Intellectual Property Considerations in RAG System Development

Retrieval-Augmented Generation (RAG) combines source material, search, and model-generated answers. Each stage can raise different questions about copyright, licences, contracts, confidentiality, or personal information. There is no universal rule that makes a RAG workflow lawful—or unlawful—just because it uses embeddings or short excerpts.

Reviewed October 3, 2026. This guide is general information, not legal advice. Copyright exceptions, licence terms, and AI-related rules vary by jurisdiction and can change. Have qualified counsel review your sources and use case.

Separate the rights questions across the RAG flow

RAG is not the same thing as model training: a typical RAG application retrieves source passages at query time and supplies them as context to a model. Indexing, embedding, storing, displaying retrieved text, and generating an answer are distinct operations to assess—not one generic “AI use.”

Clear the source before it enters the index

Being easy to download or visible on the web does not automatically mean a work is public domain or licensed for every use. An employee’s access to a document also does not necessarily give the organisation permission to repurpose it in a chatbot.

1. Record the source, creator or rights holder when known, acquisition date, and how the organisation obtained it.
2. Capture the actual licence or contract version, permitted purposes, attribution requirements, territory, term, and any limits on copying, automated analysis, or redistribution.
3. Separate material the organisation owns or has licensed from customer uploads, public web content, partner data, and content with unclear provenance.
4. When permission or terms are unclear, pause ingestion and obtain permission or legal review; do not treat attribution alone as a substitute for rights.
5. Keep a removal path for expired or challenged material across source files, chunks, vectors, caches, derived summaries, and applicable logs or backups.

Do not rely on a “safe” excerpt size or broad fair-use claim

There is no universal token or word limit that makes a quotation lawful. Shortening passages, summarising them, or adding a citation may reduce some risks or improve user experience, but none of those steps alone establishes permission. Test whether outputs can reproduce substantial or distinctive passages, and prevent answers from revealing material the user is not allowed to access.

“Fair use” is a United States doctrine; other jurisdictions may use different exceptions or fair-dealing rules. In the U.S., fair use is assessed case by case under statutory factors—there is no blanket exemption for internal search, commercial systems, or any particular RAG design. The U.S. Copyright Office Fair Use Index is a research resource, not a decision about your facts. For the EU, the Copyright in the Digital Single Market Directive includes text-and-data-mining provisions with conditions; local implementation and the facts still matter.

Make permissions enforceable in the product

• Preserve provenance. Carry source IDs, licence notes, version, and permitted-use labels into the index so teams can trace a result back to its source.
• Respect the user’s access. Apply source permissions at retrieval time; do not rely on a prompt instruction to protect documents a user should never receive.
• Use citations carefully. Link to original sources where appropriate, but do not expose a restricted title, URL, or passage to a user who lacks access.
• Test outputs. Include attempts to elicit long verbatim passages, confidential data, expired material, and content from another tenant or permission group.
• Review vendors and contracts. Check how each search, embedding, model, logging, and hosting provider may use, retain, or onward-transfer the material.
• Keep exceptions and removals auditable. Record approvals, notices, complaints, takedown requests, and the systems in which a source was removed.

Open licences are not interchangeable. For example, a Creative Commons licence can carry conditions such as attribution or ShareAlike, and its deed may not cover privacy, publicity, or other rights. Read the specific licence and confirm that the licensor had authority to grant it.

Further reading and legal review

• South Africa: Copyright Act 98 of 1978 (check later amendments and current local interpretation).
• U.S. Copyright Office: Copyright and Artificial Intelligence reports (U.S. materials; the Office labels its Part 3 training report pre-publication).
• U.S. Copyright Office: Fair Use Index (case summaries, not legal advice).
• EU Directive 2019/790, including Articles 3–4 on text and data mining.
• Creative Commons: understand the licence conditions.

Use a source-rights register, access tests, and deletion procedures as engineering controls—not as a claim of automatic compliance. Before a production launch or material change, ask counsel to assess the relevant works, licences, jurisdictions, contracts, and intended outputs.