AI-Era Software IP Audit: 12 Ways You Are Exposed

1. The contract: terms of service

1. Clickwrap acceptance. Do users take an affirmative step, such as ticking a box or clicking “I agree”, to accept your terms before they can use the product? Terms linked only from a footer are much harder to enforce.
2. An explicit AI-training ban. Do the terms expressly prohibit using your interface, DOM, API responses and outputs to train or fine-tune machine-learning models?
3. An automated-access prohibition. Do the terms specifically prohibit scraping, headless browsers, computer-vision capture and autonomous agents, and bar using the product to build a competing one?
4. Gated access and written revocation. Is the valuable part of the product behind a login, and do the terms let you suspend or revoke access for violations? A written revocation notice is what turns continued access into a stronger claim.

A breach of terms gives you a contract claim against a user who accepted them. Whether it also amounts to “unauthorized” access under the Computer Fraud and Abuse Act is a separate question. After Van Buren v. United States (U.S. 2021) and hiQ Labs v. LinkedIn (9th Cir. 2022), a terms violation alone generally is not enough, particularly for pages anyone can view without logging in. Design the product so that the contract claim does not depend on the statute.

2. The interface: design patents and trade dress

Design protection checks

5. Design patents on signature screens. Have you filed U.S. design patent applications on the two or three screens, icons or transitions that customers would recognize as yours?
6. Filing before disclosure. Did you file before showing the interface publicly, or at least within one year of first public disclosure? The United States allows that year; many other countries allow less time or none.
7. A consistent visual identity. Do you use a distinctive and consistent palette, typography and layout across the product and marketing? Trade dress protects a look that customers associate with one source, and it must be non-functional.

A design patent protects ornamental appearance (35 U.S.C. § 171), lasts 15 years from grant (§ 173), and has no maintenance fees. The grace period is in 35 U.S.C. § 102(b)(1). Trade dress is protected under 15 U.S.C. § 1125(a).

3. The evidence: technical defenses and logging

Technical and evidence checks

8. Canary elements. Do you embed unique markers a legitimate user would never touch, such as hidden DOM elements, decoy endpoints or seeded data? A marker that appears in a competitor’s product is strong evidence of copying.
9. Access telemetry. Do you log sessions, request patterns and automation fingerprints, and keep those logs long enough to reconstruct what an account did months later?
10. Scraper friction. Do you use rate limits, bot detection or changing class names to raise the cost of automated capture? These measures do not create legal rights, but they show the access was not invited.

Have counsel review canary and logging designs before deployment. Evidence is only useful if it was collected lawfully, consistently with your own privacy policy, and preserved in a form a court will accept.

4. Enforcement readiness: registrations

Registration checks

11. Registered trademarks. Are your product name, logo and principal feature names registered with the USPTO, or at least the subject of pending applications?
12. Registered copyrights. Have you registered the copyright in your core source code and original graphics with the U.S. Copyright Office? Registration is required before suing on a U.S. work, and its timing controls the remedies available.

Statutory damages and attorney’s fees generally require registration before the infringement began or within three months of first publication (17 U.S.C. § 412). The registration requirement is in 17 U.S.C. § 411; the Copyright Office explains deposits for software in its circular on computer programs.

5. Advanced: trade secrets and discovery readiness.

AI tools and trade secrets

Trade secret law protects information only if its owner takes reasonable measures to keep it secret (18 U.S.C. § 1839(3)). In Trinidad v. OpenAI Inc., No. 25-cv-06328-JST (N.D. Cal. Jan. 5, 2026), a federal court dismissed a trade secret claim against OpenAI because the self-represented plaintiff said she had developed her frameworks in ChatGPT, which meant she had voluntarily shared them with OpenAI.

That is a single district court decision on unusual facts. The practical point is broader: if engineers paste proprietary logic into an AI tool whose terms include no confidentiality or no-training commitment, you may have weakened your own trade secret position. Check which tools are in use, on which plans, under which terms.

Privilege and large-scale log production

Suing a cloner often means producing large volumes of logs and telemetry in discovery. A court order under Federal Rule of Evidence 502(d) provides that producing privileged material in the case does not waive the privilege, in that case or in other federal or state proceedings. Ask litigation counsel to seek one before large productions begin.

Tick the boxes as you review, or print this guide. Selections are not submitted. A checked box means the item has been addressed in your process, not that a legal conclusion has been established.

Reading your result.

What unchecked items usually mean
Unchecked area	Typical exposure	Usual first step
Contract (1–4)	No practical claim against a user who scrapes or clones through an account.	Redraft the terms for clickwrap acceptance with explicit scraping and AI-training restrictions.
Interface (5–7)	A visual clone built with new code may be hard to challenge.	Identify signature screens and check filing deadlines against your launch date.
Evidence (8–10)	Copying may be difficult to prove even where rights exist.	Add canary elements and extend log retention, with counsel’s review.
Registrations (11–12)	Weaker remedies and slower enforcement.	File trademark applications and register core code and graphics.

No checklist can tell you whether a particular product is protected or whether a particular competitor is liable. It can show you where to look first.

The AI-era IP audit: 12 ways your software is legally exposed.