacts might be deployed into dedicated infrastructure (for a company) while remaining under varying degrees of provider or customer control.
Asking “whose server is it?” won’t answer the legally interesting questions. The important questions, for businesses trying to acquire and use AI atleast, will be: what model artifacts exist, where are they deployed, who receives or controls them, and what is transferred to the customer?
The Corporate View
On the first element: what has the business actually done?
The relevant acts include importing, possessing or distributing an infringing copy during the course of business.
Importation under the CDPA requires the article to actually enter the UK. In the API scenario, and with managed inference services, often nothing does. In the self-hosting scenario, things are far riskier: the model weights are in fact being downloaded in the UK, and the model weights are the ‘article’, according to Getty.
Section 23 catches possession of an infringing copy in the course of business. Again, where model weights aren’t possessed, this wouldn’t become an issue. However, where model weights have been downloaded, possession becomes a very real question. Importantly, this is a question even for those who did not originally import the model into the UK–for example, by inheriting a self-hosted model from an acquisition.
Distribution is likely to be less important for an ordinary corporate user. The relevant question is not whether the company distributes material produced by the model, but whether it distributes the allegedly infringing article itself: here, the model. A business that supplies copies of downloaded model weights onwards may therefore raise a distribution question, but companies who are downloading a model for their own internal deployment should be more concerned with importation and possession.
For most companies on a standard subscription to a hosted AI tool, whether accessed directly or through a hosted inference provider, this element may never arise. However, for companies self hosting, questions of importation, possession and distribution become much more realistic.
The law must still recognise the thing being imported or possessed as an article.
On the second element: have they done that to an article?
On the second element, the High Court broke new ground, formally applying the existing rules of copyright law, regarding what constitutes an “article”, to intangible technology. This means an “article” under the CDPA could now include software or AI model weights. This represents a modern expansion of a concept built around physical, electronic storage (think: pirated CDs, USB sticks). Merely making weights available for download, as well as their actual download, could seemingly now constitute the distribution of an infringing copy.
For all AI users, the question of whether there is anything capable of being an “article” in the first place is easily answered: after Getty, the answer is ‘yes’. The argument that model weights are just numbers, and not a thing to possess, is no longer available.
We can carry two propositions forward here. A business that downloads or possesses model weights could perform one of the acts in sections 22023, and the intangible nature of the model doesn’t prevent it from being an article.
On the third element: was the article an infringing copy?
From the Getty judgment, this means it must actually contain, or be made from, something copied without permission. Getty failed on this front, as unchallenged expert evidence showed that Stable Diffusion’s weights learnt and encoded statistical patterns associated with concepts (eg, what a “bowl” tends to look like), rather than storing actual copies of Getty photographs.
A model that has learnt what a bowl looks like does not, in any meaningful sense, contain bowls. This perhaps matters most for corporate diligence, because it is genuinely specific to each model, and can’t be answered generally. A model trained on a different data set could be different. Machine-learning models can exhibit memorisation to different degrees, and the relationship between training data, learned parameters and reproducible outputs is a technical and model-specific question.
Diligence will seemingly become a question of AI engineering. Using an M&A context as an example, where one company wishes to acquire another, the target company’s financial, legal and business health is analysed and evaluated. Diligence has rarely been purely legal. Target companies are often assessed by other specialist lawyers–if their asset relies on IP, IP lawyers will be involved to assess the value or liability of a target company. However, diligence built for AI targets now needs, in some sense, AI specialists on the job, not just AI lawyers. The Getty Images judgment turned on model versions, training datasets, filtering choices, hosting locations and access mechanisms. A diligence exercise that reviews IP and licence chains for these AI companies, but doesn’t ask where the target’s models were trained, on what data, with what filtering, is not diligence that will pass through Getty. Firms, more than ever before in the AI space, must interrogate technical architecture.
Diligence may have to move with the target. Models are re-trained, merged, versioned, updated. They are constantly evolving, and where technical facts materially change, a legal analysis may need to be revised. Provenance review as a continuing obligation may be becoming a new discipline in its own right.
Still, this could all unravel. Following consequential hearings, Getty Images has been granted permission to appeal the secondary infringement ruling. The original ruling held that infringing copies need to actually store or contain a reproduction of the original work. Alternative readings suggest the judgment erred in this definition of an infringing copy. A particularly important academic criticism comes from James Hall, who argues that the court wrongly imported this requirement.
Hall suggests that Mrs Justice Joanna Smith was in some way confused by previous case law. Section 27(2) of the CDPA defines an infringing copy simply as an article whose “making” infringed copyright. Because copyright can also be infringed by unauthorized adaptation (section 21, CDPA), an infringing copy can be something that never was or never held a copy of the original at all–it is for this reason an unauthorised French translation of a novel would infringe copyright without ever containing a single copied word of the original in English. Reading in a 'must contain a copy' requirement would therefore exclude unauthorised adaptors from secondary infringement liability altogether, which, Hall argues, plainly cannot have been the legislature's intention.
If the Court of Appeal agrees, the practical consequences would be considerably wider than what the High Court achieved. The current test only catches a self-hosted model that happens to have memorised its training data, whereas Hall’s proposed test would catch any self-hosted model built through an infringing training process regardless of what it retained. This would seemingly be a far lower bar.
So what do we have so far in the sequence?
Self-hosting can bring a business within the relevant acts of importation or possession. An intangible AI model is capable of being an ‘article’. Under the High Court's present approach, however, that article does not become an ‘infringing copy’ merely because copyright infringement occurred somewhere in the process by which it was made. Suppose that all 3 elements are satisfied, there is still one more.
On the fourth element: did they at least have reason to believe they were doing something wrong?
Secondary infringement claims are not strict liability. They instead depend upon a company (or person) knowing, or having reason to believe, that they are dealing with an illegal copy. While this protects innocent people who deal without any way of knowing it was a problem, it also suggests that law firms who look further into the models they are self-hosting open themselves to greater liability.
Is ignorance now protection?
Not quite. This looks like it creates a strange incentive: a company that never asks any questions about the self-hosted AI model they have downloaded stays technically further away from that knowledge or reasonable belief threshold.
Ignorance may look like a compliance strategy, but it is not a sustainable one. The “reason to believe” standard under the CDPA is judged by an objective legal standard, not by the defendant’s state of mind. The test is whether the defendant had actual knowledge of the facts, and whether the reasonable person, looking at them objectively, would arrive at a belief that an infringement was occurring. After a widely reported High Court judgment clearly about training data provenance, lack of consideration could be seen as deliberate blindness.
Stepping back
The companies most exposed to secondary infringement may be ordinary businesses trying to keep up, update their efficiency, and hop on the AI band-wagon. Self-hosted models are not inherently riskier–hosted AI can create copyright, contractual, confidentiality, data-protection, regulatory and other risks that this article doesn’t compare.
However, it seems clear that the more control a business takes over the model itself, the more legally significant the distinction between merely using AI and actually possessing AI becomes, in regards to secondary infringement, reshaped by Getty.
Amy is a second-year Law student at the University of Oxford, also studying Computer Science for AI through Harvard Online. Alongside her studies, she is an Associate Editor at the OUULJ, has edited three international AISL anthologies, and founded her own tutoring practice, Discentium.
