AI Watermarks, Copyright, and Insurance

Introduction

Back in August, we tested Anthropic’s promise to watermark Claude’s output and found nothing there yet opens a new window . Since then, Anthropic has published which models it marks and how, and it’s no longer alone: OpenAI has announced a text watermark of its own, Google has opened its detector to the public, and xAI has taken a different route entirely.

Since August, though, the questions we’ve heard most are about what comes after the watermark: who owns a logo that a model drew, whether code written with AI can be treated as proprietary, and whether a prompt counts as authorship. And behind those sits a newer one: if your AI-assisted marketing turns out to infringe someone’s work, does your insurance still cover it?

The watermark, copyright, and insurance are moving at different speeds, and none of them is settled. Here’s where each one stands at the end of October 2026, and what it means if you run a business that uses AI to make things.

Where AI watermarks stand

When we took the announcement apart in August opens a new window , Anthropic had committed to marking output from models launched on or after August 2, 2026, and no such model existed. Since then, Anthropic’s own page on how Claude marks content opens a new window lists marking support for the current models, including Fable 5.1, Opus 5.5, Sonnet 5.5, and Haiku 5.5, and says it is adding watermarks to output from models released before the cutoff. The rollout on Amazon Bedrock for several older models was scheduled to complete by October 23.

The mechanisms are the ones we described then: a statistical watermark woven into the text, and a signed Content Credential, metadata that follows the C2PA provenance standard, attached to files such as PNGs and JPEGs. Anthropic says the Content Credential is added “when Claude creates a file,” so it applies only where Claude can generate files, in the Claude apps and the API. A drawing rendered in the chat, or a file that’s been screenshotted or re-saved, won’t carry one. On the reading side, Anthropic has a free Claude Content Checker opens a new window for files. Text detection is in private preview, open to groups including regulators, researchers, media and fact-checkers, educational organizations, and enterprises with their own compliance obligations, with broader access promised “over time.”

Anthropic’s own caveats are worth keeping in mind: a detected mark “provides a signal that content was processed by Claude, but is not fully conclusive,” since people use Claude to proofread and translate their own work, and a missing mark proves nothing.

What other providers are doing

OpenAI is the closest to Anthropic, and further ahead on media. Its provenance page opens a new window says images from ChatGPT, Codex, and the API carry both a C2PA Content Credential and an invisible SynthID watermark, which can survive the screenshots that strip metadata, and anyone can check an image or audio file at openai.com/verify opens a new window . For text, OpenAI announced its own watermark opens a new window on October 5, a statistical signal in the model’s word choices, like Claude’s, but with a narrower default: ChatGPT text in the EU carries it, while API customers anywhere can turn it on in their settings, and it stays off unless they do. The text detector is limited to approved research and academic organizations, with general business uses explicitly out of scope. OpenAI’s page is also blunt about what a mark proves: on its own, it “does not establish who authored or owns the content.”

Google has had watermarking the longest. Its SynthID marks images, video, and audio from its models, and SynthID Text opens a new window was open-sourced in 2024, when Google said it was already running in Gemini. On October 7, Google opened its SynthID Detector to everyone opens a new window , and it covers content from OpenAI, NVIDIA, and Kakao as well as Google’s own. The public detector checks image, video, and audio files, though, not text.

xAI has done the least. According to its Grok FAQ opens a new window , images and videos from the Grok apps include a Grok watermark that can’t be removed in settings, but xAI hasn’t documented any invisible marking, for text or files, and it didn’t sign opens a new window the EU code of practice that Anthropic, OpenAI, Google, Meta, Microsoft, and Mistral did. It still has to meet the EU AI Act’s own transparency requirements opens a new window .

For a business, the takeaway is that there’s no single mark to look for. Depending on the vendor, the region, and the account settings, the same kind of deliverable could carry a Content Credential, an invisible watermark, a visible logo, or nothing at all. And none of these marks says who made the content, or who owns it, and that second gap is where most of the questions we’ve been getting actually live.

Who owns AI-generated content

In the United States, the short answer hasn’t moved much in three years, but it has gotten firmer. Copyright protects works of human authorship. Stephen Thaler spent years trying to register an image he said was created entirely by his AI system, lost at the D.C. Circuit in March 2025, and on March 2, 2026, the Supreme Court declined to hear his appeal opens a new window . That leaves the human authorship requirement in place, although it’s worth knowing that the Supreme Court declining to hear a case doesn’t create a new precedent, and Thaler’s case was the extreme version: no human contribution claimed at all.

The more useful guidance for a business is the Copyright Office’s report on copyrightability opens a new window , published in January 2025. Its position is that prompts alone, no matter how detailed, don’t make you the author of what comes out, because the model, not you, decides how your instructions turn into expression. What can be protected is the human part: your own expressive material that is still perceptible in the output, your creative selection and arrangement of AI-generated pieces, and your modifications to them. The AI-generated material inside the work stays unprotected, and the Office decides the line case by case. If you register a work with meaningful AI-generated content, you’re also expected to disclose it.

Your AI vendor’s terms don’t change any of this, and they say so if you read closely. Anthropic’s Commercial Terms opens a new window state that the customer “owns its Outputs” and assign to the customer Anthropic’s “right, title and interest (if any) in and to Outputs.” The consumer terms opens a new window use the same “if any.” That parenthetical is doing a lot of work. The vendor hands you whatever rights exist, and for raw model output, under the current US position, that may be nothing.

This is where the watermark and copyright meet. A file that carries a Claude Content Credential is a record that AI was involved in producing it. It doesn’t tell anyone how much of the work is yours, but if you’re claiming that something is protectable, it means “we made this” needs to be backed by something more than your word. The practical habit is to keep a record of the human contribution as you go: the drafts, the sketches you started from, the edits, the choices between generated options. It costs very little at the time and is close to impossible to reconstruct a year later.

AI-generated work in client contracts

Most of the questions we’ve had from clients this year came from this exact gap. The general one is what copyright applies to something we delivered with AI’s help, and the answer above, protection for the human contribution and none for the raw output, surprises people more often than you’d expect, because most contracts were written assuming every deliverable comes with a copyright attached.

Prompts come up a lot too. A detailed prompt feels like authorship, especially when someone spent an afternoon getting it right, and it’s a reasonable intuition. It just isn’t the position the Copyright Office takes, so a deliverable whose only human input was the prompt is very likely not protected, whoever wrote the prompt.

The hardest one is how much human involvement is enough, and we’ve had it asked about a logo created with AI and about AI-written code a client wanted to treat as proprietary. There’s no number to give. The Copyright Office decides case by case on purpose, and the court cases that could draw a clearer line, like Jason Allen’s challenge opens a new window to the refusal to register his image Théâtre D’opéra Spatial, haven’t produced one yet. Briefing in Allen’s case closed in February, and as of this writing the court hasn’t ruled. What we can say is where the protection tends to come from. A logo that a designer substantially redrew or composed from generated elements has a much stronger claim than one picked from a batch of outputs. And a logo may be protectable as a trademark through its use in commerce regardless of its copyright status, which for most businesses is the protection that actually matters for a logo. For code, the human contribution is usually larger than people assume, because AI-written code in a real project gets reviewed, restructured, and integrated with code people wrote, but the generated parts on their own are on weaker ground. Code also has a protection that doesn’t depend on authorship at all: if you keep it confidential, it can be a trade secret.

What this means for a contract is that the standard clauses deserve a second look. An IP assignment clause transfers whatever rights exist, and like the vendor’s “if any,” it can’t transfer rights that were never there. A warranty that every deliverable is original and fully protectable is a promise that may not be keepable for AI-assisted work. We’d rather say upfront how AI is used in our work and what that means for ownership than have a client find out from a Content Credential, which is the same disclosure argument we made when the watermark was first announced opens a new window .

Where the IP fights stand

The other half of the IP picture is whether what you make, or how the model was built, infringes someone else’s rights. On training, US courts have so far split along a line that’s starting to look consistent. In 2025, the court in Bartz v. Anthropic found that training on lawfully acquired books was fair use, but keeping pirated copies was not, and the case settled for $1.5 billion. In Kadrey v. Meta, the court found training fair use largely because the authors hadn’t shown the model was harming the market for their books. Then, on September 29, 2026, the Third Circuit ruled in Thomson Reuters v. Ross opens a new window that using Westlaw’s headnotes to train a competing legal research tool was not fair use, and found that “the market for licensing headnotes as text to train AI is rapidly developing.” It’s likely the first federal appellate ruling on AI training and fair use, but the court was explicit that ROSS’s platform “cannot generate original expression,” and set it apart from the generative models in Bartz, so how far the reasoning reaches into generative AI is already being argued. Meanwhile, new suits keep arriving, including, just last month, USA Today’s suit against OpenAI opens a new window and a wave of individual author suits against Meta opens a new window .

For a business using these tools, training-data litigation is mostly the vendor’s problem. Your exposure is the output: a generated image that closely resembles a copyrighted one, or copy that reproduces protected text, used in your marketing. That’s where vendor indemnities come in, and they’re narrower than the headlines about them suggest. Anthropic’s Commercial Terms commit it to defending customers against third-party claims that their paid use of the services infringes intellectual property rights, but not to the extent the claim arises from your modifications to the output, from combining the output with content Anthropic didn’t provide, from your own inputs, or from trademark claims over using an output in commerce. And the indemnity lives in the Commercial Terms, which cover API use and business offerings. The consumer terms that cover Claude.ai and Pro for individuals have no indemnity running to you at all, only one running from you to Anthropic.

There’s an uncomfortable interaction in there. The things that make AI-assisted work more protectable under copyright, editing it heavily and combining it with your own material, are the same things the indemnity carves out, so “our vendor covers us” and “we own this” can’t both be leaned on fully for the same deliverable. And if your team is on a mix of personal and business accounts, it’s worth checking which terms each one is actually under, the kind of vendor due diligence we suggest in our list of questions to ask any AI vendor opens a new window , with IP added to it.

Where insurers are leaning

If the vendor’s indemnity doesn’t reach a claim, the next place most businesses would look is their own insurance. That’s the part of this that has moved fastest, and mostly in one direction.

For years, AI risk sat inside ordinary policies by default. A general liability or professional liability policy didn’t mention AI, so a loss involving AI was covered or not on the same terms as anything else, what the industry calls silent AI. That’s ending. Verisk’s ISO, which writes the standard policy language many insurers use, released three optional generative AI exclusion endorsements opens a new window with a January 2026 edition date: 2026-11-10 14:58:33

CG 40 48 is the one that connects back to copyright. Personal and advertising injury, Coverage B in a general liability policy, is where claims of infringing someone’s copyright in your advertisement have traditionally landed. An insurer that attaches CG 40 48 has removed that coverage specifically for anything arising out of generative AI, which is the exact scenario of an AI-generated ad that resembles someone else’s work.

The ISO forms are optional and not yet universal, but carriers are moving in the same direction on their own paper, sometimes further. A CSIS analysis published in September opens a new window , drawing on trade press reporting, puts the number of property and casualty insurers that filed for AI exclusions in 2026 at more than 60, and says state regulators had approved more than 80 percent of carrier requests to exclude AI-related damages. Some of the wording is very wide: a W. R. Berkley exclusion for management liability policies, first reported in 2025, would bar coverage for any claim involving “any actual or alleged use” of AI, where the allegation alone is enough. AIG secured the regulatory option to exclude generative AI but said it had no current plans to use it. And in July, Verisk said it was drafting exclusions for agentic AI as well.

On the other side, a market for affirmative AI coverage is forming, small but real. The same CSIS analysis lists Armilla, backed by Lloyd’s syndicates, covering AI underperformance, hallucinations, and regulatory violations, and Munich Re’s aiSure, which insures AI model performance. Some of it doesn’t fit most businesses, though: at least one major carrier’s AI endorsement covers only firms that build or deploy their own models, not companies using a third-party tool.

The direction is clear even if the details vary by carrier and state: AI risk is moving out of general policies and into specific ones that are underwritten, priced, and asked about. For a small business, the immediate risk is coverage disappearing at renewal through an endorsement nobody reads.

Putting the vendor terms and the insurance side together, this is roughly where a copyright claim over AI-generated marketing can land:

What to check at your next renewal

None of this needs a lawyer to start, just a copy of your policies and a conversation with your broker before the renewal date rather than after a claim. The things worth checking:

• Whether any of the ISO forms CG 40 47, CG 40 48, or CG 35 08 is attached to your general liability policy, and whether the phrase “generative artificial intelligence” appears anywhere in the endorsements.
• Whether your professional liability (E&O) or management liability (D&O) policies carry a broader AI exclusion, especially wording that triggers on “alleged” use.
• Whether any cyber or E&O coverage that does mention AI caps it at a sublimit well below the policy limit.
• Which terms your team’s AI tools are under, business or consumer, and what the vendor indemnity actually covers for that tier.
• Whether your client contracts promise originality or full IP assignment for work you produce with AI, and whether you keep records of the human contribution that would back that up.

If your broker can’t answer the first three, that’s an answer too, and it’s worth getting in writing.

Conclusion

Here’s how the three threads have lined up so far:

Watermarking is arriving unevenly, by default at Anthropic, on images everywhere but text mostly in the EU at OpenAI, mostly for media at Google, and only on app images and video at xAI, and wherever it lands, it records that AI was involved, not who owns the result. On ownership, prompts alone don’t make you an author, and protection comes from the human contribution, which is worth documenting as you work. The training fights are mostly the vendors’ to fight, but your exposure is the output, and vendor indemnities carve out exactly the edits that make work protectable. And insurers are writing generative AI out of standard policies, starting with the advertising injury coverage where a copyright claim over AI-generated marketing would have landed.

None of this is legal advice, and all three areas are changing month to month, so check the current state of each before relying on the details here.

Not sure what your AI-assisted work means for your client contracts or your next renewal? Let’s talk opens a new window .