Feeding the AI Machine – What’s Legal, What’s Risky, and How do You Navigate the Grey Zones

AI is transforming the Fintech industry at speed, but building and deploying AI requires data and such data often belongs to someone else. As the industry races to stay ahead, the question of what you can lawfully collect, scrape, train on, and serve back to customers is becoming impossible to ignore. The AI Act[1] does not provide an answer, but Copyright law does – partly. This article delves into the copyright framework governing AI training and output within the EU, with a focus on the text and data mining exception, emerging case law, and the practical grey zones that Fintech companies must navigate.

The interplay between the AI Act and existing legislation

Building and deploying AI solutions typically involves collecting and using large amounts of data, which is sometimes done by so called scraping of text, images, code, and other content from across the web. In most cases, such  material is protected by copyright. Thus, when an AI model is trained or fine-tuned on such material or retrieves it through retrieval-augmented generation (“RAG”), and then generates output that draws upon it, copyright issues arise. For Fintech companies, operating in a highly regulated environment and under increasing scrutiny, these risks need to be understood and managed.

Since the AI Act entered into force in August 2024, its provisions have gradually become applicable and it is now largely in force, but it does not regulate everything. One area that the AI Act leaves to pre-existing legislation is the intersection between AI and intellectual property rights (”IPR”).

Copyright is to a large extent harmonised within the EU, for example by the Infosoc Directive[2], where it is stated the fundamental rights of the rightsholder to exclusively (i) authorise or prohibit reproduction of their works, in whole or in part, by any means and in any form and (ii) communicate works to the public, including making them available on demand. Both rights are directly relevant to AI systems. When an AI system scrapes content from the web, it may create copies of protected works thus engaging the reproduction right. The material is downloaded, stored, and processed to extract patterns and information from which the model learns. This amounts to reproduction regardless of whether the copies are temporary or permanent. The copyright dimension does not stop at the training phase. The same considerations apply when an entity takes a pre-trained AI model and fine-tunes it, whether for its own product development, on behalf of a customer or as part of a joint development project, or retrieves information through RAG. When an AI system produces output that incorporates or closely mirrors protected content and makes that output available to users, the communication to the public right may also come into play.

The Text and Data Mining Exception

The rightsholder’s exclusive rights are not absolute. A key exception is the text and data mining (”TDM”) exception that applies to all purposes, including commercial ones. TDM can be defined broadly as any automated analytical technique aimed at analysing text and data in digital form to generate information, patterns, trends, correlations, and more.[3] Importantly, the exception is technology-neutral and not confined to any particular method of data analysis. It applies as long as the user has lawful access to the material, for instance content freely available on the open web.[4]

Early case law has shed some light on the scope of this exception. In Kneschke v. LAION (Landgericht Hamburg, September 2024), a German court considered whether the TDM exception covers the scraping of images for AI training. The court concluded that creating a dataset through automated extraction and storage of images from the web fell within the TDM exception, provided that the material was lawfully accessible and no effective opt-out had been communicated by the rightsholder.

However, there is a critical grey zone. The TDM exception appears to cover the extraction and mining phase with reasonable clarity. It has, however, not yet been addressed whether the exception also extends to the output generated by an AI model. In practice, this means that a Fintech company may lawfully scrape and process web content for training purposes, fine-tuning or RAG purposes, yet still face copyright exposure when the AI model produces responses to end users that reproduce or closely resemble the original protected works.

Like Company v. Google – The Pending ECJ Ruling

The uncertainty regarding the TDM exception is set to be addressed, at least in part, by the Court of Justice of the European Union (”ECJ”), in Like Company v. Google (Case C-411/24), where a Belgian court has referred several preliminary questions to the ECJ. One of them goes straight to the heart of the issue: does the TDM exception cover not only extraction and analysis, but also the output produced by AI systems?

Google argues that the exception should be read broadly, covering both extraction and the subsequent use of extracted information in AI-generated output. Rightsholders take the opposite view, contending that the exception was designed to facilitate analysis and research, not to provide a blanket licence for commercial exploitation of protected works through AI products.

The ECJ’s ruling will matter for the Fintech industry, as the industry is data-driven and much of the relevant data is available online, but until the court delivers its judgment, the legal status of AI output derived from TDM-processed material remains a grey zone. Fintech companies should proceed on the assumption that output-side copyright risks are real and should not be dismissed simply because the input-side scraping may be covered by the TDM exception.

The Opt-Out Mechanism

Rightsholders are not without recourse. They may reserve their rights, effectively opting out of the TDM exception, by expressing such reservation in an appropriate manner. For online content, the reservation must be expressed in a machine-readable format, including through metadata and the terms and conditions of a website or service.[5]

The threshold for a valid opt-out appears to be relatively low. That said, the exact boundaries remain open to interpretation. The reservation must be adequate in both form and substance (vague or ambiguous language may not be enough, while overly broad prohibitions not specifically directed at TDM activities may also be questioned). For Fintech companies engaged in web scraping for AI development, fine-tuning or RAG, this means carefully assessing whether data sources have implemented effective opt-out mechanisms.

Grey Scales and Risk Navigation

Based on the above, the legal landscape surrounding AI and copyright is best understood as a spectrum of risk. Below we outline a practical framework showing how different scenarios carry varying degrees of legal exposure.

Lower Risk

• Use of licensed material. Content obtained under licence agreements that expressly permit both AI reproduction and publication sit on significantly firmer legal ground, providing a contractual foundation independent of the statutory TDM exception; or
• Scraping openly available material with no opt-out. Where content is freely accessible on the web and the rightsholder has not expressed any reservation against TDM, the extraction is likely covered by the TDM exception. The output-side risk, however, remains unresolved; and
• Internal training use only. Where scraped material is used solely for the internal development and improvement of AI models, without the output being made available to end users, copyright exposure is lower, as the output-side risk is not triggered.

Higher Risk

• Scraping material where an opt-out is in place. If a rightsholder has implemented an effective opt-out through e.g. machine-readable metadata, robots.txt, or terms of use, scraping such material is not covered by the TDM exception. Ignoring a valid opt-out exposes the Fintech company to infringement claims.
• Output delivered to end users. Where an AI model generates output that reproduces or closely mirrors protected works used in training, fine-tuning or RAG, and makes that output available to customers or the public, the risk is higher (although it should be noted that copyright protects form rather than content, and that other customary exceptions may apply). Whether the TDM exception covers such output is still an open question.
• Scraping from sources with restrictive terms of use. The contractual dimension should not be overlooked. Where a website’s terms of use prohibit automated data extraction or restrict use for AI training, scraping in breach of those terms may give rise to contractual liability on top of copyright claims.

Conclusion

The legal framework for using copyright-protected material in AI training, fine-tuning, RAG and AI output is marked by uncertainty. The TDM exception provides a basis for extracting and analysing web content for commercial purposes, but whether it extends to AI-generated output remains, as of now, an open question.

In the meantime, Fintech companies should approach the grey zones with caution: conduct thorough due diligence on data sources, respect opt-out mechanisms and invest in licensing arrangements where possible. By staying risk-aware and monitoring legal developments closely, companies can continue to harness the power of AI while keeping copyright risks in check.

[1] Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828.

[2] Articles 2 and 3 of the Directive 2001/29/EC of the European Parliament and of the Council of 22 May 2001 on the harmonisation of certain aspects of copyright and related rights in the information society.

[3] Article 4 of the Directive (EU) 2019/790 of the European Parliament and of the Council of 17 April 2019 on copyright and related rights in the Digital Single Market and amending Directives 96/9/EC and 2001/29/EC (“DSM-Directive”).

[4] Recital 18 of the DSM-Directive.

[5] See Article 4.3 and Recital 18 of the DSM Directive clarifying  that rightsholders does not need to employ sophisticated technological measures.