Anthropic just paid the largest copyright settlement in history. The interesting part isn't the number — it's exactly what the court punished them for.

Here's the twist that most of the coverage buried: on the question that actually mattered to the entire AI industry, Anthropic won.

The court ruled that training a model on copyrighted books is fair use — described, in fact, as "quintessentially transformative." That's a landmark win for anyone building AI.

And yet Anthropic still wrote a check for $1.5 billion.

Why? Because of how they got the books. The company downloaded and stockpiled more than seven million pirated titles from shadow libraries into a "central library." Training on the books: legal. Pirating the books to build that library: not legal. That single distinction is now the most expensive line in AI compliance history.

The takeaway for the rest of us is uncomfortable but clear: the center of gravity in AI compliance is shifting from the output side (does the model generate infringing content?) to the input side (where did your training data actually come from?). And most companies' data provenance systems would not survive that question.

So before someone else asks it of you — in a lawsuit, or in a due-diligence room — here's a framework to ask it of yourself first.

A note on what this is: This is a self-audit framework to help you spot your gaps and walk into your lawyer's office with sharp questions — not a substitute for legal advice. Copyright and cross-border data law vary enormously by jurisdiction. Every real decision needs a qualified attorney.

For every dataset you've ingested, you should be able to answer four questions. Every one you can't answer is a risk.

  • Source. Where did this data actually come from? Self-collected, licensed, scraped from public channels, or bought from a third party? Can you trace it back to the original source — not just "the broker we bought it from"?

  • Authorization. What rights do you actually hold? Ownership, a license, or just "we happen to have it"? Critically: does the license actually cover AI training? Most older data agreements never contemplated that use.

  • Scope. What does the authorization let you do? Internal research only, or commercial products? Is deploying a model trained on it commercially within scope? Any limits on geography, time, or purpose?

  • Jurisdiction. Which jurisdictions do the underlying rights-holders and data subjects belong to? Compliant in one country doesn't mean compliant in another.

Different sources carry radically different risk. Inventory what you have against this table.

  • Self-collected — lower risk. Main exposure: do your user terms cover AI training, and is PII present? Homework: verify your ToS and privacy policy scope.

  • Licensed or purchased — medium risk. Main exposure: did the licensor actually have the right to license it, and does the scope include AI training? Homework: verify the licensor's rights chain and keep proof.

  • Scraped public data — high risk. Main exposure: "publicly visible" is not "free to train on." Site terms, robots directives, and copyright all apply. Homework: assess each source and drop the high-risk ones.

  • Third-party vendor — high risk. Main exposure: the vendor may itself be laundering pirated data. Homework: vendor diligence plus a contractual liability shield.

The trap: the two highest-risk categories are also the most common. "Scraped public data" is full of material that looks usable but isn't licensable for commercial training. And with third-party vendors, the infringement liability usually lands on you, the end user — not the vendor who sold you the problem.

This is where Anthropic's lesson bites hardest. If you source data from a third party, confirm the following.

Diligence

  • Require the vendor to document the data's original source in writing — not a vague "we lawfully own this."

  • Require proof of their upstream licensing chain.

  • Be suspicious of data priced well below market. Legitimately licensed, high-quality data costs money; suspiciously cheap usually means a problem upstream.

  • Check whether the vendor has any public record of prior infringement disputes.

Contract clauses (confirm these with your lawyer)

  • Source-legality warranty: the vendor warrants all data was lawfully obtained and that they have the right to license it to you for AI training.

  • Indemnification: if a vendor's data triggers a third-party claim against you, the scope and cap of their liability is spelled out.

  • Audit rights: you can demand further proof of source, or an audit.

  • Terminate-on-knowledge: the moment infringement risk surfaces, you can stop using the data and exit without penalty.

  • Don't settle for a verbal "it's fine." A core lesson of the Anthropic case: "I assumed the data was clean" is not a defense in court. The liability shield has to live in the contract, in writing.

If you ever face a copyright suit or a serious diligence process, you'll need a clean, traceable evidence trail. For each dataset, retain:

  • Original source records — acquisition contracts, license grants, scrape logs.

  • License documents — especially any clause explicitly covering AI-training use.

  • Timestamped acquisition records — when and how you obtained it.

  • Processing records — what cleaning and filtering you did, especially records of the high-risk sources you deliberately excluded (this demonstrates due care).

  • Vendor diligence records — proof you actually vetted your suppliers.

  • Integrity and tamper-resistance — the above stored securely, provably unaltered after the fact.

The value is simple: in litigation, a company that can show "we exercised reasonable care and our sources were legal" is in a completely different position from one that can produce nothing.

If you operate internationally, stack these on top of copyright:

  • Data-export compliance — does your training data trigger export or transfer assessments in any jurisdiction?

  • Data-subject rights — if personal data is involved, are you meeting obligations under regimes like GDPR?

  • Divergent copyright regimes — the same dataset can have a different legal status across jurisdictions; "fair use" standards are not universal.

  • Train-here, deploy-there — a model trained in one jurisdiction and deployed commercially in another may be bound by both.

  • Export-control overlap — if the data or model touches controlled technology, data compliance has to be coordinated with export-control compliance.

Provenance isn't a one-time cleanup. Quarterly, re-run:

  • Re-inventory newly ingested datasets — did each clear source review and authorization?

  • Re-check third-party vendors for new disputes or changed status.

  • Re-assess whether copyright and data rules in your key jurisdictions have shifted under your existing datasets.

  • Re-verify your evidence chain is complete and retrievable.

  • For known high-risk sources, decide whether to clean or replace.

The cruel efficiency of business is that some lessons don't have to be learned the hard way. Someone already paid $1.5 billion to teach this one. The smart move is to play your hand with their cards.

This is a general self-audit framework, not legal advice, and no substitute for a qualified attorney. Specifics of copyright, cross-border data compliance, and export control must be assessed against your actual circumstances by licensed counsel. Details of the Anthropic case are drawn from public reporting; rely on official filings and professional legal advice for the actual legal analysis.