TL;DR: The output from AI platforms is important. Guardrails must prevent AI tools from regurgitating copyrighted materials. But a case currently under consideration in the Third Circuit — Thomson Reuters v. Ross — is being fought at the ingestion stage. It’s about a copy made for training. And I expect the Third Circuit’s opinion to reflect that non-infringing outputs won't save a platform if it made copies of copyrighted materials, then used those to train on a competitor's proprietary data to build a head-to-head substitute.

Two years ago I wrote about who is actually on the hook when copyrighted work gets pulled into an AI model. I walked through the service providers, the users, and the model creators, and I closed by flagging one case that did not fit the comfortable pattern. I promised to revisit that case. Here is the promise I made in Part 1:

“[T]he recent case of Thomson Reuters Enterprise Centre GMBH v. Ross Intelligence Inc., gives us a glimpse into a situation where one party used copyrighted materials in a more significant way. But we’ll review that case in detail in Part 2 of this Article.”

This is Part 2. Ross has now gone from a Delaware courtroom to the Third Circuit, and is on track to be the first federal appeals argument in the country on whether training an AI system on copyrighted material qualifies as fair use. The Third Circuit heard argument on June 11, 2026 (No. 25-2153). I read the transcript so you don’t have to, and I read trial Judge Bibas’s opinion twice.

The Background

Ross Intelligence built an AI-powered legal research platform meant to compete with Westlaw. To train it, Ross wanted Westlaw’s headnotes. Thomson Reuters said no, because Ross was creating a direct competitor. So Ross went to a vendor, bought roughly 25,000 “bulk memos” created from those headnotes, and trained on them. In Thomson Reuters Enterprise Centre GmbH v. Ross Intelligence Inc., No. 1:20-cv-613-SB, 2025 WL 458520 (D. Del. Feb. 11, 2025), Judge Stephanos Bibas held the headnotes original and protectable, found direct infringement on 2,243 of them, leaving other headnotes and questions of copyright validity for a jury, and rejected Ross’s fair use defense. He decided Factors One (purpose and character of the use—was it transformative?) and Four (effect on the market) for Thomson Reuters and Factors Two (nature of the copyrighted work) and Three (the amount and substantiality of the portion used) for Ross, then certified the question for the interlocutory appeal now in front of the Third Circuit.

Note that this is an AI decision, but not a generative AI decision. Ross is not a chatbot. It does not write your brief or hallucinate a case citation for you. A lawyer asks a question in plain language and the tool returns quotes from real judicial opinions. As Ross’s counsel put it at argument, “[t]here’s no [Westlaw] headnotes in what we teach the public… [i]t’s just quotes from the judicial opinion.” That fact is at the heart of this decision.

Where Part 1 Holds Its Ground

In Part 1 I drew a line between mainstream, guard-railed, generative models on one side and copying that does real competitive damage on the other. That is exactly the line the Third Circuit spent the time arguing about.

Both advocates agreed on the boundary, which almost never happens. Ross’s lawyer told the Third Circuit panel, “you cannot just say AI.” Thomson Reuters’ lawyer, Dale Cendali, made the same point from the other direction, warning the court that “[y]ou can’t just say AI and have that just be across all fact patterns.” Judge Montgomery-Reeves pinned it down with Ross directly.

JUDGE MONTGOMERY-REEVES: … [Y]ours is not generative AI, right?

MR. DAVIES: It’s not generative AI, Your Honor…

A tool that copies a competitor’s editorial work to build a substitute for that same competitor is in a completely different category from a generative model trained on a vast and varied corpus. Judge Bove framed the stakes in plain terms near the end of the oral argument, calling the case one “about balancing what we have and where are the red lines.” The line is substitution, and Ross stepped over it. Bibas drew the same line in his district court opinion, pausing to clarify that “only non-generative AI is before me today.” In other words, he went out of his way to keep Gen AI out of this holding.

Where Part 1 Needs Sharpening

Bibas revised his own 2023 opinion in this very case, and he opened with a line I loved, that “[a] smart man knows when he is right; a wise man knows when he is wrong.”

In Part 1 I emphasized the idea that a copyright violation requires a “publication,” and I argued that feeding material into a model is not a publication because the information will not come out of the LLM in an exact replication, so there is no infringement in putting copyrighted material into an LLM. That framing may have been too generous to the model builders. Infringement turns on the exclusive rights in Section 106 of the Copyright Act, and the reproduction right under Section 106(1) stands on its own. According to District Court Judge Bibas, the copies made to assemble and ingest the training set are themselves the infringing acts. Distribution is a separate right, and you do not need it for liability to attach.

Look at how Ross actually lost. Ross never showed a copyrighted Westlaw headnote to a user; that would have clearly been publication and distribution. Instead the Ross search results were quotes from ‘non-copyright-able’ judicial opinions, and that clean output actually gained the Third fair-use Factor—the amount and substantiality of the portion used—for Ross, because Ross made no headnote “accessible to a public for which it may serve as a competing substitute.” But Ross lost anyway. The court found that the infringing copies were in the training data. LegalEase built roughly 25,000 bulk memos out of Westlaw headnotes, Ross trained on nearly all of them, and Bibas found actual copying and substantial similarity on 2,243 headnotes. Clean output did not cure the fact that a copy was made to put into the model.

Two corrections follow for anyone familiar with my earlier framework. First, as to copying, copyright infringement is largely a strict liability tort. I described creator liability as something that turns on a reckless or intentional state of mind, e.g. the builder who knowingly lets protected work leak back out. In fairness to my earlier statement, there’s an active academic debate about whether the overall structure including fair use and secondary liability is truly strict liability, but I should have qualified it. What matters here is that Ross had no such intent on the output side, and it did not matter. Ross argued innocent infringement to mitigate statutory damages; the court rejected that argument based on the presence of copyright notices.

Secondly, Part 1 cited Authors Guild v. Google, Inc., 954 F. Supp. 2d 282 (S.D.N.Y. 2013), and credited the holding to the Second Circuit. That reporter cite is the district court. The Second Circuit’s affirmance, the one Bibas himself relies on, is Authors Guild v. Google, Inc., 804 F.3d 202 (2d Cir. 2015). And that court’s reasoning helped Ross, especially in regard to the Third Factor, because Ross put no headnotes in front of the public. What beat Ross was Factor One and Factor Four, purpose and market effect.

Training vs. Copying

Key to AI and copyright protections is the knowing the difference between copying and training. Training is a purpose; copying is an act. The threshold question in copyright infringement —did you reproduce protected expression?—does not turn on purpose. Section 106(1) is strict liability, and making the copy is the violation. Purpose re-enters one step later, when one tries to use a fair use defense.

The first question is was protected expression reproduced at all? If a system ingests only facts or ideas, Section 102(b) and Feist Publications, Inc. v. Rural Telephone Service Co., 499 U.S. 340 (1991), say there is nothing to infringe. Second, if a copy was made, was it licensed or excused by fair use?

Was A Reproduction Made?

In considering whether a copy was made, it helps to separate the copies a copyright claim might target. Start with the original work; the book, article, magazine, image or piece of art. If a copy of it is made for ingestion by an AI model, as it was in Ross, that is the first copy. The second copy is the information residing in the model itself; whatever information is embedded in the model’s trained weights. Technically, those weights are a compressed, parametric representation of the training data, not literal page‑by‑page copies. Whether they qualify as a ‘copy’ for copyright purposes is contested. Some scholars argue they should be treated as compressed reproductions, others disagree.

An LLM does not store a clean copy of every work it learned from, and it usually cannot reproduce them verbatim—with the possibility of heavily duplicated works. Which leads us to the third copy; the output the tool hands back to a user. Guardrails and refinements in newer models make verbatim extraction much harder, and the best-defended systems resist it well. But even with all of that, verbatim output is still not impossible—the memorized text remains in the weights, and guardrails only filter what surfaces. As recently as 2026, researchers pulled large portions of copyrighted books—well over 70% of a single title from several production models, some without any jailbreak. Only one consumer model resisted almost entirely. Which helps the New York Times since that is the theory they maintain against OpenAI.

Think of it this way. A lawyer can read Westlaw, internalize it, and write their own original headnotes -- no liability. A lawyer can learn from a book without infringing, but the infringement occurs if the lawyer photocopies the book to learn from it without a license or fair use, even if they discard the infringing photocopy afterward.

Was There a Justification for Making a Copy?

Ross’s argument was that it copied Westlaw’s materials only to reach the underlying, un-copyrightable law. That is the intermediate-copying rationale it used in trying to shelter that copying under the software reverse-engineering cases, where courts treated intermediate copying of computer code as fair use. Bibas called those cases “inapt.” They are about programs that “serve functional purposes,” and in each one the copying “was necessary” to reach unprotected functional elements. Sega Enterprises Ltd. v. Accolade, Inc., 977 F.2d 1510 (9th Cir. 1992); Sony Computer Entertainment, Inc. v. Connectix Corp., 203 F.3d 596 (9th Cir. 2000); Google LLC v. Oracle America, Inc., 593 U.S. 1 (2021).

Headnotes are not code, and as Bibas put it, “[t]here is nothing that Thomson Reuters created that Ross could not have created for itself or hired LegalEase to create for it without infringing.” In other words, copying does not earn a pass just because it happens during training. Headnotes are protected editorial expression, not functional code where copying is technologically necessary to reach unprotected elements.

A Market for the Data

The most consequential part of the ruling is what Bibas did with Factor Four. He recognized a market for AI training data itself, and he held that harm to that market counts, writing that “it does not matter whether Thomson Reuters has used the data to train its own legal search tools; the effect on a potential market for AI training data is enough.” He reached that market as a potential derivative one, the kind “creators of original works would in general develop or license others to develop.” Ross did not put forward enough evidence to show the market was not there.

This actually vindicates the economic point I made at the end of Part 1, that the authors’ real grievance is about a licensing market. Creators deserve to be rewarded for the content they create — that is the whole point of copyright law. The backup theory of unjust enrichment I suggested in Part 1 is perhaps the long way around, but I think it still holds legal weight.

The Generative AI Cases

While Ross was in process on its way to a decision in the Third Circuit, two California judges handed AI developers real wins, and those cases are instructive. They are discussed in greater detail in a separate article, but following is a short consideration to show how Gen AI must be considered differently than non-generative AI.

In Bartz v. Anthropic, PBC, No. 3:24-cv-05417 (N.D. Cal. June 23, 2025), Judge Alsup called training on lawfully acquired books “exceedingly transformative” and held it to be fair use, while ruling that downloading and warehousing millions of pirated books in a permanent library was not. In Bartz the infringing conduct was not the training itself but the downloading and warehousing of pirated books; training on lawfully acquired copies was fair use, so provenance was the catchpoint. In Kadrey v. Meta Platforms, Inc., No. 23-cv-03417-VC (N.D. Cal. June 25, 2025), Judge Chhabria handed Meta a fair use win on training, then went out of his way to say the plaintiff authors lost because they failed to develop a market-dilution argument, not because the law was on Meta’s side. He all but invited the next set of plaintiffs to make that argument.

Read the three together and what we learn is that generative training on a broad, lawfully obtained corpus has a strong transformativeness. Copying to build a head-to-head substitute does not. Provenance matters—hello data governance--because pirated inputs (copyright infringements) sank part of Anthropic’s defense. Market harm matters most of all, as noted by Chhabria.

The Substitution Line, and a Forecast

Put Ross, Bartz, and Kadrey on a continuum. On one end sits transformative use: generative training on a broad, lawfully acquired corpus, which Alsup called “exceedingly transformative.” On the other sits substitution: copying a competitor’s editorial work to build a head-to-head replacement for that same competitor, which is what sank Ross. Transformativeness (Factor One) and market harm (Factor Four) are not two questions, but one question asked in a different way, in practicality if not in court practice. The more a use substitutes, the less it transforms, and a substitution strains the market the original owner was going for. In other words, the more of one, the less of the other; they sit on a sliding scale rather than in separate boxes.

Here is my forecast, offered only as a prediction. I expect the Third Circuit to affirm on liability, and to do it narrowly. The panel worked hard at argument to fence generative AI out of the holding—Montgomery-Reeves pinned Ross’s counsel down that this “is not generative AI,” and Bove described the case as one about “where are the red lines.” A court that careful to box in its ruling is one I’m expecting to be a court preparing to rule against the copier while leaving the generative question for another day and another set of facts. If I am right, the opinion affirms on Factors One and Four, blesses a licensing market for training data, and expressly reserves the generative-AI question—handing the next set of plaintiffs--the Bartz and Kadrey authors--the market-dilution theory Chhabria all but invited.

If the Third Circuit affirms, this becomes the first appellate ruling squarely on AI training and fair use. And I feel the need to remind readers that these are not new principles created for a new technology. Current principles being applied to new technology is sufficient. Fair use has always asked about purpose and market. The courts are just applying that to machine training and output now.

The Bottom Line

This case is different than other AI copyright cases. Ross had clean output and still lost because it trained a competing product on the competitor’s own copyrighted work, and because it did not need that copyrighted material work to build its own product. Common sense. Data provenance and licensing are governance question now. If ignored they can become litigation questions later. If a licensing market for training data is real—and I believe that’s where we’re headed—then “we only trained on it” will keep losing in court. All of which brings me back to my catchphrase of the year, “Data governance is everything when it comes to AI.”

I will write a short follow-up when the Third Circuit rules. Until then, watch Factor Four.

© 2026 Amy Swaner. All Rights Reserved. May use with attribution and link to article.