Who Owns AI-Generated Content? What Small Businesses Need to Know in 2026

Ask a small business owner who owns the blog post their AI wrote this morning and you will usually get a shrug. It came out of a tool they pay for, so surely it is theirs. That instinct is reasonable, and it is also the wrong question. The useful question is narrower: can you stop someone else from using it, and can you promise a client it is yours? Those two answers are very different from each other, and neither is what most owners assume.

This is one of those areas where every article says "be careful with AI content" and nobody says how. So here is the practical position as it stands in late 2026 — what the law in the US, UK and EU actually protects, what your provider's terms do and do not hand you, and the five things to change in your business this week. This is general guidance rather than legal advice; if you are signing a large contract on the back of it, run it past a solicitor.

The short answer for busy owners

One: in every major market, copyright requires a human author, so the purely machine-generated parts of an output are generally not protected by copyright at all — nobody owns them, including you. Two: your provider's terms almost certainly say you own the output, but a contract can only transfer rights that exist, so that clause gives you permission and comfort, not a copyright you can enforce against a competitor. Three: the risk that actually costs SMBs money is not thin ownership, it is the warranty you signed promising a client the work was original and yours.

Put bluntly: unprotected content is an annoyance. An unenforceable promise in a client contract is a liability.

What the law actually says in 2026

United States: human authorship, settled for now

US copyright protects only works of human creation. That principle was tested to the end of the road and survived: on 2 March 2026 the Supreme Court declined to hear Thaler v. Perlmutter, leaving in place the rule that a work generated by an AI system without direct human authorial contribution cannot be registered.

What that does not mean is that AI-assisted work is unprotectable. The Copyright Office has registered hundreds of works involving AI where a human made genuinely creative choices — selecting, arranging, editing, combining. In those registrations the human contribution is protected and the machine-generated material is disclaimed. The open question, still moving through the courts, is how much human input is enough. Prompting alone has so far not been treated as sufficient; substantial editing and creative arrangement generally have been.

The practical takeaway: keep your prompts and your drafts. The evidence that a human shaped the work is the whole case.

United Kingdom: an unusual rule that may not survive

The UK is the outlier. Section 9(3) of the Copyright, Designs and Patents Act 1988 protects computer-generated works with no human author, and assigns ownership to "the person by whom the arrangements necessary for the creation of the work are undertaken" — in a business context, usually you or your company. The term is 50 years rather than the usual life-plus-70.

Do not build a strategy on it. In its March 2026 report on copyright and AI, the government proposed removing that protection, saying that in the absence of evidence of its ongoing value it should go. No timetable was set, and the wider questions — text and data mining, transparency about training data — were pushed down the road pending more evidence. The government was clear, though, that copyright should continue to protect works created with AI assistance. So the direction of travel in the UK is the same as everywhere else: human involvement is what earns protection.

European Union: originality means a human

There is no EU equivalent of section 9(3). Protection requires a work to be the author's own intellectual creation, which presupposes a human author and human creative choices. Same destination, different route.

And, new this year, a disclosure duty in the EU

Separate from ownership, the EU AI Act's transparency rules under Article 50 took effect on 2 August 2026. For a small business that simply uses AI tools rather than building them, two obligations are the ones to know. If you publish deepfake-style synthetic image, audio or video content, you must disclose that it is artificially generated. And if you publish AI-generated text to inform the public on matters of public interest, you must disclose that too — unless a human has carried out editorial review and taken responsibility for it. Ordinary marketing copy is not the target, but a company blog that comments on public affairs can be. Penalties run to €15 million or 3% of worldwide turnover. Our EU AI Act guide for small businesses sets out the full compliance timeline.

What your provider's terms do and do not give you

Read almost any major provider's terms and you will find language assigning you whatever rights they have in the output, and confirming they do not claim ownership of it. That is genuinely useful. It means you can use the output commercially, resell it inside a deliverable, and not worry that the vendor will come after you.

It does not mean you hold a copyright. A contract can only transfer rights that exist. If the output has no human author, there is no copyright for anyone to assign — the provider is handing you a clear path, not a title deed.

Two further details catch people out. First, outputs are not exclusive: another customer with a similar prompt can receive substantially similar material. If your differentiator is your copy, that matters. Second, ownership terms vary by plan. Some image tools grant commercial rights only on paid tiers, with free-tier output licensed under restrictive terms. Before you put a generated logo or illustration on a product you sell, check the plan you were on when you made it — not the plan you are on now.

One bright spot: trademarks work differently. A logo whose copyright is thin can still function as a trademark, and trademark rights come from use and registration, not authorship. If a visual identity matters to your business, register the mark.

The bigger risk is infringement, not ownership

Thin copyright in your own output is a commercial inconvenience. Producing something that infringes somebody else's copyright is a bill. Models are trained on vast amounts of material, litigation over that training is unresolved, and outputs occasionally reproduce protected material closely — a near-verbatim passage, a character, a code snippet under a copyleft licence.

The major vendors have responded with copyright indemnities: Microsoft's Customer Copyright Commitment, OpenAI's Copyright Shield, and comparable undertakings from Google and Adobe. These are worth having, and they are narrower than the headlines suggest. They are typically limited to business and enterprise tiers, they require you to have kept the specified guardrails and content filters switched on, and they fall away if you bypassed protections or knowingly prompted for infringing output. An indemnity that depends on your own configuration is only as good as your discipline.

So: know whether your plan carries an indemnity, know its conditions, and treat "the model produced it" as a reason to check rather than a defence.

Where this bites in real small business situations

Agency and freelance client work. This is the big one. Most service contracts contain a warranty that the work is original, does not infringe third-party rights, and that full IP is assigned to the client on payment. If your deliverable is 70% machine-generated, you have warranted originality you cannot demonstrate and assigned copyright that may not exist. The fix is a clause, not a secret — see our guide to AI clauses for client contracts for wording that handles disclosure, assignment and warranty limits without frightening the client.

Whether to disclose at all has a clearer answer than most owners expect: see should you tell clients you use AI.

Staff using personal accounts. When an employee drafts your proposal in their own consumer AI account, the output is governed by their terms, on a tier that may allow training on the content and may grant weaker commercial rights. Your company is not a party to that agreement. This is the quiet cost of shadow AI.

Software and code. AI-suggested code can carry licence obligations from whatever it was modelled on. If you ship software, this belongs on your risk register, not in the "probably fine" pile.

Anything you intend to defend. A course, a framework, a signature piece of content, a book — if the plan is to stop competitors copying it, the human authorship has to be real and documented, not decorative.

A five-step policy you can put in place this week

None of this requires a legal budget. It requires about two hours.

1. Move every AI tool onto a business plan under company billing. You get the stronger commercial terms, the data protections, and in most cases the copyright indemnity. Personal accounts on company work end today.
2. Write down the three tiers of AI use. Freely AI-drafted (internal notes, first drafts, summaries), AI-assisted with substantive human rewriting (client deliverables, published content), and human-only (anything you will register, license or defend). One page. Our template for how to write an AI policy for a small business covers the rest of the document.
3. Keep the evidence. A shared folder per project holding the prompts used and the draft-to-final versions. Ten seconds per task, and it is the difference between a registrable work and an unprovable one.
4. Fix your client contract. Replace a blanket originality warranty with disclosed AI use, assignment of whatever rights exist, and a warranty limited to your own human contribution. One amendment protects every engagement you sign afterwards.
5. Register the marks, not the output. Put the budget into trademarking your name and logo, where protection is strong and cheap, instead of chasing copyright in generated assets, where it is thin and contested.

The bottom line

There is a lot of noise on this topic and not much signal. Strip it back and the position is stable: machines cannot be authors, so the parts of your content a machine produced are largely unowned; your provider gives you permission to use it, not a monopoly over it; the UK's one exception is on its way out; and the exposure that actually lands on SMBs comes from contracts that promise more than AI-assisted work can deliver.

Handled properly, none of this slows you down. Keep your prompts, put a human genuinely in the loop on anything that matters, and make your client paperwork honest about how the work gets made — a real advantage in a market where most competitors have not thought about it at all.