On September 16, 2026, the U.S. Court of Appeals for the Ninth Circuit ruled in Doe v. GitHub, Inc. (No. 24-7700) that code produced by generative AI coding tools counts as a "newly generated work," not a "copy" of training data — and therefore does not violate Section 1202(b) of the Digital Millennium Copyright Act (DMCA), which bans removing or altering copyright management information (CMI). According to Bloomberg Law, it is the first federal appellate decision to squarely address AI and CMI.
What the court actually held
The plaintiffs were several anonymous programmers suing over GitHub Copilot — a code-completion tool trained on a modified version of OpenAI's Codex, using billions of lines of public code as training material. Many of those repositories carried author names, copyright notices, and open-source license terms — exactly the "copyright management information" the DMCA protects. The plaintiffs advanced two theories: the "output theory," that Copilot's outputs reproduce original works with CMI stripped out; and the "input theory," that feeding code into the training pipeline while stripping CMI is itself unlawful.
The district court had dismissed the output theory because the plaintiffs' examples were not "identical" to the originals. The Ninth Circuit affirmed the dismissal but on different grounds: Section 1202(b) targets the act of "removal" from an "already existing work." Generating a "new work that never carried CMI in the first place" is not the same as "removing" CMI. They are different acts.
But the court handed AI companies no blanket immunity. It also rejected a rigid "must be verbatim" standard: cosmetic tweaks do not shield a defendant — output that nearly verbatim reproduces an original work, minus attribution and license notices, can still serve as circumstantial evidence that removal did occur. The court expressly declined to decide two questions: whether AI outputs that reproduce copyrighted material constitute direct infringement, and whether stripping CMI during training is unlawful (avoided on procedural grounds). It also distinguished generative systems from retrieval-based ones, hinting that systems which directly retrieve and disseminate existing works could face different treatment.
Who is affected
First, developers of AI coding tools and general-purpose generative AI. GitHub, Microsoft, and OpenAI won a narrow victory: only the CMI-output claim is blocked; the battles over training compliance and direct infringement continue.
Second, open-source authors and rights holders. The CMI damages path is now largely closed; future lawsuits must pivot to direct infringement, which is harder and costlier to prove.
Third, enterprise users. Teams that generate code with AI should note: the ruling never says "AI outputs don't infringe." Licensing and infringement risks around generated code have not gone away.
What to do
For developers: don't treat "outputs are new works" as a get-out-of-jail card. Keeping attribution and license-notice mechanisms in outputs remains best practice; how training pipelines handle CMI is still a gray zone the court left undecided, so stay conservative; if your product retrieves, caches, or quotes existing works verbatim, assess it separately for compliance, since the court hinted such systems may be treated differently.
For rights holders: adjust litigation strategy — shift the focus from CMI removal to direct infringement, and preserve evidence of "near-verbatim reproduction," which still carries weight in CMI disputes.
For enterprise users: review the IP indemnification clauses in your AI coding tools' terms of service; keep provenance records for AI-generated code that matters; run a license check on snippets that look verbatim — it costs far less than a dispute after the fact.
Where the risks remain
- The ruling resolves only the Section 1202(b) output theory; the court expressly reserved the direct-infringement question, so related lawsuits will continue.
- The training-side CMI question was left undecided on procedural grounds and remains an open risk.
- The decision binds only the Ninth Circuit and is merely persuasive elsewhere. Don't treat it as a nationwide — let alone worldwide — rule; the EU, Japan, and China each apply their own copyright laws.
- Retrieval-based AI systems may be treated differently; the decision's umbrella is narrower than it looks.
- Near-verbatim output missing CMI can still be found to be removal — "just rename a few variables and you're safe" is a misunderstanding.
Compliance Q&A
Q: If our code is generated by AI coding tools, are we free of copyright trouble?
A: No. The ruling eliminated only the "removal of copyright management information" claim; the court expressly did not decide whether AI outputs infringe. Licensing and infringement risks around the code remain, so keep provenance records and run license checks.
Q: Does this mean open-source authors can no longer defend their rights?
A: No. What closed is the CMI-removal path; direct-infringement lawsuits remain open. The court also left a door ajar: near-verbatim output stripped of attribution can still serve as evidence of CMI removal.
Q: Does this ruling apply in China or the EU?
A: Not directly. It is a U.S. federal appellate decision binding only within the Ninth Circuit. The EU, Japan, and China apply their own copyright laws — a U.S. rule is not a global one.
