Model Weights, Watermarks, and Memorisation: UK, German, and US Primary-Source Signals on Generative AI and IP

Generative AI providers are now facing materially different answers to a deceptively simple question: when does a model “contain” protected content, and who is responsible when that content shows up in outputs.

In late 2025, the High Court of England and Wales (Chancery Division) and the Regional Court of Munich I each issued detailed rulings tied to real-world model behavior, while the USPTO’s Appeals Review Panel issued a precedential patent-eligibility decision that is directly relevant to ML training inventions.

In the UK, Getty Images (US) Inc v Stability AI Ltd turned on a narrow set of claims that survived to trial. The court recorded that Getty’s “Outputs Claim” and “Training and Development Claims” were abandoned, leaving (i) trade mark infringement allegations tied to “synthetic” watermarks in generated images, and (ii) a novel secondary copyright theory aimed at downloads/importation of the Stable Diffusion model itself. The result was a mixed trade mark win for Getty on limited evidence, paired with a clear rejection of the secondary copyright importation theory for the model weights.

On the trade mark side, the court treated infringement as evidence-driven and version-specific. Getty established infringement in respect of certain iStock watermarks under section 10(1) and section 10(2) of the Trade Marks Act 1994, but the findings were expressly confined to specific example outputs and did not extend to a broader conclusion about scale. The court dismissed Getty’s section 10(3) dilution claim, and it declined to address passing off on the way the case had been advanced. It also found no evidence supporting section 10(1) infringement for Getty Images watermarks, and it found no UK evidence of users generating Getty/iStock watermarks for certain later model versions referenced in the pleadings.

The UK decision’s most consequential point for genAI developers was the court’s treatment of “infringing copy” in the secondary infringement provisions of the Copyright, Designs and Patents Act 1988. The court accepted that an “article” can be intangible, then held that an “infringing copy” must still be a “copy” in the statutory sense. On the facts found, the Stable Diffusion model in its final iteration did not store the claimant’s images, and the model weights were described as the product of learned patterns and features from training rather than stored copies. That conclusion disposed of the importation/distribution theory under sections 22 and 23 (as pleaded) because the model was not an “infringing copy,” even if training involved storing copies elsewhere during the training process.

Germany has moved in the opposite direction on closely related concepts. In a case brought by GEMA against the operators of a GPT-based chatbot (models referenced in the judgment include “4” and “4o”), the Regional Court of Munich I (LG München I) treated memorisation as the hinge point. The court found that the disputed song lyrics were “reproducibly” embodied in the model parameters, and that the “work” could be made perceptible through simple prompts, which was sufficient for a reproduction analysis under German law’s technology-neutral understanding of fixation and perceptibility. The court granted injunctive relief against reproducing the lyrics “in” the language models and against making the lyrics publicly available via outputs, along with information and damages findings in principle.

The Munich court also drew a sharp line on text-and-data-mining. It accepted that the German text and data mining exception (UrhG § 44b, implementing DSM Directive Article 4) can cover preparatory reproduction acts involved in assembling a training corpus. It then held that the memorisation of protected works within the model during training was not merely “text and data mining” and was not covered by § 44b, because the relevant reproductions did not serve the data analysis purpose that justifies the exception. In the court’s framing, the exception cannot be stretched to legitimise reproductions that reach beyond analysis and directly interfere with rightsholders’ exploitation interests.

The Munich decision is also operationally important on attribution of conduct. The court treated the model operators as the responsible actors for reproductions caused by outputs where the prompts were “simple” and did not meaningfully dictate content. It held that the operators retained “Tatherrschaft” (control over the act) in that scenario, rather than shifting responsibility to the user as “prompter.” This matters for consumer-facing chat products, because it ties liability to controllable system choices: training data selection, training execution, and model architecture.

In the United States, the USPTO’s Appeals Review Panel (ARP) moved in a different direction, addressing patent eligibility of AI training inventions rather than IP infringement risk. In Ex parte Desjardins, the ARP treated the claims as reciting an abstract idea at Step 2A, Prong One (mathematical calculation), then held the claims integrated that abstract idea into a practical application at Step 2A, Prong Two because the claim limitations were tied to technical improvements in continual learning and model efficiency: reducing storage requirements and preserving performance across sequential training, addressing “catastrophic forgetting.” The ARP vacated the Board’s § 101 new ground of rejection (without disturbing other aspects of the Board’s prior decisions). The USPTO then issued an advance notice of change to the MPEP to reflect the decision’s implications for examination practice.

For product and legal teams operating across these jurisdictions, the combined signal is clear: “weights versus copies” is not a universal answer, and memorisation behavior is now a litigation fact, not a purely academic risk. UK exposure in this set of facts centred on trade mark and consumer perception issues tied to output artifacts (watermarks), while Germany treated the same category of model behavior (verbatim or near-verbatim retrieval from training data) as a reproduction that can occur “in the model,” paired with operator responsibility for outputs triggered by minimal prompts. US developments, at least at the USPTO, are simultaneously encouraging applicants to frame ML training inventions in terms of concrete technical improvements rather than “math in the abstract.”

Practical mitigations that map to these rulings are not exotic. They include disciplined dataset provenance and opt-out handling, memorisation testing designed to detect verbatim recall, output controls for protected-corpus requests (lyrics, long passages), and product decisions that reduce the probability of generating confusing trade marks or brand-identifying artifacts. Where model weights are distributed, teams should also evaluate whether the legal theory in a given forum treats downstream distribution as distribution of a “copy,” and what evidence will be used to prove (or disprove) storage/containment of protected works.

---

If you would like to discuss how these developments affect model training, deployment, licensing posture, and product controls, our team at Prokopiev Law Group can advise on both AI/content risk and adjacent digital-asset matters. Examples include: tokenised IP, NFTs, DeFi, stablecoins, staking, DAOs, RWAs, custody, MiCA compliance, VASP licensing, AML/KYC.

Disclaimer: This document is for informational purposes only and does not constitute legal advice. The information provided is based on publicly available sources and may not reflect the latest legal developments. Readers should seek professional legal counsel before acting on any information contained in this document. Some parts of the text may be automatically generated. The views presented are those of the author and not any other individual or organization.