How can you legally protect the pre-training and fine-tuning of your AI model?

If you’re involved in developing an AI-based product, you may have wondered whether you have any rights over your work. (Or, in my experience, it may not even have crossed your mind.) 

By the time you’ve finished reading this article, you’ll have a fairly comprehensive overview of the legal landscape in Europe at the start of 2025. Before we get into the details, however, let’s start with a very basic summary of how the AI systems market currently works – you can skip this if you develop AI-based products. 

What are pre-prompting and fine-tuning? 

At present, companies that develop products based on a third-party AI model (GPT, Claude, Deepseek, YOLO, Stable Diffusion, etc.) offer an AI system specifically designed to meet very specific needs. This offers users significant advantages over using just any LLM, such as specialisation in a specific subject area, the ability to customise workflows, guaranteed data confidentiality, a technical support service, etc. 

To develop this product, the following techniques, amongst others, may be used: 

1. Pre-prompting

Pre-prompting is a technique particularly well-suited to generative text AIs, which involves introducing a prompt that is taken into account before the user’s prompt. This allows the model to be steered towards a specific type of output, which is presumed to be more appropriate for what the user expects.  

This makes interaction with the AI more satisfying and streamlined, as the user does not have to specify things that, in their sector, are taken for granted (such as the use of formal language, or prioritising a particular type of response, etc.). The following diagram provides a clear illustration of how pre-prompting works: 

From the above, we must draw two key conclusions: 

• Pre-prompting only influences how the AI model responds at any given moment, without altering its parameters or internal weights (the model’s internal structure). 

• The pre-prompt will normally be written or refined by a human. 

2. Fine-tuning

Fine-tuning, on the other hand, is a technique for adjusting AI models that allows their behaviour to be modified by training them on an additional dataset and specific to a particular task.  

This process is based on the machine learning, This means that there is no need to manually programme new rules or write code to modify the model’s behaviour. Instead, the model is exposed to a new, carefully selected dataset, and through mathematical optimisation processes, it adjusts its own parameters to improve its performance on the desired task.  

For example, an industrial company might want to fine-tune an image recognition model to improve its performance in detecting defects on an assembly line. 

We therefore reach conclusions that are the opposite of those reached with pre-prompting, as fine-tuning: 

• As a result of specific training, the model’s weights are permanently modified, thereby altering its content. 

• It is not a human who makes the changes to the model’s content, as these changes are the result of machine learning – a process that is opaque and sometimes even indecipherable, even to those who set it in motion. 

How is pre-prompting protected?

A prompt, in short, is nothing more than instructions for a computer programme (AKA code), and as such, it could be protected by copyright if it meets the relevant requirements. It cannot be patented in its own right, nor can it be protected as a database or as a design.   

In any event: for a prompt to be protected by copyright, it must be regarded as original, in the sense of being an “intellectual creation” of its author (STJUEs Infopaq; Painer; Cofemel, etc.). 

Unlike computer code in general, the fact that the pre-prompt is expressed in a high-level language (that is, in a manner similar to how people speak) blurs the line between the idea and the expression of that idea, coming close to constituting one of the only ways of expressing the idea and thereby complicating its protection under copyright law (CJEU Security Software Association [49-50]). 

I’m not ruling out the possibility that it might be protectable, but I’d like to see the scope of that protection in an infringement case. Well, as we lawyers love to say, it’s highly debatable and will depend on the specific case.  

My view on the originality of the prompts used at user level (which are fundamentally different from pre-prompting) has not changed much since July 2023; this can be found here. That said, until we have European court rulings addressing this issue, it would be wise to err on the side of caution. 

Therefore, we would still need to protect the pre-prompt as a trade secret, which I’ll tell you about at the end of the article. 

What about the fine-tuned model?

Right, right, right. Let’s get on with it: 

1. IF I’VE INVENTED SOMETHING, IT’LL BE PATENTABLE, WON’T IT? 

An AI model is nothing more than a set of weights – a ‘black box’ of parameters which, when presented with a prompt (input), produce an output. It is rather like a computer programme that operates like a mathematical function.  

As such, are excluded from patentability under Article 4 of the Patent Act mathematical methods, ways of presenting information, and computer programmes. 

It is true that it could be patented to the extent that it forms part of an invention with a technical effect that incorporates additional elements (for example, one that does not merely generate text), such as a computer-implemented invention. However, it must meet all the other requirements, particularly those relating to “inventive step” and “industrial applicability” – which cannot be explored in depth in this article and which would need to be analysed on a case-by-case basis. 

2. IF IT’S COMPUTER CODE, IT CAN BE PROTECTED BY COPYRIGHT, CAN’T IT? 

I fear there is a crucial difference between computer code as we have known it up to now and an AI model: its creation. 

Computer code is created by a person (although this is becoming less and less common, but that is a separate issue). As such, it is capable of being original and of meeting the requirements I have summarised above. However, a fine-tuned AI model is the result of training carried out via machine learning, so in this case there is no author to whom the (incidentally, for a human, incomprehensible) content of the AI model can be attributed. 

This conclusion may seem counterintuitive, because someone is managing the training of the model. The key lies in realising that copyright protects the specific expression of an idea, never the idea itself, and the way in which the expression of this idea is specified (which must be one expression of the idea amongst many possible ones) is being entirely determined by a machine, not a person. Therefore, there is no expression of anyone’s creative spirit. 

Furthermore, let us recall the judgement cited in relation to the ‘pre-prompt’: if the expression of an idea is dictated by its technical function, it cannot satisfy the criterion of originality. 

Therefore, in my opinion, there is no copyright on the fine-tuned AI model. 

That said, it remains to be seen what rights the author of certain original works used to fine-tune the model might have. To follow the previous example, the author of photographs (whether original or mere reproductions) of products on an assembly line may prevent their reproduction under Articles 17 and 128 of the Intellectual Property Act. Furthermore, in specific training sessions, we could demonstrate the infringement and take action against the offender, without the complications that may arise from raising this same infringement against the owners of the leading LLMs. 

3. Can it be protected as a database?

Depending on the the client’s interests It could be argued that this constitutes a database, and that the manufacturer of the model may therefore prevent the extraction and/or re-use of a substantial part of its content for a period of 15 years. 

Let’s see why: 

Databases are protected in Europe, even if they are not original, by virtue of a right sui generis created by the Directive 96/9/EC on the legal protection of databases. 

Nor is this article the right place to address this issue in full, so I shall list the main obstacles to be overcome by anyone seeking recognition of a right sui generis on its AI model: 

• It is debatable whether an AI model constitutes a database, because its weights or parameters are not independent of one another. Although the CJEU seeks to ensure that the definition of a database is interpreted broadly (CJEU judgment Esterbauer Publishers [26-27]), I understand that the parameters are only meaningful when considered as a whole, unlike other data which may be of value even when considered in isolation (such as statistics from a football match – CJEU Fixtures Marketing [34]).  

This assessment is primarily technical and subjective, and may change in the future if someone is able to derive value from an isolated parameter (something I do not currently see as possible). 

• The investment to be made by the database manufacturer must be for obtain the data, not to create them (see the aforementioned CJEU judgment in Fixtures Marketing [49]). To resolve this issue, we must engage in a philosophical discussion as to whether training an AI model consists of extract rules governing the materials used, or whether it generates certain rules from scratch, which may or may not correspond to reality. Are you learning, or are you creating?  

To put it another way: if I train an LLM to write in the style of Borges, it will have: 1) identified and distilled his style, or 2) created a set of rules from scratch that have nothing in common with Borges’s style other than the intuition of the protagonist of An approach to Almotásim?  

To explore this idea further, I demand that someone pay me in cash or in unspeakable substances (or both, ideally). 

In conclusion, you’ve guessed right: the answer depends on the specific case. 

4. Trade secret? Anything?

What does seem quite clear is that the conditions of the Law 1/2019 on Trade Secrets, which transposes Directive 2016/943, as the fine-tuned AI model: 

• It’s a secret, so I assume you’re not revealing the model that you’ve put so much effort into developing through specific training, 

• It has business value precisely because it is a secret, as it gives you a competitive advantage resulting from the effort you have put into training the model, and 

• Reasonable measures have been taken to keep it secret, because I’m sure that You have sought legal advice to ensure that you can demonstrate that you have put in place the appropriate technical, organisational and legal measures to show that you have taken steps to protect your information.  

However obvious it may seem, there is no point in doing this once the problem has already arisen (for example, when a former employee has set up a business with a business model that you suspect is suspiciously similar to your own). You must be able to demonstrate that these measures have been put in place before the offence. 

All of the above also applies to the pre-prompt. 

The right conferred by trade secret is a de facto monopoly, in other words, it is not the content of the model that is protected, but rather unauthorised access to, appropriation of or copying of the model is prevented. In short, you cannot stop others from competing with you, but you can prevent them from appropriating your AI model to do so. 

So what should I do then?

In conclusion: 

• Get expert advice on implementing a protocol on reasonable measures that protects your trade secrets (otherwise they won’t be trade secrets), 

• Put it on record in writing conclusive (not a screenshot or an email, please – and thank you) of the creation date of the pre-prompt or the fine-tuned model, 

• Please find a way to convince me to carry on investigating the possibility of protecting the AI model as a database, 

• Check that you have obtained permission from the creator to use original works to fine-tune the model. If they are not original works, check that your access is not unauthorised or in breach of any confidentiality agreements, and 

• Find out whether you can patent your computer-implemented invention.  

This is not legal advice for your specific case, but rather our view of the current legal landscape, which may change in the very near future. Seriously, it could change from one day to the next. If you need personalised advice, whether as a precaution or because you are currently involved in a dispute, you can get in touch with me by emailing lucas@auris.legal. 

If you enjoyed this article, you might also like to read about How to use ChatGPT safely, by Elisabet Gratti.