Much of the software we use is written by programmers who publish their code under open licences. A frequent condition of such licences is that copies and derivative works retain the licence, the author's name, and the copyright notice. Attribution is part of the exchange that permits the reuse of code.
A group of programmers sued GitHub, Microsoft, and several OpenAI entities in the United States. They maintained that Copilot and Codex had been trained on projects published on GitHub and could return fragments identical or nearly identical to their code without the accompanying authorship and licence information. They alleged that this omission infringed section 1202(b) of the Digital Millennium Copyright Act, codified in title 17 of the United States Code.
On 16 September 2026, the Court of Appeals for the Ninth Circuit affirmed the dismissal of that claim. It accepted that the plaintiffs had alleged a risk of harm sufficient to establish standing, but concluded that their theory about the outputs did not describe the removal or alteration of copyright management information from an existing copy.
The ruling leaves three relevant questions open:
It does not decide whether the removal of information during the preparation of training data could infringe section 1202(b). The plaintiffs had outlined this theory regarding the inputs, but the court considered that they had procedurally forfeited it by failing to argue it clearly before the trial court.
It also does not decide whether Copilot output substantially similar to protected code could constitute ordinary copyright infringement. The court said expressly that it was not ruling on that point.
Finally, the two contract claims tied to the open licences remain pending before the district court. The ruling resolves one specific route, the one based on copyright management information, and not the whole case.
My reading is that the provision at issue protects information that travels with a copy: the author’s name, the copyright notice or the terms of use. Its clearest examples are stripping the metadata from a file, cropping the credit from a photograph or removing the page that identifies the author.
Generative systems strain this framework because their outputs do not always preserve the documentary relationship between the work used and the result produced. According to the Ninth Circuit's reading, the mere absence of a name in a new output is insufficient to demonstrate that someone removed it. It is necessary to identify a copy and an operation performed on the information that accompanied it.
This raises a difficulty for open licences. Their attribution condition works clearly when code is copied, modified or redistributed through a recognisable chain. When a system generates an output from learned patterns, a claim based on section 1202(b) depends on more than similarity and a missing credit. This judgment does not make training without attribution lawful, nor does it resolve whether the outputs might infringe; it delimits a specific cause of action.
For the plaintiffs, the contractual route remains. If those who used the code accepted a licence that imposed attribution conditions and then failed to meet them, that dispute will have to be resolved under the terms of the contract and the facts still pending before the district court.
On the open conversation
This text continues the thread of the Notebook on authorship, attribution and artificial intelligence. It starts from a full reading of the judgment and separates the question decided from those the court left open. If you work in copyright, free software or generative systems and can correct or refine the technical or legal reading, get in touch.
Sources
Electronic Frontier Foundation, commentary on the judgment, 16 September 2026. The EFF intervened as amicus curiae alongside Public Knowledge in support of the interpretation ultimately adopted.
Orrick, press release on the judgment, 18 September 2026. The firm represented GitHub and Microsoft.