Copyright’s silent frontier: AI memorisation, inference and retrieval-augmented generation

Manuel Durães Rocha

Abreu Advogados, Lisbon

manuel.rocha@abreuadvogados.com

Margarida Castillo Silva

Abreu Advogados, Lisbon

margarida.c.silva@abreuadvogados.com

The problem: copyright does not stop at the data centre door

Imagine a user asks a system to recite a poem. The model was not given the poem at that moment. It simply remembers it, encoded, invisibly, in billions of numerical parameters trained on data ingested years earlier. Courts in Germany have held that this is reproduction. Courts in England have held that it is not.

Now consider a second scenario: an artificial intelligence (AI) assistant is asked to summarise today’s news. The system does not ‘know’ the answer. It reaches out to the internet, pulls three articles from a paywalled newspaper, loads them into its working memory and generates a response. No article appears verbatim in the output, and no one could say that the machine ‘copied’ anything. Yet under the copyright law of several European Union Member States, each step in that chain – retrieval, temporary storage, processing – may independently constitute an act of reproduction, with no available exception to shield the operator.

These scenarios are likely to represent the next wave of AI copyright litigation. They arise not from the training of a model, but from its everyday operation and, as this article shows, they extend beyond memorisation and retrieval-augmented generation (RAG) to inference itself, run on an already trained model with no retrieval component at all.

Model memorisation: the ghost in the weights

AI model ‘weights’ are numerical parameters, compressed statistical representations of patterns extracted from training data. The orthodox technical position is that weights are not copies: they contain no human-readable text and do not reproduce any work in a recoverable form. Based on this view, the Munich Regional Court’s reasoning in GEMA v OpenAI (LG München I, 42 O 14139/24, November 2025) is radical: the Court held that OpenAI’s model memorised lyrics and, therefore, contained reproductions of the relevant works under Article 2 of Directive 2001/29/EC, otherwise known as the InfoSoc Directive, triggering liability for hosting those weights in-jurisdiction.[1] This decision, however, is not yet final: OpenAI has appealed, so the Munich Court’s approach to memorisation currently represents first-instance decision only.

The English High Court took the opposite position in Getty Images v Stability AI, holding that model weights themselves do not contain copies of the training data.[2]

This divergence highlights that an AI operator that localises compute infrastructure in a given jurisdiction is itself subject to that jurisdiction’s copyright law related to upstream training, even where the training itself took place elsewhere. Under lex loci protectionis (Article 5(2), Berne Convention; Article 8(1), Rome II Regulation), copyright protection is governed by the law of the country where protection is claimed. Where a court has accepted jurisdiction on the Pinckney/Hejduk basis,[3] this principle will, in practice, typically point back to its own law as the substantive standard against which the alleged infringement is measured.

Inference as an independent act of reproduction

Even setting memorisation aside, running an already trained model to generate outputs, with no RAG component, engages copyright in two independent ways that no court has yet resolved.

The first is straightforward: output reproductions. Where an AI output contains an extract of a protected work that reflects the author’s intellectual creation, a rightsholder can argue that the output is an infringing reproduction. Consistent with the Court of Justice of the European Union’s (CJEU) approach in Infopaq (C-5/08), what matters in this context is whether the extracted fragment reflects the author’s own intellectual creation.[4]

The second vector is more novel: technical reproductions during inference. A rightsholder may contend that running inference itself creates copies of protected expression, not in the output, but in the computational process. This depends on the memorisation thesis: it requires showing that the model weights encode protected expression that is activated and reproduced from memory when responding to a prompt. This remains an untested proposition rather than settled doctrine, but the underlying logic is a straightforward conditional: if the memorisation thesis fails, this vector likely fails with it; if it succeeds, inference on locally located compute would, based on that reasoning, become the moment of reproduction, locating the infringing act within the jurisdiction. No court has yet been asked to draw this connection explicitly.

RAG: the architecture that changes everything

RAG is architecturally different from standard inference. When a user submits a prompt, the system retrieves passages from an external index or by crawling the internet, loads them into the model’s context window and generates a response grounded in that content. Whether this results in permanent storage is architecture specific: where content is loaded for a single inference call and neither cached nor logged, no permanent storage of that copy occurs. In practice, however, many production RAG systems cache retrieved passages, embeddings or model states across queries to reduce latency and cost and log prompts and outputs for auditability. Each such cache or log is a separate act of storage, distinct from the transient context-window copy, carrying its own copyright exposure.

In this sense, RAG materially elevates the copyright risk profile in two ways.

• First, indexing and storage. Building a RAG index necessarily involves copying third-party content into a searchable store, which constitutes reproduction. Unlike model weights, where the memorisation argument is contested, the reproduction in a RAG index is unambiguous: the content is stored in human-readable form, retrievable on demand. The same applies to any additional persistent cache of retrieved passages or embeddings.
• Second, retrieval and context-window loading. Each time the system retrieves a passage and loads it into the context window it engages the reproduction right again, regardless of whether the content appears verbatim in the output. Whether this falls outside the temporary copying exception under Article 5(1) of InfoSoc Directive depends on whether the copy is cached. Where the passage is discarded at the end of the call with no persistent caching, the exception’s transience requirement may in principle be satisfied, but the exception is still unlikely to help, since a commercial RAG system loads the content for a monetised purpose with independent economic significance, taking it outside the ‘lawful use’ the exception permits. A court could, therefore, readily conclude that loading copyrighted content for a commercial RAG response falls outside Article 5(1) whether or not it is cached, and that caching only strengthens the case for infringement.

The failure of available exceptions

Text and data mining (TDM)

The TDM exception, pursuant to Article 4 of Directive (EU) 2019/790 on copyright and related rights in the Digital Single Market (the DSM Directive), allows the reproduction of lawfully accessible works for TDM purposes where rightsholders have not adequately reserved their rights. TDM, under Article 2(2) of the DSM Directive, is defined as ‘any automated analytical technique aimed at analysing text and data in digital form in order to generate information which includes but is not limited to patterns, trends and correlations’.

RAG is unlikely to satisfy this purpose requirement, although not because it fails to generate ‘patterns or trends’. Article 2(2) of the DSM Directive’s definition of TDM is deliberately non-exhaustive on that point (‘includes but is not limited to’). The more powerful distinction is structural: TDM presupposes an analytical technique applied to a corpus to generate information about it, whereas RAG retrieves a specific document promptly in order to surface, and often substantially reproduce, its content in the output: here the reproduction is the point of the operation, not a preparatory step towards an analytical result. That takes RAG outside TDM within the statutory meaning, without resting on an unduly narrow reading of Article 2(2).

However, a related question arises as to how far the TDM exception extends within the lifecycle of a trained model absent any RAG component, that is, in relation to the model’s core training and generative functions rather than external retrieval. The Munich Regional Court in GEMA v OpenAI addressed this in the training context: the TDM exception covers the preparatory assembly of the training corpus, but does not extend to memorisation of protected works fixed within the trained model itself, since this exceeds the mere analytical evaluation of patterns, trends and correlations that TDM is designed to permit.[5] The Court did not decide whether the same reasoning extends to ‘proper’ inference, that is, running an already trained model to generate outputs, divorced from training-stage memorisation. That question remains open. Recital 105 of Regulation (EU) 2024/1689, otherwise known as the AI Act, confirms that TDM techniques ‘may be used extensively’ in developing generative AI models, and much of the literature reads this, together with Articles 3 and 4 of the DSM Directive, as settling that the TDM exception covers model training. That confirmation, however, is generally understood to concern the training/pre-training stage specifically, not the model’s subsequent operational life. Extending TDM to inference on the strength of the AI Act’s holistic regulatory framing remains, at most, a contestable analogy but one that merits closer scrutiny as the relevant case law develops.

Temporary copying

Article 5(1) of the InfoSoc Directive exempts temporary reproductions that are transient or incidental, form an integral and essential part of a technological process, have no independent economic significance and whose sole purpose is to enable a lawful use or transmission. As noted above, whether a RAG copy is transient is architecture specific. Where the system caches or logs retrieved content beyond the single inference call, as many production systems do, those copies are persistent by design, and the exception cannot apply at all. Even absent caching, the exception is still unlikely to assist: the content is loaded to generate a commercial output, and inference is precisely what AI licensing markets have begun to price. Courts are therefore likely to find the ‘no independent economic significance’ condition unmet regardless of technical transience.

The exception may nonetheless remain relevant, in principle, where the RAG system retrieves content at promptly rather than from a permanent cache, and the copy is neither cached nor logged afterwards. Even then, the ‘no independent economic significance’ condition will typically remain the harder hurdle for a commercial deployment to clear. This is, in any event, the narrowest and most defensible form of RAG from a copyright standpoint.

Conclusion

The training debate, while unresolved, has attracted extensive academic and judicial attention. The operation debate has not, and it is not one debate but three: model memorisation and its territorial consequences, inference itself as an independent act of reproduction and the elevated, multilayered risk profile of RAG. None of these three questions have been resolved yet by a court. Yet inference is where AI deployment is accelerating most rapidly, and where the financial exposure may ultimately be greater: an emerging licensing market for AI inference activities gives courts market rate comparables for damages, making a substantial award realistic where infringement is found at scale.