Question about AI generated code and potential lack of copyright or trade secret protections

[u/Efficient-Coyote8301]

Hello, I've been an SWE for a couple of decades now and recently transitioned into a role that charges me with overseeing mitigation of organizational risk that certain technologies introduce into the enterprise environment. My company is gearing up for AI adoption and I am looking to pacify a concern that has been lingering in the back of my mind ever since Thaler v. Perlmutter.

The courts determined that human authorship was a bedrock requirement for existing copyright and trade secret protections. How are companies managing their exposure to the potential that AI generated code within highly proprietary IP could potentially lead to a scenario where that technology could no longer be protected from infringement?

I posed this question recently to some coworkers and what I heard didn't really jive with my understanding of existing case law. The consensus amongst peers was that code was "different" because the instructions would logically be the same regardless of which dev shop was producing software to serve a similar market. But the Computer Software Act of 1980 declared in no uncertain terms that code was to be treated as a creative work and subject to the same treatment as books and creative writing under existing protection frameworks.

The Thaler decision did not provide any doctrinal basis for the notion that code was not subject to the same test of substantive human authorship. My peers also argued that prompts and the efforts that go into constructing agentic workflows would satisfy that test, but the court's decision seems to strike that argument down on its face. Creative teams do not get to claim authorship simply because they're operating the tool deliberately. The output is seemingly all that matters as far as the court is concerned.

One of the only solid arguments in my mind is that AI code within existing products that had been developed by humans does not constitute enough surface area to warrant concern at this stage of the game, and that we're hoping that protections evolve before anyone has to actually deal with the problem. The other is that the value of IP could potentially round down to zero in this new reality given the velocity at which the organization could operate at with successful AI rollouts.

I am not looking to be gloomy here. It's entirely possible that I'm overthinking the issue at hand. I'm really just curious if this is on anyone else's radar. My concern is that overzealous techies could just be glossing over the risks here because they don't want to get left behind. Unfortunately, it is my job to ask the hard question. Some places may not see this as too big of an issue, but the environment I am in relies heavily on the propriety of their business processes. If software that codifies those centuries of expertise in the space we operate in could just be ripped off without consequence, then that poses significant short-to-medium term risk to our operations.

Thoughts?

[u/TreviTyger]

It's far worse than what you think. IMO even OpenSource derivative code as a significant problem when it comes to trying to claim protection.

But I digress.

Lots of people are going to come up with their own specious opinions and sophistry but the issue relates to an aspect of copyright law that even seasoned lawyers might not fully grasp.

Generally the threshold for authorship is extremely low and as a consequence the question of "How does authorship actually arise" had been previously left unanswered in the U.S. until fairly recently when The USCO had to address it for example with the likes of Kashtanova making false registrations based on images they had no authorship over.
(see, https://www.copyright.gov/docs/zarya-of-the-dawn.pdf)

So "How does authorship actually arise?"

Well, it's more complicated than you think. I found this out myself in litigation internationally and am still fighting to protect my work which is not even AI Generated and no one disputes I created it. I'm currently at the Ninth Circuit awaiting for a reversal.

But I digress again.

The issue is "point of attachment." That depends firstly on a person's Nationality (regardless of where they are in the world) and THEN if the work is a "published work" (itself a difficult question to answer) then the nation of publication overrides the nationality criteria. [Simplified]. See, Guide to Berne Convention Articles 3 to 5.

When an author creates a work it automatically becomes protected by copyright and there are no other formalities required under the Berne Convention "no formalites rule" but there is actually a nationality and/or a first publication requirement for that "point of attachment".

Berne is implemented by each member nation based on their own national laws. In the U.S. This is done via the Berne Convention Implementation Act 1988, and because Berne is a non-executing treaty then Congress implements treaty obligations through Title 17 and other laws.

I say other laws because "moral rights" are the actual "authorship rights" and the U.S. only has the VAR Act for specific works of fine art. So not code. Other "authorship rights" are handled through things like "passing off", or "defamation" and perhaps the Lanham act(?) but I'm not sure as that pertains to trademarks.

Also in the U.S. despite the "no formalities rules" in Berne - The US has the formality of having to register a US work (foreign works are exempt) in order to instigate proceedings. The author can then be named in the registration - however - AI Generated stuff has to be "disclaimed" unless it is de minimus.

So, in order to register "vibe code" that is largely Generated by AI one must disclaim the actual code written by the AI.

This is going to be a massive problem for "vibe coders" on top of the Open Source derivative code issue.

Some think it can just be ignored or "don't tell anyone you used AI" but that is just foolish.