Law Is Part of the Model Boundary

Public access, permission to copy, permission to train, and permission to deploy are four different questions. A dataset can clear the first and fail the other three. A rights register answers all four, and it has to exist before the first takedown.

Copyright law asks what you can copy, transform, and generate. Privacy law asks what personal information you can collect, process, store, expose, and delete. Where the law runs behind the system, professional codes still bind the builder.

Legal Exposure Accumulates At Every Handoff

The first obligation lands at collection, and every copy, transformation, and filter adds another. Training, serving, logging, and fine-tuning each add one more. So does the customer who uses the output.

That makes law part of system design. A team that cannot explain provenance, licenses, consent, retention, outputs, and user controls cannot price its risk. The obligations exist whether or not anyone wrote them down.

Four Permissions Live Behind One Dataset

Public data carries four permissions, and reading is only the first. Copying it into a corpus, training on that copy, and shipping the result each need their own. Terms of service and dataset licenses decide which of the four you hold.

The answer stays fact-specific. Source, license, jurisdiction, consent, transformation, memorization, output similarity, product use, and user controls all move it. Copyright analysis alone touches copying, fair use, licensing, and derivative works.

Output similarity is a live question because models memorize. The security note showed the mechanism: extraction turns generation into a search for training text. A corpus the model can reproduce is a corpus whose license follows the output.

Privacy Adds Operational Duties

Copyright asks who owns the data. Privacy asks who is in it. Data subjects hold rights over their own records, and users expect deletion to mean deletion.

Privacy analysis touches collection, purpose limitation, retention, access, deletion, and cross-border transfer. Each item names a system that has to change.

Personal information spreads past the training corpus. Logs carry it, and fine-tuning sets carry sensitive text. A retrieval system can hand a document to a user who cannot open it at the source.

A Product Claim Creates Obligations The Model Cannot Satisfy

A model generates legal-looking text. The claim on your website decides what that text becomes: assistance, publication, advice, or automated decision-making. The model behaves the same way in all four cases. The obligations differ in each one.

Each category brings its own machinery. Attribution, user disclosure, review workflows, and appeal mechanisms turn generated text into a claim you can defend. When the model makes a consequential decision, someone owns the audit trail, and the product decides who.

Build The Rights Register Before The First Takedown

A rights register holds one row per data source, and the row carries provenance, permission, use, and remedy. Provenance describes the source, the filter, and the mixture, the three choices the data note used to explain behavior. The permission column names which of the four you hold, and which you assumed. The use column names what the deployed system does with the data.

Remedy is the hardest column to fill with a real mechanism. A removal path touches four places: the training set, the checkpoint, the retrieval index, and the logs. Deleting a row from the training set leaves the checkpoint unchanged. The security note priced that already, because text that entered training does not leave the weights cleanly.

An honest removal path states what it reaches and when. The retrieval index and the logs clear on request. The training set changes at the next build, and the weights change only at the next retrain. Until then the remedy is a filter at serving time, and the register must say so.

The register reads as bureaucracy until the first deletion request, takedown, or procurement review arrives. Courtroom risk is one part of the bill. Product trust, enterprise adoption, and data partnerships turn on the same record. A download is easy to justify, and a lifecycle is the thing you defend.

The Builder Test

Fill one row for your largest data source. Stop at the first column with no answer, because that gap is the finding.

• Source: where the data came from, and who collected it.
• Permission: the license, the consent basis, and the restrictions that came with it.
• Retention rule: how long the raw data, the derived corpus, and the logs stay.
• Removal path: what a deletion request reaches, and what it cannot reach.
• Output-risk check: the test that shows whether the model reproduces the source.
• Responsible owner: the person who answers when a rightsholder writes.

An empty owner column makes the register a document. A named person makes it a control.

What Carries

The model boundary is bigger than the model file. Law decides what the system consumes, what it remembers, what it produces, and what it decides. Each of those four verbs is a place a rightsholder or a regulator can reach you.

Every constraint so far arrived from outside the model: the corpus, the user, the attacker, and the rightsholder. The next four notes open the machine that produced the model.