Blog
Articles in the "Rights" category.
Data you hand to US providers (OpenAI, Google, AWS) is reachable by the US government through the CLOUD Act, FISA 702, and NSLs — fast — while a non-US government's MLAT route averages ~10 months, and Japan has no CLOUD Act executive agreement. The sovereignty asymmetry the EU litigated in Schrems II, mapped for builders.
Read moreWhat happens to data you hand to AI/cloud services after you delete it? Retention, government access (CLOUD Act, FISA, NSL), managed enclaves, and the EU view (GDPR, Schrems II) — mapped for builders, kept separate from the training-use question.
Read morePublishing on GitHub, collaborating abroad, or making controlled technology accessible to non-residents can put software inside an export-control regime — though most public OSS clears the publicly-available exemption. The dual-use logic, a five-category screen, US EAR / ITAR and EU Dual-Use basics, and a self-diagnosis checklist.
Read moreAI regulation pulls in different directions: the EU's risk-based hard law with extraterritorial reach, a US federal layer that swings by administration plus a state patchwork, and Japan's promotion-first model. An attribute-based screen for which regime actually reaches you.
Web-accessibility "mandates" are widely misread. In the US the ADA imposes a duty of access but no binding WCAG standard for the private sector; the EU EAA is an enumerated list with exemptions; WCAG is mandated directly only for government. The accurate scope for builders.
Whether AI-generated work gets copyright turns on human creative contribution; prompt-only output is hard to protect in Japan, the US, and the EU. Separate copyright from the service contract and from disclosure duties, with per-jurisdiction tests.
Read moreIf a contract is silent, the deliverable's copyright usually stays with the maker — "we paid for it" is not enough. The default rules, copyright-assignment clauses (work made for hire, the 17 U.S.C. §204(a) signed writing), moral rights, and USPTO/EUIPO trademark screening, for both the hired and the hiring side.
Read moreOnly a CDN-level block actually stops an AI-training crawler; robots.txt, X-Robots-Tag, and noai signal intent and leave a record. A four-layer defense stack, host-by-host setup, and where US fair-use and EU DSM litigation now stands.
Read moreAI service Terms are a contract, distinct from the underlying model license. Read them across six axes — training opt-out, commercial use, output ownership, liability, indemnity, retention — for personal, commercial, and enterprise-API cases.
Read moreA US/EU-focused guide: when you scrape — or let an AI fetch pages — sort your case into four legal lenses (CFAA, copyright/fair use, GDPR, contract) before you use the data. Covers hiQ, Meta v. Bright Data, the Ross/Bartz/Kadrey AI-training split, and Clearview.
Read moreRoyalty-free and free mean neither zero cost nor unlimited. Before you use any image, music track, AI-generated asset, Creative Commons work, or font, check commercial use, caps, modification, credit, and redistribution — with a font-by-use table.
Read moreBefore adopting third-party OSS, identify its tier by SPDX identifier and reconcile it with your linking and distribution form to see what source-disclosure duties reach your code — from MIT to AGPL, plus the source-available trap and case law.
Read moreA pre-ship rights check for US/EU developers: copyright exceptions (fair use, EU DSM Art. 4), AI-generated work (human authorship, the EU AI Act), and the four-tier OSS license spectrum.
Read more