AI Model IP and Distillation: What the Law Actually Says in 2026

The Anthropic/DeepSeek incident brought a question into sharp focus that the AI industry has been avoiding: who owns what when one model learns from another?

The answer, as of February 2026, is less clear than most people assume. Copyright law probably doesn't apply. Trade secret law is untested in this context. The primary enforcement mechanism is Terms of Service — contractual language with real but limited teeth.

This article breaks down the actual legal landscape. Not legal advice — consult qualified counsel for your specific situation — but a substantive analysis of where things stand and what it means for teams building with AI.

The Anthropic/DeepSeek Case: What Was Actually Alleged

In February 2026, Anthropic published evidence that three Chinese AI labs — DeepSeek, Moonshot AI, and MiniMax — had conducted industrial-scale distillation campaigns against Claude.

The specifics matter for understanding the legal dimensions:

• 24,000+ accounts created to distribute the query load
• 16 million+ exchanges with Claude across the three campaigns
• Systematic targeting of specific capabilities (reasoning, tool use, coding, agentic behaviour)
• Regional access circumvention — these companies operated from jurisdictions where Anthropic restricts access

Anthropic framed this as a violation of their Terms of Service and raised national security concerns about distilled models lacking safety guardrails. They did not, however, file a lawsuit (as of this writing). That's a significant detail.

Copyright Law: Why It Probably Doesn't Apply

The most intuitive legal framework for protecting AI outputs is copyright. If Claude generates text, shouldn't that text be protected?

The answer is almost certainly no, for several reasons.

AI-generated outputs likely aren't copyrightable. The U.S. Copyright Office has consistently held that copyright requires human authorship. In the Thaler v. Perlmutter decision (2023), a federal court upheld this position. AI-generated content — including model outputs — falls outside copyright protection.

Model weights aren't directly copied in distillation. Copyright protects expression, not ideas or methods. In distillation, you don't copy the teacher model's weights or code. You generate outputs (which aren't copyrightable) and use those outputs to train a new model. The resulting student model contains none of the teacher's copyrightable elements.

The "compilation" argument is weak. Some legal scholars have argued that a model's training represents a copyrightable compilation of knowledge. Courts haven't accepted this theory, and it faces significant conceptual problems — a model's learned representations bear no resemblance to the structured data compilations that copyright law protects.

The bottom line: under current legal frameworks, copyright is unlikely to offer meaningful protection against model distillation. Providers know this. That's why they rely on a different mechanism.

Terms of Service: The Real Enforcement Layer

Every major AI provider includes anti-competitive distillation clauses in their Terms of Service. These contractual restrictions do the work that copyright can't.

What Each Provider Prohibits

OpenAI — Their usage policies explicitly prohibit using outputs "to develop models that compete with OpenAI." The restriction is framed around competitive use — training models that directly compete with OpenAI's services.

Anthropic — Anthropic's terms are notably broader. Their Consumer ToS prohibits using services to "develop any products or services that compete with our Services, including to develop or train any artificial intelligence or machine learning algorithms or models." Their Usage Policy goes further still, explicitly prohibiting "utilization of inputs and outputs to train an AI model (e.g., 'model scraping' or 'model distillation') without prior authorization from Anthropic." Crucially, this applies to training any AI model — not just competing ones. At the same time, Anthropic assigns output ownership to customers: "we assign to you all of our right, title, and interest — if any — in Outputs." This creates an unusual tension: you own the outputs, but you cannot use what you own to train a model.

Mistral — Their commercial API terms restrict competitive model training. However, their open-weight model releases (Mistral 7B, Mixtral) carry different, more permissive licences.

xAI — Restricts use of Grok outputs for training competing models, with language similar to OpenAI's.

The Enforcement Gap

ToS-based enforcement has real limitations:

Jurisdictional reach. Anthropic is a U.S. company. DeepSeek operates from China. Enforcing U.S. contract law against a Chinese entity is possible in theory but practically difficult. International AI disputes lack established legal precedent and enforcement mechanisms.

Detection difficulty. Identifying distillation requires sophisticated behavioural analysis. The queries look like normal API usage. The outputs are standard model responses. Only the pattern — volume, targeting, systematic extraction — reveals the intent. This means smaller-scale distillation may be functionally undetectable.

The "use vs. distillation" boundary. Every API customer receives model outputs. Every customer stores those outputs. Some customers use stored outputs to inform future product decisions. Consider the progression: a SaaS company uses Claude to power a feature (permitted), logs the responses for product analytics (permitted), then fine-tunes a small classifier on those logs to reduce costs (prohibited). In all three cases, the company is using API outputs for its business objective. The ToS draws a clear line — training AI models is out — but the practical boundary between "using" and "training on" outputs becomes increasingly blurred as AI-powered products mature. And Anthropic's Usage Policy makes no exception for non-competing models: even a tiny internal classifier trained on Claude outputs technically requires prior authorisation.

Remedy limitations. Even when distillation is detected, the primary remedy is account termination and potential contract damages. The distilled model — once trained — can't be "un-distilled." The knowledge is already transferred. This is fundamentally different from, say, revoking a stolen software licence, where you can prevent further use.

Open-Source Model Licences: What They Actually Permit

The legal landscape looks very different for open-source models. Here's what the major licences allow:

Meta Llama (Community Licence) — Permits commercial use, modification, and creation of derivative works including through distillation. Requires attribution and disclosure of Llama's use. Monthly active user thresholds apply for some commercial uses (700M MAU requires separate licence).

Mistral (Apache 2.0 for open models) — Fully permissive. Commercial use, modification, distillation — all permitted with attribution. No restrictions on competing models.

Qwen (various licences) — Qwen 2.5 models are released under Apache 2.0. Commercial use and distillation permitted. Some larger models may have different terms — check each release.

Google Gemma (Gemma Terms of Use) — Permits commercial use and model creation. Some restrictions on redistributing model weights in certain contexts. Generally permissive for fine-tuning and distillation.

DeepSeek-R1 (MIT Licence for open weights) — Permissive. Commercial use and derivative model creation allowed.

The key point: if you're building on open-source models, the legal path is clear. You can distill, fine-tune, and deploy commercially. The ToS restrictions that create risk with closed APIs simply don't apply.

Skip the legal gray zone entirely. Fine-tune open-source models on your own data with Ertas. Join the waitlist →

The NVIDIA Framework: Doing It Right

NVIDIA published a framework for building licence-compliant synthetic data pipelines for model distillation. It's the closest thing the industry has to a "do it right" standard.

The framework's key principles:

1. Verify the licence of every model in your pipeline. Teacher models, student models, and any intermediate models used for data generation.
2. Document the provenance of training data. Track which model generated which training examples.
3. Separate licenced and unlicenced content. Don't mix outputs from permissive and restrictive models in the same training set.
4. Maintain audit trails. Record which models, versions, and configurations were used at each step.
5. Respect downstream restrictions. If a model's licence restricts certain use cases, those restrictions propagate to derivative models.

This framework matters because it establishes industry norms that will likely influence future regulation and legal precedent.

The Geopolitical Dimension

Anthropic's blog post explicitly raised national security concerns. Their argument: models distilled from frontier AI systems inherit capabilities but not safety guardrails. When foreign labs distil American models, the resulting models can be deployed for "offensive cyber operations, disinformation campaigns, and mass surveillance."

This framing positions distillation enforcement as a national security issue, not just a business dispute. The timing is notable — the announcement came as the U.S. was actively debating AI chip export controls and technology transfer restrictions.

For businesses, the geopolitical dimension adds regulatory risk to the equation. Future regulations may restrict cross-border model distillation, impose new reporting requirements, or create licensing regimes for AI model transfer.

Building on models you own and control insulates you from this regulatory risk. Models fine-tuned on open-source bases with your own data don't trigger cross-border transfer concerns.

What This Means for Your Business: The Risk Matrix

The risk matrix makes the strategic choice clear. Fine-tuning open-source models on your own data eliminates every category of legal risk while giving you model ownership and competitive differentiation.

Distilling from closed APIs combines high ToS risk, growing regulatory risk, and zero competitive moat (since anyone else can distil the same teacher). It's the worst combination of risk and reward.

The Safe Path

The legal landscape around AI model IP is evolving fast. New regulations are being proposed. Legal precedents are being established. The courts haven't yet ruled on most of the key questions.

In that environment, the safest and most strategically sound position is:

1. Use open-source base models with permissive licences (Llama, Qwen, Mistral)
2. Fine-tune on your own proprietary data — data you created, data you licenced, or data you have clear rights to use
3. Deploy on your own infrastructure — GGUF export to Ollama, llama.cpp, or LM Studio
4. Maintain documentation — track which models, data, and licences you used at each step
5. Monitor the regulatory landscape — new rules are coming, and preparation beats reaction

This approach gives you:

• Zero legal risk from distillation disputes
• Full ownership of model weights
• No vendor dependency
• Compliance with current and likely future regulations
• A competitive moat built on proprietary data

The DeepSeek story will generate lawsuits, regulations, and industry debates for years. You don't need to wait for those to resolve. The safe path is available today — and it's also the strategically superior one.

---

Own your models. Own your data. No IP risk. Ertas gives you the full pipeline from dataset to GGUF. Pre-subscribe at early-bird pricing →

Disclaimer: This article provides general information about the legal landscape surrounding AI model distillation and intellectual property. It does not constitute legal advice. Consult qualified legal counsel for guidance specific to your situation and jurisdiction.