Rules and risks

How the rules work

Copyright. Prompts alone don't make you an author, the Copyright Office said in January 2025, though human selection, arrangement or modification can, and the Supreme Court declined Thaler's case for an AI author on March 2, 2026. On September 16, 2026 the Ninth Circuit, in Doe v. GitHub, upheld the dismissal of the claim that Copilot and Codex break the DMCA by producing code without the original's copyright notices: generating new code isn't "removing" anything. The court didn't decide whether training on the code was lawful, and breach-of-licence claims are still pending. I found no lawsuit against a company for using AI-suggested code, so for buyers ownership looks settled enough. Copyright protection for a mostly AI-written codebase is thinner, and most companies rely on trade secrets and contracts anyway.

Data and indemnities. The plan tier decides most of it.

Liability caps are in Liability allocation.

Regulated change control. PCI DSS requires bespoke code to be reviewed before release, and if the review is manual the reviewer can't be the originating author. The PCI Security Standards Council's AI principles (September 11, 2025) add that an AI system gets its own trackable, revocable credentials, can't take responsibility or give management approvals, is logged with a named human responsible, and should be treated as a potential malicious insider; it announced further AI guidance on October 7, 2026. EU financial firms under DORA must separate whoever requests and builds a change from whoever approves it. SOC 2 had no AI-specific criteria as of August 2026. US bank supervisors' April 2026 model-risk guidance leaves generative and agentic AI out, so banks govern them under their existing risk practices. A person who prompts an agent and approves its change fails segregation of duties in all of these.

EU product rules. The AI Act puts few duties on coding tools themselves; general-purpose model duties sit with the labs. The Cyber Resilience Act has required reporting of actively exploited vulnerabilities and severe incidents since September 11, 2026 (24 hours, 72 hours, 14 days), and its main obligations start on December 11, 2027. From December 9, 2026 the revised Product Liability Directive treats software as a product with liability without fault. Both fall on the seller, whoever wrote the code.

What mistakes cost

Let's say an engineer at the invoicing company lets an agent run commands against the cloud provider's API with their own token, and the agent deletes a production volume. If the company spends $150-250 per developer a month with the agent's vendor, its enterprise cap is 12 months of fees, $360,000-600,000. But lost data, lost revenue and consequential damages are excluded, and the terms put the risk of automatically run commands on the user, so the expected recovery is close to zero. An IP claim on an unmodified suggestion is the one case where the vendor pays.

Most of these are old control failures: production credentials in reach, no separation of environments, backups on the same volume, no confirmation before a destructive call. The actor is new. What's new in the attacks is that issue text, comments and rules files are now instructions an agent may follow. The tools have had their own holes too, such as CamoLeak, a hidden-comment attack on Copilot Chat that GitHub fixed in August 2025.

Supply-chain risk has an AI flavour. In a USENIX 2025 study, 19.7% of code samples referred to at least one package that doesn't exist, and 43% of those made-up names came back every time the prompt was repeated, so attackers can register them in advance. GitGuardian, which sells secret scanning, found that commits co-authored by one coding agent leaked secrets at 3.2%, against 1.5% overall. And in SusVibes, an academic benchmark presented at ICML 2026, the best agent setup solved 57% of 186 real-repo tasks correctly but only 11.8% securely.