Reading AI Service Terms for US/EU Builders — Training, Commercial Use, Output & Indemnity

As of: 2026-05 / Jurisdiction focus: United States & EU (Japan is covered in the Japanese edition) / last_updated: 2026-05-26 Changelog: 2026-05-26 first published

Where this sits in the series: this is the 5th piece in the "rights for builders" series. Earlier pieces covered the pre-ship rights checklist, OSS licenses, the legal boundaries of scraping, and licensing third-party assets (images, music, fonts). This one is about the layer beyond those: your agreement with the AI service itself — its terms of service.

Quick glossary:

• Terms of Service (ToS): the contract between the provider and you — what you may use it for, how inputs and outputs are handled, and who bears responsibility when things go wrong.
• Model license: permission to run, distribute, or modify a model's weights yourself (e.g., the Llama Community License). A different layer from the service's ToS (see §1).
• Training / opt-out: using your input to train the model. On some plans this is on by default, and you must opt out in settings.
• Indemnification / Copyright Shield: when output is alleged to infringe a third party's rights, the provider covers the costs and defends you. As a rule, this is limited to business / higher-tier plans.
• AUP (Acceptable Use Policy): the part of the terms that lists prohibited uses. High-risk fields may require a human in the loop and disclosure that AI was used.

"It's free, and the output is mine, so I can do anything" — AI services invite that feeling. But open the terms and you'll find that whether your input trains the model, whether you can use it commercially, and who defends you if you're sued are all set asymmetrically by plan. This article lays out the axes for reading AI service terms, then ends with checklists by reader stance — personal use, commercial release, and enterprise/API. The focus here is US and EU practice; Japanese law and domestic practice are covered in the Japanese edition.

First, the big distinction — Terms of Service vs. the model's license

When you read an AI service's terms, the first thing to separate is the Terms of Service (ToS) from the model's license. People conflate them, but they rest on different grounds.

• (A) A model license governs running, distributing, or modifying a model's weights yourself (Llama Community License, Gemma Terms, Apache-2.0, etc. — per model).
• (B) A service ToS governs calling a model through an API or app (OpenAI Terms, Anthropic Commercial Terms, etc. — per service).

"Llama is commercially licensed, so ChatGPT's output must be free to use too" conflates the two. The layer depends on whether you host the weights or call an API; if you do both, check both. Classifying model/software licenses is covered in AI model licenses — here we focus on (B) the service ToS.

With that set, here is what this article does and does not cover. Questions around AI terms split into "as a matter of contract" and "as a matter of law," and this piece sticks to the former.

In short: "as a contract, is my input used for training and can I stop it?" is this article, while "as a matter of law, is training permitted, and how do I protect my own site?" is covered in AI training data and crawlers. It's an easy mix-up, so we put the map up front.

Read the terms along six axes — keep per-service comparisons as a sidebar

AI service terms are long, but the points that matter in practice collapse into six axes. Make those the main act and relegate per-service numbers to a sidebar — service-specific clauses change fast and start going stale the moment you write them down.

Which axis matters most depends on your stance — personal use / commercial release / enterprise-API — which we line up in the checklists at the end.

For the per-service "current values," a watch-table like the one below — carrying confirmation date, plan in scope, effective date, and whether a primary source exists — makes it easier to keep up with changes (the table reflects May 2026).

Legend: ✅ confirmed against the primary text / ⚠️ cross-checked via secondary sources rather than the official terms text (flagged inline). Effective dates, clauses, and plans in scope change without notice — verify the latest on each provider's official page at decision time. This table is a template for what to watch, not a source to cite the values from.

Input training — personal plans lean "on," API and business default to "off"

Most relevant here: personal use (whether your input trains the model is directly at stake). Businesses should confirm the "training off by contract" clause on their business plan.

The first asymmetry to internalize: consumer chat plans (ChatGPT Free/Go/Plus/Pro, Claude.ai Free/Pro/Max, free Gemini) lean "training on" — unless you explicitly opt out, your input may be used for training. API and business plans default to "off." Same company, but the training default can run the opposite way depending on the entry point (your plan).

† OpenAI's and GitHub's personal-plan training defaults were cross-checked via secondary sources rather than the official terms text, so confirm against the current official Data Controls / settings. Note that the free Gemini API tells you not to submit confidential or personal information at all, so putting sensitive data in is out of bounds by design. Regional exception (important for EU readers): for users in the EEA, Switzerland, or the UK, even the free Gemini API is governed by the paid data terms — i.e., it is not used for training or human review — per Google's ToS. The "free = trained + human-reviewed" line above (and in the commercial-use table) applies outside those regions.

Opt-out doesn't stop everything

Opt-out is not absolute. Anthropic's Consumer Terms spell out exceptions:

• Feedback ratings (👍 / 👎) and inputs flagged in safety review may still be used for training and safety research after you opt out.
• You can't claw back anything already used in a completed training run or already baked into a trained model.

And one more: "don't train on it" and "don't keep it on the server" are different things. Even with training off, operational logs may persist for a period. To stop storage itself, you need a ZDR (Zero Data Retention) agreement (business / by application — OpenAI requires pre-approval on eligible endpoints; Anthropic needs a Commercial org key plus ZDR approval).

If you pass your customers' personal data to an AI service, note a separate layer: under GDPR (and US state privacy laws), you may be acting as a controller or processor with your own obligations, regardless of what the ToS says. Whether the provider "uses it for its own purposes (training)" or "merely processes it (opt-out / ZDR)" affects that analysis — so read the settings above together with your privacy-law duties. The specifics belong to a dedicated treatment; here we just flag the connection.

The step-by-step of how to opt out, or how to shorten retention, is about each service's settings rather than its terms, so we won't go deep here. This article stays on "what the terms provide."

Commercial use — don't mix up the basis for "you can use it"

Most relevant here: commercial release (can you build it into your product?) plus enterprise (you owe an account of why it's commercially OK).

As noted, "can I use it commercially?" has two layers: (A) the model license and (B) the service ToS. Host the weights yourself → (A); call an API or app → (B); do both → check both. Here we look at (B), the service-ToS side (as of May 2026).

The costliest mistakes come from confusing the basis:

• ❌ "Llama is open, so ChatGPT's output is free too." Different layers — an open model license has nothing to do with a service ToS.
• ❌ "The API is commercial-OK, so I can redistribute the weights too." API access ≠ permission to distribute weights.
• ❌ "The output is mine, so I needn't worry about third-party copyright." Output ownership ≠ third-party rights cleared (next section).

"Commercial OK" is only the starting line. You still have to check the AUP's prohibited uses and whether the output infringes anyone's rights.

Output rights and liability — "yours," but with caveats

Most relevant here: personal use (can you use the output in your work?) plus commercial / enterprise (rights and liability of deliverables).

Who owns AI output is, across major providers, generally settled as "it sits with the user." The wording differs, though: OpenAI and Anthropic assign it to you, while Google states it "won't claim ownership" (the table below spells out the differences).

The easy-to-miss part is that every one of these is conditioned on "if any." That's because whether AI output is even copyrightable is treated differently across jurisdictions, turning on the degree of human creative involvement — in the US, the Copyright Office's position is that purely AI-generated material lacking sufficient human authorship isn't registrable. So "the contract assigns it to you" and "it is protected by copyright" are separate questions; the latter is covered in copyright in AI-generated work.

The other caveat is the "as is" accuracy disclaimer. No provider warrants accuracy, and that's where liability starts. Anthropic's Commercial Terms state the services and outputs are not warranted to be "accurate, complete or error-free," and OpenAI notes output may not be unique and that other users may receive similar output (terms text to verify).

The implication matters: if you copy a hallucination or an erroneous output into a deliverable without checking and harm results, under the terms, the duty to verify and comply falls on you first. In the US, a lawyer was sanctioned in 2023 for filing non-existent, AI-fabricated case citations without verifying them (the Mata v. Avianca matter, S.D.N.Y.) — the textbook example of "you're responsible for trusting the output."

If output infringes a third party's copyright or trademark, the default ToS structure places the duty to check and comply on the user first (on personal plans you indemnify the provider — next section). And in high-risk fields (legal, medical, financial), the terms (AUP) may require review by a qualified person (human-in-the-loop) and disclosure that AI was used before output reaches an end user (below).

Indemnification — personal users give protection; business and higher tiers receive it

Most relevant here: enterprise (core to plan selection) plus personal use (the awareness that you're not protected).

Indemnification is the mechanism by which, if your output is alleged to infringe a third party's rights, the provider covers the costs and defends you. The direction trips people up: under the default terms, personal/Consumer users actually stand on the side that protects (indemnifies) the provider. Anthropic's Consumer Terms, for instance, state that you agree to indemnify and hold harmless Anthropic.

Providers move to the "we protect you" side only on plans that carry the following (as of May 2026).

A notable 2026 change for GitHub Copilot: as of April 3, 2026, setting the duplicate-detection filter to "Block" is no longer a precondition for IP indemnity (Microsoft's Customer Copyright Commitment "required mitigations," confirmed 2026-05-12). The filter remains an optional feature to reduce overlap with public code.

(Scope note on Google: the ❓ above reflects the ai.google.dev Gemini API direct terms. Google Cloud / Vertex AI contracts do offer a separate "generated output" IP indemnity for paid, generally-available services under responsible-AI conditions.)

Two takeaways for solo developers:

• If a deliverable made on a personal plan (ChatGPT Plus / Claude Pro / GitHub Copilot Individual) is sued for copyright infringement, the standard terms leave you outside the provider's indemnity. If you need protection, a business / higher-tier contract is the premise.
• Even with indemnity, the carve-outs are broad. "You modified the output," "you combined it with another product," "you used it knowing it infringed" — any of these can drop you out. An indemnified plan is meaningful only once you also check that you're using it in a way that doesn't hit a carve-out.

Indemnity language depends on your plan's contract text, and carve-outs differ by provider. Whether indemnity actually applies needs the contract text plus a qualified attorney (commercial / IP).

Retention and prohibited uses — when "deleted" isn't gone, and high-risk carve-outs

Most relevant here: enterprise + personal use (understanding when "deleted" may not be gone).

Normal retention looks roughly like this:

But a litigation-driven preservation order made "deleted" data persist in practice in 2025. In NYT v. OpenAI / Microsoft (case no. 1:23-cv-11195, U.S. District Court, S.D.N.Y.), a preservation order issued on May 13, 2025 reached past logs of ChatGPT Free / Plus / Pro / Team and non-ZDR API (Enterprise / Edu were out of scope; Anthropic is unrelated). That indefinite-retention obligation ended on September 26, 2025 (with a formal termination order on October 9, 2025), and OpenAI has since returned to standard retention. Logs preserved before September 26, 2025 may remain held for the litigation, and deletion-request logs originating in the EEA, Switzerland, and the UK were carved out from the start.

The practical implication: in normal times data is deleted per the terms, but a legal order (such as in litigation) can keep "deleted" data around for a while — and that actually happened. Treat putting sensitive data into a personal plan as something done with that exception in mind. The standard hedge is an out-of-scope plan (Enterprise / Edu) or ZDR. The litigation is fluid, so verify the current status against the court record.

Prohibited uses (AUP) — high-risk fields have special rules

The terms include an AUP (Acceptable Use Policy) listing what you may not do. Providers broadly prohibit illegal activity, child sexual abuse material, weapons/malware generation, attacks on critical infrastructure, impersonation/disinformation, and unauthorized tracking of individuals, and they set minimum-age and similar conditions (details differ by provider — verify).

The most overlooked part is the high-risk carve-out. Anthropic's Usage Policy (effective September 2025) requires, for advice or decisions affecting individuals in fields like law, medicine, insurance, finance, employment, housing, academic testing, and journalism, (1) review by a qualified professional before delivery (human-in-the-loop) and (2) disclosure that AI is being used. Unauthorized model training (imitation/distillation) from inputs and outputs is also prohibited. (Provider rules differ in kind, not just degree: Google's Gemini API Terms go further and flatly prohibit use "in clinical practice, to provide medical advice," or for medical-device functions — a ban, not a review-and-disclose carve-out.)

In other words, a service that puts AI output in front of users as professional advice without review can violate the AUP on that basis alone. If you're embedding AI in a product, check that your use case doesn't trip these prohibited categories, age requirements, or high-risk rules in each provider's AUP/terms.

Checklists by stance — different stances watch different things

The same six axes, but the axis that matters most shifts with your stance. Copy the block for your stance into your dev notes / PR description / internal checklist, and run it before you submit input or ship.

[Personal use — self-check before input / before shipping]
□ 1 Training: Did you check your plan's training default and opt out if it's a consumer chat plan?
□ 2 Commercial: If you sell the result, did you separate the basis — "service ToS" vs. "model license"?
□ 3 Output ownership: Do you understand that "yours" still means "not unique, and copyrightability is a separate question"?
□ 4 Liability: Do you accept that, under the terms, the duty to check and comply for hallucinations / third-party infringement falls on you first?
□ 5 Indemnity: Do you understand a personal plan is, as a rule, on the "not protected" side?
□ 6 Retention & AUP: Have you kept sensitive data out of personal plans? Are you clear of prohibited uses?

[Commercial release — building into a product / delivering work]
□ 1 Training: Is the path you send customer data through set to training-off (API / business / ZDR)?
□ 2 Commercial: Can you explain the commercial basis across both layers (service ToS + model license)?
□ 3 & 4 Output & liability: Have you reflected deliverable ownership and third-party-output risk in user-facing notices or contracts?
□ 5 Indemnity: If your use case needs indemnity, is it on a covered plan and clear of carve-outs (modification / combination)?
□ 6 AUP: For high-risk fields, have you built human-in-the-loop and AI disclosure into operations?

[Enterprise / API — adoption decisions & plan selection]
□ 1 Training: Did you confirm the training-off-by-contract clause on the business plan?
□ 2 Commercial: Did you organize the org-wide commercial basis across both layers?
□ 3 Output ownership: Did you reflect deliverable ownership and third-party-output risk in customer contracts?
□ 4 & 5 Indemnity: Is it a plan with Copyright Shield / IP indemnity, clear of carve-outs (modification / terms violation / high-risk use)?
□ 6 Retention: Did you assess ZDR and litigation-driven preservation risk (the NYT-order type)? Anything but Enterprise/Edu can fall within legal preservation.

Wrapping up — before you use it, read the terms along your stance's axes

AI service terms are long and change fast, but they read along six axes: input training, commercial use, output ownership, output liability, indemnity, and retention & prohibited uses. With those in hand, you can find "where the landmines are" on any service.

• The biggest asymmetry: personal plans lean "training on, no indemnity, and can fall within a preservation order," while API/business plans are "training off, indemnity available, and let you choose an out-of-scope plan." Same company, but it can run the opposite way at the entry point.
• "The output is mine" and "commercial OK" are only starting points. The uniqueness caveat, the as-is disclaimer, and the user's duty to check for infringement remain, and indemnity is limited to business/higher tiers with broad carve-outs.
• And the terms are about the contract. Whether training is permitted as a matter of law, and how to defend your own site from crawlers, are separate questions — covered in AI training data and crawlers.

Terms aren't only there to bind users; they're the agreement between provider and user. Once you understand how they work, there's no need to be overly afraid. A little effort before you use it prevents bigger trouble later.

This series also covers the pre-ship rights checklist, OSS licenses, the legal boundaries of scraping, and licensing third-party assets.

Sources / References

Primary sources first (tag (primary) = official terms, statutes, government documents, party statements; (secondary) = commentary, reporting). Provider terms change without notice, so everything reflects what we confirmed as of May 2026. Some OpenAI / GitHub clauses were cross-checked via secondary sources rather than the official terms text, and are marked "terms text to verify."

Anthropic

• Commercial Terms of Service (primary)
• Usage Policy (AUP) (primary)
• Consumer Terms of Service (primary)

OpenAI

• Terms of Use (ROW) (primary; terms text to verify)
• Service Terms (primary; terms text to verify)
• API data usage (Your data) (primary)
• How your data is used to improve model performance (primary; personal vs. business training defaults)
• Business Terms (primary; terms text to verify)
• Response to NYT data demands (official statement) (primary; to verify)

Google

• Gemini API / Generative AI Terms of Service (primary)

GitHub / Microsoft

• GitHub Copilot Product Specific Terms (2026-03-05 archive) (primary; an archived version for Business/Enterprise licensed directly from GitHub before 2026-03-05 — current new contracts have moved to the GitHub Customer Agreement / Microsoft Product Terms; the IP-indemnity substance is anchored by the Microsoft CCC below)
• Microsoft Customer Copyright Commitment — Required Mitigations (primary)
• GitHub Docs: "Finding public code that matches GitHub Copilot suggestions" (primary)

The timeline and scope of the preservation order in NYT v. OpenAI / Microsoft (case no. 1:23-cv-11195, S.D.N.Y.) are fluid; this article relies on OpenAI's official statement and secondary sources. Verify the current status against the court record (PACER / CourtListener).

On AI assistance: This article draws on the author's hands-on experience with the topics, used Claude (Anthropic) as an aid for research, structuring, and summarization, and was then composed after the author verified the primary sources (official terms, government documents, party statements). Because provider terms change without notice, effective dates, clauses, and plans in scope reflect what was confirmed at the time of writing. Where some OpenAI / GitHub clauses rely on secondary sources rather than the official terms text, that reliance is noted inline and in the references.

About the author

More than 20 years of electrical and software development — from control engineering at a major electronics manufacturer — plus about 10 years of solo development. Across hardware and software, and across enterprise and individual work, I publish the basics that "become a risk if you don't know them," and I plan to cover practical ways to use AI as well. More at About this blog.