Let's start with the question that matters most if you're paying a contractor to use AI to create something for you, or if you're using AI to create something yourself.

The U.S. Copyright Office has been clear: works created entirely by an AI, without meaningful human authorship, cannot be copyrighted. The D.C. Circuit Court of Appeals confirmed this in the Thaler case, holding that AI systems cannot be "authors" under the Copyright Act because authorship requires a human creator. Purely AI-generated content — an image generated entirely by Midjourney with a one-line prompt, a blog post written entirely by an LLM with no human revision — may not be protectable by copyright at all, potentially putting it in the public domain.

This has real implications for small businesses. If you're relying on AI-generated content as a core brand or creative asset, you may not be able to copyright it. A competitor could legally replicate it.

The Copyright Office has indicated that human involvement in the creation process matters. If a human provides substantial creative input — writing detailed prompts, making significant editorial revisions, selecting and arranging AI-generated elements with creative judgment — there's a reasonable argument that the resulting work is copyrightable. But the threshold for "sufficient human creativity" hasn't been precisely defined by courts, and the Copyright Office has been cautious.

Practical guidance: When using AI tools to create content you want to own and protect, document your creative process. Save your prompts, your revision iterations, and the editorial decisions you made. The more you can show human creative judgment, the stronger your copyright position.

Here's a scenario that's playing out all over the small business world: you hire a freelance writer or designer, they use ChatGPT or Midjourney to produce the work, and they hand you the output. Who owns it?

Under U.S. copyright law, the default rule for contractor work is that the contractor owns the copyright unless there's a written assignment agreement or the work qualifies as a "work made for hire" under the Copyright Act's narrow statutory categories. If your contractor used AI to generate the work, and that work isn't copyrightable (because it lacks sufficient human authorship), then there's nothing to own — and you may have paid for content that anyone can copy.

The solution: your independent contractor agreement must include an explicit IP assignment clause. Have the contractor assign all rights in the deliverables to you — not just the parts they created, but also AI-generated components. The assignment should include a warranty that the work doesn't infringe third-party rights, that they had authority to assign the rights, and that they'll disclose what AI tools they used.

Some attorneys also recommend including explicit language about AI-generated content in contractor agreements, given the copyright uncertainty. Something like: "Contractor assigns to Client all intellectual property rights in all deliverables, including any content generated with the assistance of artificial intelligence tools, to the extent such rights exist." That phrasing captures whatever rights are assignable while acknowledging the legal ambiguity.

One caution for California businesses: using "work made for hire" language in a contractor agreement can, in certain circumstances, reclassify the contractor as a statutory employee under California law, triggering workers' comp and unemployment insurance obligations. Work-for-hire clauses need to be drafted carefully in California. Your IP assignment clause should be paired with (not solely dependent on) the work-for-hire doctrine.

This is the most common — and most underappreciated — AI risk for small businesses. When you paste customer data, proprietary business information, financial records, or trade secrets into a public AI tool like ChatGPT, you may be feeding that information into the AI's training pipeline. The terms of service for many AI tools explicitly state that inputs can be used to improve the model.

What this means in practice: sensitive business information you share with an AI tool could potentially appear in outputs generated for other users. It probably won't. But it's not impossible. And even if it doesn't, you've lost control of that information.

For small businesses with NDA obligations or who handle client data, this creates real exposure. If you're handling protected health information (PHI), you're subject to HIPAA — and using a consumer AI tool to process PHI almost certainly violates your HIPAA obligations unless you have a Business Associate Agreement (BAA) with the AI provider.

Practical guidance:

Use enterprise or business-tier versions of AI tools that offer data privacy protections. OpenAI's Enterprise plan, for example, explicitly excludes user inputs from training. Microsoft 365 Copilot and Google Workspace AI also have data protection commitments. Never input client names, customer PII, financial data, trade secrets, or health information into consumer AI tools. If you're handling data that's subject to privacy regulation (HIPAA, CCPA, GDPR if you have EU customers), confirm the AI tool's compliance before use and get appropriate agreements in place.

If you use AI tools to screen job applicants — résumé screeners, interview scheduling bots, or AI-powered assessments — you need to be aware of emerging regulation in this area. The legal landscape is evolving fast.

Illinois, Maryland, and New York City have enacted laws requiring employers to notify job applicants when AI tools are used in hiring decisions, and in some cases to conduct bias audits of those tools. While these laws currently apply more squarely to mid-size and larger employers, solopreneurs operating in those jurisdictions should be aware that the regulatory trend is toward transparency and accountability in AI-assisted hiring.

The EEOC has issued guidance making clear that employers remain liable for discriminatory outcomes in hiring even if those outcomes result from an AI tool's decisions. You can't outsource legal compliance to an algorithm. If an AI screening tool has a disparate impact on protected classes, you face potential liability under Title VII, the ADA, or other anti- discrimination laws.

Practical guidance: If you use AI tools to help evaluate contractor applications or job applications, document your process. Don't rely solely on AI recommendations. Make human judgment a part of every hiring decision. And if you're operating in New York City, Illinois, or Maryland, check whether the local notification or audit requirements apply to you.

What about when you — the business owner — use AI to help create content for your business? Marketing copy, social media posts, product descriptions, blog articles. Do you own that content?

The answer depends on the degree of your human contribution. If you use an AI tool to generate a first draft and then substantially revise, edit, and develop it with your own creative judgment, the resulting work is likely copyrightable. The Copyright Office has signaled that human selection and arrangement of AI-generated elements, combined with meaningful editorial input, can qualify for protection.

If you copy-paste an AI output with minimal revision, the copyright protection is weaker — or nonexistent. Which means anyone else could use the same or similar prompt to generate essentially the same content, and there's nothing you can do about it legally.

For content where originality matters — your unique brand voice, your flagship content pieces, anything you want to own exclusively — invest the human creative effort. Use AI as a drafting tool, not a finished-product machine.

Every major AI platform has terms of service that govern your use of the tool, ownership of outputs, and data handling. These terms vary significantly and change frequently. Some key provisions to look for:

Ownership of outputs. Most major AI tools assign output ownership to the user (with caveats). Verify this for every tool you use. License grants. Some tools retain a license to display or use your outputs. Understand what you're granting. Data use. Does the tool use your inputs to train the model? Can you opt out? Prohibited uses. AI tools typically prohibit use for certain types of content. Violations can result in account termination.

AI tools are genuinely powerful for small businesses. They can multiply your productivity, reduce your costs, and enable you to do things that previously required a large team. But they introduce legal complexity in three areas: copyright ownership of AI-generated content, confidential data exposure, and hiring law compliance.

The principles here are straightforward: document your creative process, use privacy- protective enterprise tools for sensitive work, put AI clauses in your contractor agreements, and stay informed as the law develops. None of this requires a legal team. It requires awareness and a few deliberate habits.

NoBossly is here to help you build a business that's not just efficient — but built on a legally sound foundation. Explore our full library of guides for solopreneurs and small business owners.

The copyright angle builds on IP basics, and client-data risk should be addressed in your contracts' confidentiality clauses. If AI touches hiring, revisit worker classification and employment rules with counsel.