AI developers who train large language models on copyrighted code just cleared a significant legal hurdle. On September 16, 2026, the 9th Circuit affirmed dismissal of the plaintiffs’ claim in Doe v. GitHub, Inc. under Section 1202(b) of the Digital Millennium Copyright Act, holding that Copilot does not “remove or alter” copyright management information from an existing work when it generates code, because it creates a new work rather than reproducing a stored one.
What Happened
A group of programmers who published open-source code on public GitHub repositories alleged that Copilot and Codex sometimes reproduce their code without the attribution, copyright notices, or license terms that accompany the original files. They framed this as a violation of the DMCA’s copyright management information (CMI) provisions rather than as ordinary copyright infringement, likely because the DMCA allows statutory damages of up to $25,000 per violation.
The plaintiffs raised two distinct theories. Under the first, an “input” theory, GitHub and OpenAI supposedly stripped CMI from licensed code before feeding it into Copilot’s training data. The panel refused to consider this theory at all, finding that the plaintiffs had forfeited it by failing to correct the district court’s repeated statements that the case was not about training.
That left the second theory, the “output” theory. Copilot allegedly reproduces near identical or identical copies of a programmer’s code in response to user prompts, without the CMI attached to the original. The 9th Circuit agreed the plaintiffs had standing to bring this claim, since they plausibly alleged a substantial risk that their code would eventually be reproduced this way. But standing only got them in the door.
Why the Claim Failed on the Merits
The court’s reasoning turns on what it means to “remove or alter” CMI. Judge Eric Miller’s opinion holds that both verbs describe an affirmative act performed on something that already exists. You cannot remove or alter CMI from a work unless there was a copy of that work, with its CMI attached, in the first place.
Copilot, according to the complaint’s own description, does not retrieve and display stored files the way a search engine does. It identifies statistical patterns in the training data and generates a new output based on the most probable completion of a prompt. Because the resulting code is a newly created work rather than a reproduction of an existing one, the court held it never contained CMI to remove or alter in the first place.
The opinion is careful to note that this is not a strict identicality requirement. Minor cosmetic edits will not save a defendant who otherwise reproduces a protected work wholesale and strips its CMI. What matters is whether the output can fairly be described as a copy of an existing work missing its CMI, or whether it is a new work that never had CMI attached to begin with. On the facts alleged here, the court placed Copilot’s output in the second category.
The court also flagged the stakes of ruling otherwise. Treating ordinary substantial similarity between an AI output and a protectable work as enough to state a Section 1202(b) claim would let the DMCA’s enhanced statutory damages swallow traditional copyright infringement claims, which cap statutory damages at $30,000 per work rather than per violation. The panel declined to let a DMCA claim do that work.
What This Means for Your Business
This decision does not resolve whether AI-generated code or other AI outputs infringe copyright. The panel expressly said it was not deciding that question, and the plaintiffs’ breach of contract claims against GitHub are still pending in the district court. What this decision does is close off one aggressive route to statutory damages against AI developers, at least within the 9th Circuit and at least on an output theory framed the way these plaintiffs framed it.
For companies building or licensing generative AI tools that train on copyrighted or licensed material, the practical lesson is to document how a model actually generates its output, not just what it was trained on. The plaintiffs here lost in large part because their own complaint described Copilot’s process in terms that supported the court’s characterization of its output as a new work, so companies defending similar claims will want a clear, accurate technical record showing the model predicts likely completions rather than retrieving stored files. That said, this ruling is no shield against copyright infringement exposure generally. The court repeatedly distinguished the DMCA claim from a traditional copyright claim and noted that substantial similarity between an output and a protected work could still support an infringement theory, so that analysis remains a live risk entirely separate from CMI removal.
There is also a procedural lesson buried in how this case unfolded. The plaintiffs’ input theory, arguably a stronger fit for the DMCA’s text, never reached the merits because counsel failed to correct the district court’s understanding of the complaint early in the case. Any company litigating a novel theory should track how a court characterizes its claims at each hearing and object on the record when that characterization is wrong, since an uncorrected mischaracterization can forfeit a theory entirely.
Looking ahead, the DMCA claims may not be the last word in this dispute. With those claims narrowed, the plaintiffs’ breach of contract theories, based on the open-source licenses attached to their code, remain pending before the district court, and that may be where the more consequential precedent on AI training and output eventually comes from. It is also worth watching whether other circuits adopt the same reasoning. The panel leaned on a 5th Circuit decision reaching a similar conclusion, but acknowledged that print-media examples do not map neatly onto generative AI, so other courts may draw the line between a new work and a copy with CMI removed differently as more AI cases reach the appellate stage.
Key Takeaways
- The 9th Circuit affirmed dismissal of the plaintiffs’ DMCA output theory against GitHub, Microsoft, and OpenAI, holding that Copilot’s generated code is a new work rather than a copy from which CMI was removed or altered.
- The plaintiffs forfeited a separate “input” theory, based on CMI allegedly stripped during training, by failing to preserve it after the district court repeatedly said the case was not about training.
- The plaintiffs did have standing to bring the DMCA claim, since a substantial risk of future reproduction without CMI was enough at the pleading stage.
- The ruling does not decide whether AI-generated code infringes copyright, and the plaintiffs’ breach of contract claims tied to open-source license terms remain pending.
- Companies building or defending generative AI tools should document how their models generate output, preserve every legal theory at every stage of litigation, and watch the contract claims for the next significant development in this case.









