The Law Can't Keep Up

In The Uncomfortable Parts I worked through the things about AI-assisted development that I benefit from and haven't resolved, and the training-data question was the one I left most openly unfinished. I said the lawsuits were unresolved and that "unresolved" was doing a lot of heavy lifting, because what it actually meant was "no, and we're hoping the courts sort it out."

I've since spent more time looking at whether the courts actually can sort it out, and I don't think they can, at least not on any timescale that matters. The problem isn't that the institutions are getting it wrong, it's that they're built to move at a speed the technology left behind years ago. That mismatch is the reason almost every uncomfortable part stays uncomfortable, so it's worth talking about in its own article.

A delay measured in model generations

The clearest example is the one closest to me. Anthropic, whose API my entire development workflow runs through, agreed last year to settle the Bartz class action for $1.5 billion, the largest copyright settlement in US history, covering roughly 500,000 books pulled from shadow libraries [1]. The fairness hearing was held on the 14th of May this year. As I write this, almost a month later, there's still no final approval order. The judge took it under submission and ordered more briefing on a handful of late opt-outs [1]. A billion-and-a-half-dollar agreement that both sides want approved is still not done.

I'm not pointing at that to criticise the court. The process is careful for good reasons. I'm pointing at it because if the fast path through this, a settlement nobody's really contesting, still takes this long to land, the slow path is hopeless. The New York Times sued OpenAI in December 2023. Two and a half years later it's still in discovery, the most recent milestone being a fight over whether OpenAI has to hand over twenty million ChatGPT logs [2]. There's no summary judgment, no trial date, nothing that looks like an answer.

And here's the part that makes the delay more than an inconvenience. The models named in these filings are already gone. The cases litigating what was scraped to train a 2022 or 2023 model are arriving at a point where those models have been retired and replaced twice over. By the time a court produces a precedent, it's a precedent about a machine nobody runs any more. The law doesn't just arrive late, it arrives late to a thing that no longer exists.

The same technology, opposite verdicts

If the slowness were the whole story you could at least wait it out. The bigger problem is that the answers coming back don't agree with each other, because every court is improvising against a different statute with no settled framework to lean on.

In November last year the UK High Court handed Stability AI a win, rejecting Getty's core copyright claim and holding that AI model weights aren't "infringing copies" [3]. That sounds like a landmark, except a month later Getty was granted permission to appeal the whole thing, with the judge herself calling the central question "novel and important" with "far-reaching ramifications" [3]. So the landmark is provisional, and the real answer is another couple of years away up the appeal chain.

Meanwhile, in the same month, a court in Munich went the other way entirely and held an AI developer directly liable for training on protected material [4]. Same broad technology, same broad question, opposite outcome, different country. There's a US fair-use trend pointing one way, a German ruling pointing the other, and a UK ruling that's now on appeal and could flip. If you're trying to work out what the rules are, the honest answer is that there aren't any yet, there are just a scattering of first attempts that contradict each other.

This is what it looks like when institutions are overtaken. It isn't silence from the institutions, instead it's a noisy, incoherent set of partial answers. Even though each one is technically reasoned, none of them add up to a thing you - or any business - could actually plan around. The lawsuits I was "hoping would sort it out" are currently sorting it out into several incompatible piles.

Some of the slowness is the point

It's worth being fair to the institutions here, because not all of the delay is dysfunction. A lot of it is the system working as designed, and the design has reasons behind it.

A court can't rule until someone sues, and then it can only decide the case actually in front of it, on the evidence both sides put up. It doesn't get to issue a general pronouncement on how AI training works and have everyone fall in line. The fight over those twenty million ChatGPT logs isn't the court stalling, it's the court refusing to decide something this consequential on incomplete facts, which is more or less what you'd want it to do. The common law builds precedent case by case on purpose, so that one bad call doesn't immediately become the rule everywhere. A legal system that moved fast enough to keep pace with AI would also be a legal system fast enough to get AI badly wrong and lock the mistake in for a decade. The caution is doing a job.

Legislation has the same brakes built in even harder, the consultation, the committees, the need for enough people to agree, all of which exist precisely to stop bad law getting passed in a hurry. The EU AI Act took years partly because binding rules on an entire industry should be hard to pass.

So I want to be careful not to pretend this is all just bureaucratic drag, even if some of it genuinely is. The truthful position is that the slowness is mostly the price of getting it right, and that's exactly what makes it such an uncomfortable problem. You can't reasonably ask the courts to be reckless, and you also can't wait for them, because the careful answer arrives years after you needed it. The thing that makes the law trustworthy is the same thing that makes it useless to me - and many of you - right now.

Regulators drafting for yesterday's model

Legislation is meant to be the answer to all of this, the thing that sets a rule prospectively instead of fighting it out case by case after the fact. But even setting the slowness aside, it has a second problem the courts don't, which is that whatever it does manage to pass is aimed at a target that's already moved.

The EU AI Act's transparency and general-purpose-model disclosure rules become enforceable in August this year [5]. They were drafted against an understanding of "general-purpose AI" that crystallised in 2023 and 2024. By the time they bite, the frontier has moved through several generations of capability the drafters weren't writing about, which means we get rules carefully tuned to a snapshot of the technology that's already historical. New filings keep landing faster than any of this can absorb them. CNN sued Perplexity in late May, the ninth major organisation to do so, over a product category that barely existed when the Act was being negotiated [6]. The regulator finishes writing the rules for the last thing roughly as the next thing arrives.

I don't think there's a clean fix for this. You can't draft regulation faster than you can understand what you're regulating, and you can't understand a moving target. You also can't draft the legislation too broadly, because that just results in lawsuits to clarify what's meant by broad legislation. The structural mismatch is real, so let's not pretend a better-resourced agency would close it. It might narrow the gap, but it won't catch up.

Sitting with it, again

Here's where this lands for me, and continues to be uncomfortable. In audit and security, the whole discipline rests on the idea that someone sets the rules and you're accountable to them. The control framework exists, the standard exists, and your job is to demonstrate you met it. When the rules don't exist yet, that entire model breaks down, and the risk doesn't disappear. Instead it just falls back onto whoever's actually doing the thing.

That's me. I'm building regulated software on tools whose legal foundations are being argued over in courts that won't finish in time to help me, under regulations written for models I'm not using, while the company I depend on settles a copyright case that still isn't final. "The lawsuits will sort it out" turns out to be a way of saying "someone else is accountable for this," and the longer I look at the timelines the less I believe anyone is.

I used to write findings against exactly this posture. "We're waiting for guidance" was never an acceptable answer when the activity was already happening, because the activity doesn't pause for the guidance to arrive. The information that the guidance is years away is itself available. I have it. And I'm carrying on anyway, which puts me back in the position I keep landing in with this whole subject: not ignorant of the problem, just deciding to live with it, and trying at least to be specific about what "it" is.

And I should be honest about which side of this I'm sitting on. My discomfort is the comfortable kind, risk I've chosen to accept on tools I get a lot of value from. The people with the real grievance are the authors and artists whose work was used without their consent, and for them the same slow process isn't an abstract governance problem, it's years of waiting to find out whether they'll ever be paid or even asked. My work didn't get scraped. Theirs did.

The institutions we'd normally rely on aren't going to rescue us from this on a useful timescale. They're doing their jobs at the speed those jobs run at, and the technology is simply running faster. Whatever accountability there's going to be in the meantime is the kind we impose on ourselves, and that's a thin and unreliable thing to be leaning on. But for now it's most of what there is.

Sources

1. Authors Guild — What Authors Need to Know About the Anthropic Settlement — $1.5B settlement, ~500,000 works, largest US copyright settlement. Fairness hearing held 14 May 2026; as of the latest docket updates the court took final approval under submission and ordered supplemental briefing on late opt-outs rather than entering an approval order. Hearing recap: Authors Alliance; status tracking: AI Lawsuit Tracker — Bartz v. Anthropic. 2. Bloomberg Law — OpenAI Must Turn Over 20 Million ChatGPT Logs, Judge Affirms — Judge Sidney Stein affirmed the magistrate's order compelling production of 20M logs (January 2026). The NYT v. OpenAI matter, filed December 2023 and now consolidated as an SDNY MDL, remains in discovery with no summary-judgment ruling or trial date. Background: National Law Review. 3. Pinsent Masons — Getty's copyright case against Stability AI fails — UK High Court judgment of 4 November 2025 rejecting Getty's secondary copyright claim (model weights not "infringing copies"), finding only limited historic trademark infringement. Getty was granted permission to appeal in full at the December 2025 consequentials hearing: Taylor Wessing — Next steps for Getty v Stability. 4. Bird & Bird — Landmark ruling of the Munich Regional Court (GEMA v. OpenAI)-on-copyright-and-ai-training) — November 2025 ruling holding an AI developer directly liable for unlicensed use of protected lyrics, contrasting with the US fair-use trend and the UK Getty outcome. 5. European Commission — AI Act — General-purpose AI transparency and disclosure obligations become enforceable on 2 August 2026, drafted against a 2023–2024 understanding of general-purpose models. 6. TechTimes — AI Regulation 2026: CNN Sues Perplexity, OpenAI Aligns to EU Rules — CNN filed against Perplexity on 28 May 2026, the ninth major organisation to sue the company; same article covers the EU AI Act August 2026 enforcement milestone.