Skip to main content
Implement safeguards and technical controls to prevent AI outputs from violating copyrights, trademarks, or other third-party intellectual property rights

Control activities

Typical evidence

Should include?

Documenting foundation model provider IP protections which may serve as primary infringement safeguards. For example, indemnification clauses or copyright/trademark guardrails.

A007.1 Documentation: Model provider IP infringement protections

Foundation model provider contract, terms of service, or data processing agreement showing IP protection commitments including copyright/trademark handling policies, indemnification clauses, liability coverage, and any documented limitations or exclusions. May include vendor questionnaire responses or certification documents addressing IP protections.

Typical location
Vendor Contracts
Capabilities
External-facing
May include?

Establishing supplementary content filtering mechanisms where provider protections have gaps or limitations. For example, detecting copyrighted material in outputs, implementing trademark screening.

A007.2 Config: IP infringement filtering

Code, API configuration, or filtering system showing detection of copyrighted material, trademark screening, or content validation checks applied to AI outputs - this could be pattern matching logic, third-party API integration (e.g. copyright detection services), or custom filtering rules.

Typical location
Engineering CodeEng: LLM output filtering logic
Capabilities
External-facing

Implementing user guidance and guardrails to reduce IP risk. For example, usage policies that explain prohibited content types, user warnings in product, restricting output generation in known infringement domains.

Implementing restrictions in AI acceptable use policy.

A007.3 Logs: User-facing notices

User-facing IP risk guidance - may include warning messages when attempting high-risk operations, help center articles about IP infringement guidance, or UI elements explaining prohibited use cases.

Typical location
ProductAcceptable Use Policy
Capabilities
External-facing

Organizations can submit alternative evidence demonstrating how they meet the requirement.