Brief Yourself on the Legal and IP Risks of AI Code — Then Make Legal Review the Gate

Workflow area: Policy & Governance · Tier: Core · Hands-on time: ~30 minutes

The IP questions around AI code are unsettled enough that confident answers should worry you, and consequential enough that ignoring them is not an option: your codebase's cleanliness is an asset that gets valued at acquisition, audited by enterprise customers, and warranted in every services contract you sign. The leader's job is triage — know which risks are real, which are managed by vendor terms you may not have read, and which questions only your counsel can close. This playbook is preparation for legal review, not a substitute for it.

When to use — and when not to

• Use it before scaling AI code generation past the experimentation phase — the briefing shapes tool tier choices (enterprise vs consumer) that are expensive to reverse.
• Use it ahead of due diligencefunding rounds, acquisition talks, and enterprise-customer security reviews now routinely ask how AI-generated code enters your codebase and under what controls.
• Use it when choosing between vendorsindemnity terms differ materially and are a legitimate selection criterion alongside pb-35's capability bake-off.
• Skip presenting this briefing as settled lawthe copyright status of AI output is jurisdiction-dependent and actively evolving; every conclusion in your briefing carries a date and a "counsel to confirm" tag.
• Skip DIY contract interpretationyou read the vendor terms to formulate questions; counsel reads them to give answers. The gate is not optional.

The recipe

1. 1.

   Map the four risk areas in one page each. The briefing covers:

   • •
     License contamination — models trained on open-source code can emit near-verbatim copyleft-licensed snippets; if merged, copyleft obligations could attach to your proprietary code. Managed by: duplication filters (enable them), provenance scanning in CI (pb-28), and the license allowlist.
   • •
     Copyright status of output — several jurisdictions, including the US, currently decline copyright to purely machine-generated work; heavily AI-generated code may have thin or uncertain protection. Matters for: anything you license, sell, or defend as proprietary IP.
   • •
     Vendor indemnity — major vendors offer IP-infringement indemnity for output, but typically only on paid/enterprise tiers with safety filters enabled; consumer tiers usually carry none. The conditions matter as much as the headline.
   • •
     Confidentiality and training — whether your prompts and code can be retained or used for training under each tier you actually use; the enterprise answer and the free-tier answer are usually different products legally.
2. 2.

   Extract the vendor-terms comparison with Claude — as questions, not conclusions.

   Copy

   Here are the current terms/DPA excerpts for our AI coding tools:
   [PASTE, WITH TIER AND DATE FOR EACH].
   
   Build a comparison table: vendor+tier / IP indemnity offered? /
   conditions that void it (filters off, free tier, modified
   output?) / training on our inputs? / retention period /
   governing law. Where the text is ambiguous, write [ASK COUNSEL]
   with the exact quoted sentence — do not resolve ambiguity
   yourself. Then list the 5 highest-stakes [ASK COUNSEL] items.
   

   The [ASK COUNSEL] list is the agenda for step 4. A table with no such flags means the extraction was too confident, not that the terms were clear.

3. 3.

   Draft the clause wishlist for procurement. From the comparison, the clauses to require in any AI-tool contract: indemnity that survives your normal usage patterns (confirm the filter and tier conditions match how engineers actually work), no training on your inputs at your tier in writing, retention and deletion terms compatible with your client commitments (pb-33), and notice before terms changes. Hand this to whoever owns vendor contracts — it converts the briefing into negotiating position.

4. 4.

   Book the legal review and run it as a working session. Sixty minutes with counsel: the four one-pagers, the comparison table, the [ASK COUNSEL] list. Leave with three artifacts — counsel's corrections to the briefing, the approved license allowlist for pb-28's scanner, and a written answer to "what is our position if a copyleft match ships?" Then mark every page of the briefing reviewed by counsel on [date] — that line is what makes it usable in front of a board or a client.

5. 5.

   Set the re-review triggers. This area moves. Re-brief when: a vendor changes terms (you asked for notice in step 3), you adopt a new tool or tier, a major ruling or regulation lands in a jurisdiction you sell into, or twelve months pass — whichever comes first. Keep the dated versions; showing an auditor a briefing history is itself evidence of a functioning control.

Make it yours

• Small team or startup without in-house counsel: do steps 1–3 yourself, then buy two hours of outside counsel for step 4 — it is among the cheapest legal spend with acquisition-diligence payoff; until reviewed, run enterprise tiers with filters on and treat that as your interim control.
• Large org or GCC: legal likely has an AI position already — your job is translating it into the engineer-facing rules (allowlist, tier mandates, no-AI zones per pb-27) and feeding real usage patterns back so the position governs practice, not theory; for GCCs, reconcile parent-company legal guidance with local jurisdiction differences explicitly.
• Services firms: your exposure is doubled — you warrant deliverables to clients while relying on vendor indemnity upstream; have counsel check the two chains actually connect (does your vendor's indemnity cover work you re-warrant to a client?), and align every conclusion with the pb-33 addendum.

Quality check

• Every conclusion carries a date and a review statusan undated claim about vendor terms is a rumor; terms change quarterly.
• The comparison covers the tiers you actually runverifying enterprise terms while half the team is on free tiers (see pb-32's inventory) is auditing the wrong product.
• Counsel edited the briefinga legal review that changed nothing was a presentation, not a review; ask for the redlines.
• The allowlist reached the scannerthe briefing's license positions must land in pb-28's CI config within a sprint, or the gate enforces last year's opinion.
• You can answer the three diligence questions cold"how does AI code enter your codebase, under what review, and who indemnifies the output?" — in under two minutes each, with documents to point at.