AI vendor risk management

AI Vendor Risk Assessment: A Screening Framework to Use

Published: Updated: by

By Tom Morgan

TL;DR: AI copyright liability in 2026 hinges on three checkable facts about a vendor: whether a live lawsuit targets how training data was acquired rather than what it outputs, whether an EU-market model has a published training-data summary, and whether the indemnity clause predates the vendor’s most recent training-data suit. A settlement on one dataset says nothing about the next — below is the screening flow, then the sourced case law that produced it.

Why your questionnaire misses this

Vendor security reviews are built for encryption and SOC 2 status. Almost none of them ask how an AI vendor acquired its training data — which is exactly the variable that has cost Anthropic $1.5 billion so far and counting. The gap isn’t confusion about the law. It’s that liability here is claim-specific, dataset-specific, and jurisdiction-specific — a shape no standard questionnaire was built to catch. Here’s one that is.

The screening flow

Three checks, run against any AI vendor before signature:

A vendor proposes a model. Check 1: is there a pending suit against the vendor about data acquisition rather than outputs? Check 2: is a training-data summary published for this model’s EU release, if applicable? Check 3: does the indemnity clause name training-data claims, not just outputs? A flag on any single check routes to high risk and escalation to legal review. Clearing all three routes to low risk and standard contract terms. Three Checks: Every Flag Routes the Same Way Vendor proposes a model Check 1 — Any pending suit against this vendor about acquisition, not outputs? Check 2 — Training-data summary published for this model’s EU release (if applicable)? Check 3 — Does the indemnity clause name training-data claims, not just outputs? clear clear clear on all three Low risk Proceed with standard contract terms High risk Escalate to legal review before signature — any single flag is enough to land here flag flag flag
Read top to bottom: a flag on any single check — regardless of the other two — routes to the same escalation box. Only a vendor clear on all three reaches low risk.

Here’s what each check requires in practice, and what makes it hard for a vendor to fake:

Check 1 — a live suit about acquisition, not outputs. Anthropic’s music-publisher suits allege illegal acquisition of training data — the same category of claim that produced the $1.5B book settlement — not claims about what Claude generates for users. A vendor can have a clean output-indemnification clause and still be exposed here, because the claim never touches outputs at all. Don’t ask “any pending litigation?” — ask specifically whether any pending case is about how the data was obtained. (Sources for the suits referenced here are listed at the end of this piece.)

Check 2 — a published EU training-data summary, if the model is sold there. Any GPAI model placed on the EU market after August 2, 2025 was already required, under Article 53(1)(d) of the AI Act, to publish one using the European Commission’s template [1]. A vendor that can’t produce one, or hasn’t tried, has a documentable gap you can point to — independent of what any court eventually decides about legality. Worth knowing before you grade a summary as sufficient diligence: the template’s “top scraped domains” requirement isn’t “all scraped domains,” and the “unreasonable burden” carve-out providers use to explain gaps is self-certified, with no independent check before the AI Office’s enforcement powers activate in August 2026.

Check 3 — an indemnity clause dated after the vendor’s most recent training-data suit. If the indemnification language was negotiated in 2024 and the vendor has since been sued multiple times over different datasets, the clause almost certainly wasn’t drafted with those claims in mind. Check the contract’s effective date against the vendor’s litigation timeline, not just its content — a competent legal team can often patch this gap with a side letter faster than a vendor can resolve active litigation, so it’s a real flag but rarely a dealbreaker on its own.

If you only change one thing this quarter, make it Check 1. It’s the one that can produce a judgment or another multi-hundred-million-dollar settlement regardless of what any contract says, because it doesn’t run through the customer relationship at all.

What actually produced this framework

Each check above traces to a specific ruling or filing from the past thirteen months. The headlines around them have mostly obscured the narrower, more useful thing each one actually decided — so here’s what’s checkable in each, with sources.

Anthropic’s book settlement drew one boundary, not blanket immunity

In June 2025, Judge William Alsup found that training a large language model on legally acquired, purchased books is fair use — but that Anthropic’s downloading of millions of books from pirate repositories like Library Genesis was not [2]. That distinction, not training itself, is why Anthropic settled for $1.5 billion rather than risk a trial with potential damages plaintiffs argued could reach hundreds of billions. Alsup has since retired from the case; Judge Araceli Martínez-Olguín granted final approval on July 20, 2026, after 91% of the roughly 482,000 certified works filed claims — an unusually high rate for a class action [3].

The release covers only past acquisition and copying, through a fixed date. It says nothing about outputs, future conduct, or any other dataset — which is exactly why four separate music-industry suits exist against the same company: Universal Music Publishing Group, Concord, and ABKCO’s $3 billion claim over 20,000+ works, filed January 2026 [4]; BMG’s suit over 493 compositions, filed March 2026 [5]; Round Hill Music’s suit over its 14,000-composition catalog, filed August 17, 2026; and — eight days after final settlement approval — Sony Music Publishing and Warner Chappell’s joint suit [6], which brought the publishing arms of all three major music companies into active litigation against Anthropic at once.

Getty v. Stability AI turned on jurisdiction, not legality

The UK High Court rejected Getty’s core copyright claim against Stability AI in November 2025, but Getty had conceded there was no evidence training occurred in the UK and abandoned its primary claim before closing arguments. The remaining secondary claim failed because the court found a trained model’s weights aren’t a “copy” of the training images under UK law. A plaintiff who can prove training happened inside a given jurisdiction could get a different result from the same court — this ruling doesn’t foreclose that.

NYT v. OpenAI is still open, and the DOJ just weighed in

The Times is seeking not just damages but a court order to destroy GPT models trained on its work — a request no AI copyright case has yet succeeded on. On September 1, 2026, the DOJ filed a Statement of Interest in the consolidated MDL arguing LLM training is “extraordinarily transformative” fair use — reportedly the first time the federal government has taken a position in an AI training-data suit [7]. The filing is persuasive, not binding, and leans on national-security framing rather than pure copyright doctrine. No trial date is set.

Where this framework runs into its own limits

None of this produces certainty. Getty is expected to appeal, and a different fact pattern before the same UK court could reach a different result. NYT v. OpenAI could settle, go to trial, or run for years without resolving the injunction question. The EU’s disclosure regime is untested — how strictly the AI Office applies “unreasonable burden” exceptions, once enforcement powers activate in August 2026, remains to be seen.

There’s also a leverage problem: smaller enterprises negotiating standard commercial terms with a major lab have little room to demand bespoke indemnification language, whatever the ideal contract would say. For those buyers, the realistic version of this framework isn’t “negotiate better terms” — it’s documenting what was asked and what was received, so that if the risk materializes, the record shows a reasonable review took place rather than no review at all.

That documentation matters because transparency and legality aren’t the same thing, and the 2026 regulatory response has mostly delivered the former. The EU can compel a training-data summary; it cannot compel that summary to describe a lawful process. A vendor can hand over a clean disclosure document and still be the defendant, two years later, in a case that finds how that same data was gathered was unlawful — at which point the disclosure becomes evidence, not protection. Waiting for the law to fully settle before adopting AI tools means waiting indefinitely; the more useful move is treating training-data provenance as a standing item in vendor risk review, re-checked against each new lawsuit a vendor accumulates, not signed off once and filed away.

Sources

  1. European Commission AI Office, template for the public summary of training content under Article 53(1)(d) of the EU AI Act — WilmerHale summary
  2. Judge William Alsup’s June 2025 fair-use ruling in Bartz v. Anthropic — reporting via Pearl Cohen
  3. Final settlement approval, July 20, 2026 — Authors Guild
  4. UMPG, Concord Music Group, and ABKCO’s January 2026 suit — TechCrunch
  5. BMG’s March 2026 suit — Music Business Worldwide
  6. Sony Music Publishing and Warner Chappell’s August 2026 suit — complaint via Music Business Worldwide; coverage
  7. DOJ Statement of Interest, September 1, 2026, In re: OpenAI, Inc. Copyright Infringement Litigation, MDL No. 1:25-md-03143 — public docket