AI copyright indemnity: the conditions that decide whether the vendor pays

The question worth asking about an AI vendor's copyright indemnity is not whether it exists. It exists at all three of the vendors below, and at two of them it sits outside the liability cap, which makes it one of the few genuinely unlimited obligations in the contract. The question is what you have to have been doing at the moment the output was generated, because that is what these clauses turn on.

What the three vendors actually promise

The shapes differ more than the marketing suggests. Microsoft does not write a standalone insurance policy at all: the Customer Copyright Commitment works by extending the intellectual-property defence obligation that already exists in your volume licensing agreement, and by switching off the reverse obligation you owe Microsoft. OpenAI and Anthropic write the promise directly into the terms you accept.

Microsoft's commitment is forfeited by a configuration setting

The Microsoft Product Terms attach five conditions to the commitment, and they are cumulative — the text says the defence applies "if all the following additional conditions are met". The first and the fifth are the unusual ones, because they are about how you configured the product rather than about what you did with the output.

That fifth condition is a live document rather than a fixed list. Microsoft publishes the required mitigations separately, each row with its own effective date, and gives customers six months from publication to implement a new one before coverage depends on it. New services, features and models can arrive with requirements effective immediately. The page also states the practical consequence plainly: a customer tendering a claim "will be required to demonstrate compliance with all relevant requirements".

The filters the commitment requires are optional features

This is the part that turns a contractual footnote into a real exposure. Azure's protected-material and jailbreak classifiers are not part of the default safety baseline; Microsoft's own content-filtering documentation describes them as "other optional classification models" whose use "is optional". The commitment requires several of them to be on, and to be on in a specific mode.

None of this applies uniformly across the Microsoft estate. The required-mitigations page limits itself to Azure OpenAI and other covered products with configurable metaprompts or safety systems; products whose safety systems are fixed carry no equivalent homework, and as of 3 April 2026 GitHub offerings have no additional required mitigations at all. Which product you bought decides how much of the compliance burden is yours.

The exclusions repeat across vendors, and that is where claims land

Read the three documents side by side and the same four carve-outs appear at all of them. That convergence is informative: it is the industry describing, in unison, the fact patterns it will not stand behind.

Two of the shared exclusions are far broader in practice than they look on the page. "Modified, transformed, or used in combination with products or services not provided by" the vendor, in OpenAI's wording, describes nearly every professional use: nobody ships raw model output. Anthropic's K.3(a) and K.3(b) say the same thing in two clauses. The exclusion is not a trap so much as an honest statement of what a defence obligation can cover — the vendor can stand behind what its model produced, not behind what you built out of it.

The "knew or should have known" exclusion does the other half of the work. It is the clause that answers the prompt engineered toward a named artist, character or article. A prompt naming the work you want to look like is evidence you should have known, and it is preserved in your logs.

The indemnity does not follow the output to your client

This is the gap the vendor comparison pieces rarely reach, and it is the one that matters to anyone delivering work for money. The promise runs to the customer. Anthropic's extends to "Customer and its personnel, successors, and assigns"; Microsoft's operates inside the customer's own volume licensing agreement. Your client is none of those things.

The practical drafting consequence: do not price the vendor's promise into what you are willing to warrant downstream. If you give a client an unqualified warranty that the deliverable is original and non-infringing, backed by an uncapped indemnity, you have taken on a risk that the vendor has already excluded on at least two grounds. That is the connection point with AI clauses in client contracts — the clause that allocates AI risk on your side of the chain is the only one you control. A SaaS agreement you sign as a customer and a service agreement you sign as a supplier are two different positions in the same chain, and the second is where the exposure sits.

Owning the output and being defended over it are different promises

All three vendors also assign the output. Anthropic "assigns to Customer its right, title and interest (if any) in and to Outputs"; OpenAI's Services Agreement 4.1 says the customer "owns all Output" and assigns OpenAI's interest "if any"; Microsoft states that output content is customer data and that "Microsoft does not own Customer's Output Content".

Note the two words both drafters chose: "if any". An assignment transfers what the assignor has, which where the output is purely machine-generated may be nothing at all — the subject of who owns AI-generated content. Ownership language tells you the vendor will not claim your file. It is silent on whether anyone else can, and that second question is the one the indemnity is about. Reading the assignment clause as reassurance about infringement risk is the most common misreading of these documents.

What to check before you rely on any of this

• Your tier. Anthropic's commitment covers "paid use" under the commercial terms; OpenAI's runs to API and named business tiers, and expressly not to beta services. Consumer and free accounts are a different document.
• Your configuration, in writing. For Azure, screenshot or export the content-filter configuration attached to the deployment, with dates. Coverage is proved by what was running when the output was generated, not by what is running when the claim arrives.
• Your evaluation report. Microsoft requires one to be retained and produced. A deployment that has never been red-teamed for third-party content reproduction fails a condition it has probably never read.
• Your logs. The "should have known" exclusion is decided on prompts. Retaining them cuts both ways, and a policy that never mentions them is not a neutral choice.
• Your own contract. The IP assignment and warranty language you give clients should not assume a defence you may not be able to tender.

The most useful thing about these documents is not the promise at the top. It is the list underneath it, which is the clearest published account anywhere of the fact patterns the model vendors believe are risky: outputs generated with the protected-material classifier off, prompts steered at a specific work, inputs the customer had no right to, and marks used in trade. That list is a better guide to where infringement exposure actually lives than the indemnity is a shield against it — and unlike the indemnity, it costs nothing to act on.