If you assume your AI vendor indemnifies you for infringing output, the answer depends on which product you bought, which route you reached the model through, and what your team did to the output afterwards. An IP indemnity is a vendor's contractual promise to defend you and pay covered costs when a third party sues over its product. All four major vendors publish an indemnity for paid business use, and each one has conditions that a normal enterprise deployment can trip.
For seats, buy a paid Microsoft Copilot: it carries the Customer Copyright Commitment with no configuration duties on fixed-safety Copilots. For API work, Anthropic's Commercial Terms are the cleanest published text by a narrow margin, because they name both output and training data, carry no filter condition and sit outside the liability cap. Google Cloud comes second, and first if you fine-tune. OpenAI's direct API ranks last of the four on our reading: it loses the edited output in the scenario below, as Google does, and adds a wider guardrail condition. The route that needs the most checking is any partner model reached through a cloud catalog, where your platform's indemnity usually stops applying and cover depends on the model provider's own terms.
Terms were checked on November 9, 2026. This is a reading of published terms, and your negotiated paper overrides all of it.
| Route | Who qualifies | Training data named? | Conditions most likely to void cover | Cap as published |
|---|---|---|---|---|
| OpenAI API; ChatGPT Enterprise, Edu, Healthcare, Business | Customers under the Services Agreement and Service Terms | No | API section: filters or citation tools disabled, ignored or unused; output modified or combined. All: Beta Services | Uncapped |
| Microsoft paid Copilots | "Covered Product" under the Product Terms glossary | No | Safety systems disabled; known likely infringement; trademark use | Not stated in the commitment; read your volume agreement |
| Azure OpenAI in Foundry | Same glossary | No | All of the above plus required mitigations you must prove | Not stated in the commitment; read your volume agreement |
| Google Gemini, Imagen, Veo | Paid, listed GA services | Yes, as a separate indemnity | Output must be unmodified; filters or citations disregarded; Pre-GA | Uncapped |
| Anthropic direct | "Paid use" under Commercial Terms | Yes | Modification, combination, Inputs, known infringement, patent, trademark | Uncapped |
| Amazon Nova on Amazon Bedrock | Listed services, GA features | Not in Section 50.10 | Filters not enabled or instructions disregarded; infringement caused by fine-tuning; known infringement; trademark | No damages cap |
| Partner models on any cloud | The model provider's terms, if any | Varies | Varies; check each model | Varies |
What Each Vendor's Indemnity Says
OpenAI puts the output promise in a second document. Section 13.1 of the Services Agreement (version 010126) has OpenAI defend claims "alleging that the Services infringe any third-party IP Right," then excludes Customer Content, which the agreement defines as "the Input and the Output." Output cover therefore comes only from what the agreement calls the Service-Specific Terms Indemnity, which it says "is not subject to any liability cap" and which OpenAI "may not materially reduce" without your written agreement. The phrase buyers search for, Copyright Shield, does not appear in the Services Agreement.
The Service Terms extend the promise to claims that your "use or distribution of Output infringes a third party's intellectual property right." OpenAI's site refused a direct fetch of that page on November 9, so the wording here comes from the search index of the live page. Compare it with the current text before relying on it.
Microsoft's commitment turns on conditions. The Product Terms apply Microsoft's defense obligation to claims based on your "use or distribution of Output Content of a Covered Product" if you meet five conditions: you did not interfere with filters or safety systems, you did not modify, use or distribute output in a way you knew or should have known was likely to infringe, you had rights to the input, the claim is not a trademark claim about use in commerce, and you implemented any required mitigations. A Covered Product is "any Azure OpenAI model in Microsoft Foundry Models or any Copilot (excluding free Previews)" available for a fee or used with a paid subscription, per the glossary.
Google writes two indemnities. Section 20(i) of the Service Specific Terms covers "an unmodified Generated Output" from a listed service using Google's own models, and separately covers allegations "that Google's use of training data to create any Google Pre-Trained Model" infringes. The covered list names generally available Gemini, Imagen, Veo, Codey and PaLM models through the Gemini Enterprise Agent Platform API, and the terms exclude any use "provided to Customer free of charge." Pre-GA offerings are "not covered by any SLA or Google indemnity."
Anthropic's text is the shortest. Section K (effective June 17, 2025) defends "Customer's paid use of the Services," expressly including "data Anthropic has used to train a model that is part of the Services" and authorized Outputs. It covers judgments and Anthropic-approved settlements, and Section L.3.b takes indemnification out of the 12-month fee cap. The Service Specific Terms say Anthropic "is not obligated to provide any indemnity" for Beta Services.
AWS covers its own models and leaves others to their providers. Section 50.10 (terms updated November 5, 2026) defends claims that Generative AI Output from an Indemnified Generative AI Service infringes, with no damages cap, for generally available Amazon Nova features and a list of other services. It excludes a claim "if you have fine-tuned, refined, customized, or otherwise modified" the service and the alleged infringement "would not have occurred but for" that change.
Which Tiers Are Excluded From Copyright Indemnity?
Free and preview tiers are excluded across the board, and the wording differs by vendor. Google's terms remove free services directly, and its general terms cap liability for free services at $5,000. Microsoft excludes free Previews. Anthropic's text reaches only paid use, and consumer plans sit outside its Commercial Terms, which cover Claude for Work, Government, Education and API use. OpenAI's Service Terms name API customers and ChatGPT Enterprise, Edu, Healthcare and Business. AWS writes free tiers out of the list, for example "Amazon Q (excluding Amazon Q Developer Free Tier and AWS assistant Free Tier)."
Preview features catch more enterprises than free tiers do. OpenAI defines Beta Services as anything labelled "alpha, beta, preview, early access, or evaluation" and says it "WILL HAVE NO LIABILITY" for them. If your team runs a preview model in production, assume you have no indemnity for that traffic.
Do These Indemnities Cover Training-Data Claims?
Only Google and Anthropic name training data in the published indemnity language. Google's is a standalone promise, and Google described it in 2023 as covering allegations about its use of training data. Anthropic writes training data into the Customer Claim definition. Microsoft's commitment is limited by its own words to claims about output, and OpenAI's and AWS's output clauses do the same.
The strongest argument against caring is that training suits have mostly targeted model developers. Bartz v. Anthropic, which received final approval in July 2026 at $1.5 billion, was filed against the vendor. The Authors Guild's summary says the release covers past acquisition and copying and leaves claims based on outputs unreleased, so output claims remain open. Ask for named training-data cover anyway, because it costs a vendor little to confirm and removes an argument later.
How a Normal Deployment Trips the Carve-Outs
Run one workload through all four contracts: a paid customer on a generally available model, vendor filters left on, an internal RAG app that combines the output with company documents, an employee who edits the text, and a publisher who files a copyright suit over the published result.
Microsoft does best on the edit. Its condition only bites if you modify output "in a manner that it knows, or should know" is likely to infringe, so an ordinary edit stays covered. On Copilots with fixed safety systems, the required mitigations do not apply at all.
Azure OpenAI has the same edit language and much heavier upkeep. You need a metaprompt directing the model to prevent infringement, a retained testing and evaluation report you hand to Microsoft on a claim, and the protected material and jailbreak filters on. If you use the asynchronous filter, flagged protected text is not covered. Microsoft says a customer tendering a claim "will be required to demonstrate compliance," so a missing report is a coverage problem. Microsoft is also the only vendor that tells you exactly what to keep in the file. GitHub offerings have had no additional required mitigations since April 3, 2026, and Copilot Studio loses cover for a model hosted outside it unless that model runs in Azure OpenAI and meets the same mitigations.
Anthropic applies its exclusions "to the extent" the claim arises from modifications, from combining output with technology or content Anthropic did not provide, or from Inputs. That proportional wording helps on the edit. The combination and Inputs language is still a live problem for RAG, where the retrieved documents are your inputs. It also excludes "the practice of a patented invention contained in an Output," a carve-out Microsoft's commitment and Google's Section 20(i) do not list.
Google's word "unmodified" is the hardest test in the group: an edited paragraph is no longer unmodified output. Its general terms also exclude combinations with materials Google did not provide. Google is better than the others on tuning, covering Fine-Tuned Google Models and Customer Adapter Models if you hold rights to the tuning data.
OpenAI's Service Terms exclude output you modified or combined with non-OpenAI products, and output where you "disabled, ignored, or did not use" relevant citation, filtering or safety features. "Did not use" is the most explicit guardrail condition of the four, because it names a tool you never turned on, though Google's "disregards" can reach some of the same ground. Those exclusions appear in the API section, so Enterprise buyers should read their own section. In this scenario OpenAI direct and Google both lose cover on the edited text. OpenAI direct ranks last on the published wording, even with its uncapped liability and its written promise against reduction, because its guardrail condition is wider and its output clause does not name training data. The same GPT model through Azure OpenAI gets better edit language if you can keep the evidence file.
Why Your Platform Route Decides Who Pays
Claude has two indemnity positions on Microsoft's products alone, depending on how you buy it. Inside Copilot and Copilot Studio, Microsoft says the commitment "applies to Claude models used within products covered by the CCC." Models labelled "Anthropic models with Data Retention" are instead subject to Anthropic's Commercial Terms. In Foundry's catalog, models from other providers are "Non-Microsoft Products" and "subject to the terms provided with the models," and the Product Terms say Microsoft "assumes no responsibility or liability whatsoever for any Non-Microsoft Product." For Claude in Foundry, Microsoft says Anthropic is the seller and "Anthropic's terms of use govern your use of the Claude models," so that route also leads to Anthropic's paper.
On AWS, Section 50.12.1 treats third-party models as Third-Party Content, so the Nova indemnity does not travel with them. The Bedrock third-party terms vary by provider: Anthropic and most OpenAI serverless models are sold by those companies under their own defense clauses, Cohere has a Copyright Assurance, and Mistral's models are sold by AWS with a Mistral defense clause. Meta's entry on that page has no indemnity language and points to terms on a separate AWS documentation page. If your procurement sheet says "covered by AWS," it is wrong for most of the catalog.
Google's Section 19(b) disclaims indemnity for any Separate Offering, defined to include a model under "third party terms." Claude on Vertex AI appears to fit that definition. The only Vertex-specific Anthropic paper we found is a March 2024 version, which carries its own Anthropic defense clause. Anthropic's current Service Specific Terms (effective August 31, 2026) name Vertex as a cloud platform and say nothing about indemnity on that route, so ask Google and Anthropic which current document binds you.
Gateways and resellers add another gap. OpenAI's agreement indemnifies "Customer" and states there are "no intended third-party beneficiaries," so if a reseller or gateway holds the OpenAI account and you are its customer, you need that promise from the party you actually contract with.
Who Should Not Rely on Each Option
Skip a Microsoft Copilot as your indemnity answer if your agents use a model hosted outside Copilot Studio or the Data Retention Claude models. Skip Azure OpenAI if nobody will own the evaluation report and filter settings, or if you run the asynchronous filter on protected material.
Avoid leaning on Google's output indemnity if your people routinely edit generated text, or if you ship on Pre-GA models. Anthropic's terms are a poor fit if the whole product is retrieval and tool combinations and you cannot negotiate the combination clause. OpenAI direct is the wrong choice for teams that strip citations or skip safety tooling for latency, and for buyers who need training data named. Assume nothing from Bedrock unless you have read the entry for the exact model you call.
What Predicts Regret, and What to Negotiate
The clauses that cause regret are the ones that decide whether a claim reaches the indemnity at all. OpenAI defines a Claim as "legal proceedings filed by a third party," so a demand letter may not start the clock on OpenAI's obligations, while Anthropic's text reaches a "claim, suit, or proceeding." Google requires prompt written notice of allegations that preceded the proceeding and reduces its obligation "in proportion to the prejudice" if you are late, and it requires you to tender sole control. OpenAI and Anthropic also keep control of the defense, including counsel. Google's Indemnified Liabilities are limited to approved settlements and damages "finally awarded," and Fenwick warns separately that caps on these clauses can be set too low relative to real exposure.
The indemnified party is usually you and your people. Your own customers are outside it, and OpenAI's agreement has you indemnify OpenAI for Customer Applications. If you embed model output in a product you sell, that gap is yours to price.
Put these requests into the order form. OpenAI's agreement ranks the Order Form above everything else and protects signed forms from later updates, and Microsoft gives six months to adopt new mitigations.
This Week:
- List every route that reaches a model: seats, direct API, cloud catalog, gateway, reseller. Write the contracting party and the indemnity document beside each one.
- Find anything in production labelled preview or beta, and tell legal that it has no indemnity on the published terms.
This Month:
- If you run Azure OpenAI, assign an owner for the metaprompt, filter configuration and evaluation report, and retain them per application.
- Log model name and route with each generated output, so you can show which contract applied when a claim arrives.
Before Your Next Renewal:
- Ask for the combination and modification exclusions to apply only to the extent the claim would not have arisen without them, with retrieval named as covered.
- Ask OpenAI and Microsoft to name training-data claims, and ask every vendor to treat a written demand as a triggering event.
- Get a written answer on which party indemnifies each partner model you call.
The Bottom Line
Google and Anthropic both announced these promises in late 2023, and the risk that remains sits in the conditions and the routes. Manage the indemnity the way you manage an SLA, with a named scope and an evidence file for each application. Get the route inventory done before anyone tells the board you are covered.
Continue Reading
- Adobe, Google and Getty Offer Different AI Image Indemnities
- Croissant and OpenLineage Help Document Training Data Lineage
- Five AI Vendors Give Customers 0 to 90 Days to Get Data Out
- AI Vendor Security Review: 6 Questions That Change the Answer
- Bedrock vs Vertex AI vs Foundry: Your Cloud Commit Decides
- OpenAI, Azure, Bedrock, Vertex and Anthropic SLAs Compared
