Who owns the code? Copyright and AI-generated output in the workplace

The use of artificial intelligence in intellectual production has become routine across sectors. Software engineers craft prompts to generate working code. Designers instruct AI systems to produce visual output. Media professionals rely on generative AI to create content that previously demanded hours of human creative effort. Many businesses assume - implicitly, if not explicitly – that IP generated by their employees using AI belongs to the business. That assumption deserves scrutiny. 

The starting point is settled: AI cannot be an author or copyright holder under Norwegian law. The Copyright Act provides that the person who creates a work holds the copyright and is designated as the author. This "person who creates" refers, under established Norwegian law, to a natural person. Copyright can only arise in favor of natural persons - not legal persons such as companies - based on the premise that only natural persons are capable of creating. A machine cannot be an author, and this is not in dispute.

The more difficult question is whether the employee who operates the AI tool qualifies as the author of the output – and whether, if so, the copyright passes to the employer. 

For something to constitute a copyright-protected work under the Copyright Act, it must satisfy the threshold of originality (Nw: “verkshøyde”). A work is protected only where it constitutes a literary or artistic work of any kind that is "an expression of original and individual creative intellectual effort.", cf. Section 2 of the Copyright Act. 

The Norwegian Supreme Court has formulated the threshold as follows: A work must be the expression of the author's original intellectual effort; it must be the result of an individually characterised creative effort, and that effort must have produced something that appears original (cf. HR-2017-2165-A para 66).

The EU Court of Justice has expressed the same principle by requiring that the work must be “original in the sense that it is the author’s own intellectual creation” (see the EU Court of Justice’s judgment of 16 July 2009 in case C-5/08 Infopaq International A/S v. Danske Dagbladets Forening para 37). 

The critical implication for AI-generated output is this: If AI has generated the code, the design, or the text in its entirety – without the employee exercising a genuine, individually characterised creative effort – the output will likely not qualify as a copyright-protected work at all. There is simply no human author whose intellectual creation it is. The AI's statistical output, however sophisticated, is not a "creative intellectual effort" in the legal sense. The output falls into a gap; it is neither owned by the AI system (which cannot hold rights) nor by the employee who prompted it (whose contribution may be insufficient to constitute authorship), nor by the employer (who only acquires right to what the employee had to give).

The law does not draw a bright line between "sufficient" and "insufficient" human contribution. The analysis is fact-specific and falls along a spectrum.

At one end: A software engineer types a brief, descriptive instruction ("write a function to sort a list by date") and accepts the AI's output without modification. The human contribution here is minimal, generic, and unlikely to constitute the kind of individual, creative intellectual effort that the originality threshold requires. The resulting code is almost certainly unprotected.

At the other end: An engineer engages in a sustained, iterative process of crafting precise and creative prompts, steering the AI's direction through multiple rounds of refinement, making substantive choices about structure, style, and approach, and integrating the output into a broader architecture he has designed. Here, the human contribution is more plausibly the kind of creative intellectual effort that gives rise to copyright protection – though Norwegian law has not yet definitively answered where on this spectrum the threshold lies.

A useful analogy from existing copyright doctrine is the treatment of derivative works. Derivative works are distinguished from mere reproductions. In the latter case, changes that are the result of technical/functional work or work simply expressing ordinary craft-skill do normally not give rise to independent copyright protection. In the same way, AI-generated output that is purely the "technical" product of the model's inference process, without genuine human creative steering, is unlikely to qualify.

Where a human engineer codes further contributions on top of AI-generated code – refactoring, extending, redesigning – those human additions may attract independent copyright protection. But the protection will be limited to the human's own creative contribution, not the underlying AI-generated base, nor the AI-output that goes beyond the human contribution. There is in other words an inherent issue of an "IP-delta", where only partial protection of the whole (often valuable) asset is afforded.

Assuming the employee's contribution does meet the originality threshold – so that copyright arises in the employee's favor – does it transfer to the employer?

For computer programs, the Copyright Act contains a specific and broadly drafted provision, providing that copyright in a computer program created by an employee in the performance of tasks covered by the employment relationship, or pursuant to the employer's instructions, passes to the employer. The same applies to the right to modify the work and to further transfer the right. This does not apply to moral rights, or where otherwise agreed. The provision i.a. embodies a presumption of total transfer to the employer of the economic rights in computer programs created in employment.

For categories of works other than computer programs, there is an established, uncodified principle of Norwegian law, that copyright in works created in an employment relationship passes to the employer to the extent necessary for the employment relationship to achieve its purpose, and provided that creating such works falls within the employee's duties. This is a more limited transfer than the total transfer rule for computer programs, and its application in any given case will depend on the nature of the work and the scope of the employee's role. 

Here lies the central practical problem. Both section 71 and the general employer principle operate only where copyright exists in the first place. If AI-generated output does not meet the originality threshold – so that no copyright arises – there is nothing for the employer to receive. The transfer mechanism is irrelevant. The output is, from a copyright perspective, unprotected.

This means that a business which assumes it owns the AI-generated code produced by its employees – because its employment contracts contain a standard IP assignment clause – may be operating on a legally unsound basis. A clause that purports to assign "works and inventions created in the course of employment" cannot transfer rights that do not exist. The employee has no copyright to give, and so the employer receives none.

Furthermore, the Copyright Act provides that an author may, subject to the limitation of moral rights, wholly or partly transfer the right to dispose of a work; but upon such transfer, the author shall not be deemed to have transferred a more extensive right than the agreement clearly expresses. This “principle of specificity” (NO: spesialitetsprinsippet) means that ambiguity in assignment clauses is construed against the assignee – in this case, the employer. General, broadly worded assignment clauses drafted before the AI era may be poorly suited to the AI-assisted workplace.

Review the employment contracts.  Review your standard IP assignment clauses to assess whether the IP provisions are fit for purpose in the AI era - in particular, whether they adequately cover the employee's prompting work and iterative engagement with AI tools, the testing and validation of AI-generated output, the implementation of that output into broader systems and products, and any human coding contributions made on top of AI-generated material. Where gaps are identified, updating the relevant clauses – or introducing supplementary IP policies that sit alongside the contract – is a practical and proportionate step.

Document the human creative process. The originality assessment takes into account both the individual elements of the work and the work assessed as a whole. Businesses should establish internal workflows that capture the employee's creative contribution: Prompt history, iteration records, design choices, and testing decisions. This documentation will be material evidence if the existence of copyright is ever disputed.

Consider supplementary forms of protection. Where copyright protection is uncertain, trade secret law may offer an alternative. Internal prompting methodologies, AI workflows, and bespoke configurations of AI tools may qualify as trade secrets under the Norwegian Trade Secrets Act, provided they are kept confidential and have commercial value. Unlike copyright, trade secret protection does not require originality, it requires only secrecy and economic value.

Pay particular attention to freelancers and consultants. Section 71 of the Copyright Act applies only to employment relationships. The provision in the general employer rule applies correspondingly in contractor relationships and similar relationships where the work is created to order and the creator bears no economic risk in relation to the result. However, the total-transfer presumption that applies to computer programs in employment relationships does not extend automatically to computer programs created by independent contractors. For consultants and freelancers, express contractual assignment is essential.

The fundamental copyright principle – that a work must be the product of a human being's original, individual creative effort – creates a gap in the AI-assisted workplace. Where AI does a significant portion of the creative work, the output may not be copyright-protected, the employer's standard IP clauses may be ineffective, and a commercially valuable product may have uncertain legal protection.

Reviewing and updating employment contracts, establishing documentation practices, and considering supplementary forms of protection are not merely good housekeeping; they may be essential to ensuring that the business actually owns what it thinks it owns.