One Tuesday morning in 2024, an airline executive in Vancouver, Canada choked on his coffee. The British Columbia Civil Resolution Tribunal had ordered Air Canada to pay $812 in damages. The amount was small. But the message carried the weight of billions. Tribunal member Christopher Rivers wrote: "While a chatbot has an interactive component, it is still just a part of Air Canada's website. It should be obvious to Air Canada that it is responsible for all the information on its website."

Air Canada's lawyers tried an astonishing argument. The chatbot, they claimed, was a "separate legal entity" for which the company could not be held responsible. The tribunal member dismissed this as a "remarkable submission." At that moment, phones began ringing in corporate legal departments around the world. "What is our chatbot saying right now?"

This checklist is a survival guide for avoiding that chaotic Tuesday morning. It is not a simple to-do list. It is the blueprint for a safe house you must build before bringing AI, the smartest yet hardest-to-control thing we have ever created, inside the fence of your company.

Legal Checklist by AI Model Development Stage

June 23, 2025, the U.S. District Court for the Northern District of California. Judge William Alsup leaned back in his chair. Before him sat stacks of filings from a copyright lawsuit between authors and Anthropic. Anthropic had trained Claude on millions of books. Some were lawfully purchased; others were downloaded from pirate sites on the internet. The judge picked up his pen. "Training an AI model on lawfully acquired copyrighted works is fair use. It is remarkably transformative." But the next sentence was the problem. "The use of pirated copies is a different story."

Every catastrophe begins with a tiny decision. A developer in the open-source community in 2023 thinking "it should be fine to just grab this" and clicking once, only for that click to return as a lawsuit worth hundreds of billions of won in 2025. The model development stage is like laying a building's foundation. If the foundation is contaminated, the building will collapse.

The first gate is classifying your AI system's risk level. The regulations that apply change entirely depending on what your AI does. The EU AI Act began enforcing obligations on general-purpose AI models from August 2, 2025. If you are building high-risk AI, you must be prepared to pay fines of up to 7% of revenue, which translates to a maximum of 35 million euros. What is high-risk AI? Put simply, it is AI that makes decisions that change people's lives. Hiring, lending, medical diagnosis, insurance underwriting, college admissions. AI operating in these areas is all classified as high-risk. Colorado's AI Act follows the same logic. Effective June 30, 2026, it imposes a duty of reasonable care on AI that makes "consequential decisions." Violations carry penalties of $20,000 per incident.

There is a question you must ask your development team. Does the AI we are building affect someone's employment, credit, healthcare, or housing? If so, you are building high-risk AI. If not, you can breathe a little easier. But do not relax. Low-risk does not mean unregulated.

The second gate is verifying the model's provenance and license. Do not be fooled by the word "open-source." Open-source does not always mean free. You need to check whether it carries an Apache 2.0 license or a Creative Commons license that prohibits commercial use. If you take a model distributed "for research purposes" and build a paid service on it, you have started a time bomb's countdown yourself. The GitHub Copilot lawsuit is a good example. That case arose because open-source code was stripped of its license information and used for training. As of December 2025, that litigation is still ongoing.

If you are using external APIs, the situation gets more complicated. When using APIs from OpenAI, Anthropic, or Google, did you read the contract carefully? Are data processing rights, confidentiality, and prohibitions on secondary training clearly stated? A blanket indemnity claiming "the provider bears all responsibility" is generally difficult to enforce in practice. If actual harm occurs, you as the deployer may also be held liable.

The third gate is algorithmic bias testing. Remember the Workday lawsuit. Is your system systematically filtering out Black applicants, disabled applicants, or applicants over 40? During development, you must intentionally attack the model and provoke it into revealing its biases. This process, called red teaming, is not optional. Bias discovered internally now is a "bug." Bias discovered in court later is "discrimination." Discrimination does not end with a fine. It leads to class action lawsuits.

The fourth gate is securing explainability. Black-box AI is vulnerable in court. In the Cigna and UnitedHealth medical claim denial cases, the opaque reasons for AI-driven rejections became the core basis for class action lawsuits. Does your AI have a technical architecture capable of explaining, after the fact, why it reached a particular conclusion? The EU AI Act requires high-risk AI to have technical documentation and logs "prepared before market placement." It is a warning that "later is too late."

Finally, you must verify the transparency of your foundation model. If you are using Microsoft's or Google's APIs, you can at least shift part of the responsibility to them. But if you are fine-tuning a large language model in-house, the story changes. Can you guarantee that the base training data for your model does not include child sexual abuse material or terrorist planning information? In 2023, a Stanford research team discovered child sexual abuse material in the LAION-5B dataset. That dataset had been used to train numerous image-generation AI systems.

Data Collection and Management Checklist

On December 27, 2023, lawyers for the New York Times filed a 69-page complaint in federal court. It contained a strange piece of evidence. They placed New York Times articles and text generated by ChatGPT side by side. The two texts were nearly identical. Word for word, comma for comma. The lawyers called this "regurgitation," the phenomenon of an AI spitting back what it learned verbatim. Their argument was simple: you copied our articles. Millions of them.

Data is AI's food. But just as eating spoiled food makes you sick, training on contaminated data causes AI to hallucinate or invite lawsuits.

The first item to check is whether training data was lawfully obtained. "It was publicly available on the internet, so it's fine to use" is an excuse that only worked until 2022. On February 11, 2025, Judge Stephanos Bibas of the U.S. District Court for the District of Delaware rejected the fair use defense in Thomson Reuters v. ROSS Intelligence. ROSS had used copyrighted headnotes from Westlaw for training. The judge ruled it was copyright infringement.

Did you comply with robots.txt protocols when web crawling? Did you circumvent paywalls to scrape subscriber-only content? If you bought data from a broker, did that broker obtain the data lawfully? If you cannot answer these questions, discarding the data is cheaper. In the Anthropic case, Judge Alsup made it clear: training on lawfully acquired books is fair use, but using pirated copies "requires a different analysis."

The second item to check is whether personal information or biometric data is included. Remember Clearview AI. This company scraped people's facial photos from the internet to build a facial recognition database. The consequences were brutal: fines of 30.5 million euros in the Netherlands, 7.55 million pounds in the UK, 20 million euros in France, and 20 million euros in Italy. In the United States, the company faced a class action lawsuit for violating the Illinois Biometric Information Privacy Act (BIPA).

Does your dataset contain names, addresses, phone numbers, or photographs of people's faces? If so, did you obtain consent from the data subjects? If not, you may end up shutting your company's doors over GDPR or BIPA violations. Italy's data protection authority once temporarily blocked ChatGPT, pointing out that it could not technically guarantee the right to erasure under the GDPR.

The third item to check is data cleansing and copyright tag management. If you plan to enter the Chinese market, you must verify that your training data does not contain "subversive content." In Western jurisdictions, you must check whether rights holders have opted out of having their content used for training. The EU AI Act, effective August 2, 2025, requires providers of general-purpose AI models to publish summaries of their training data. You must document data sources, license status, presence of personal information, and whether synthetic data was used.

If you do not tag and manage your training data, "unlearning," the process of selectively deleting problematic data later, becomes technically near-impossible. You must maintain data lineage so that you can explain which data cluster a particular output originated from.

The fourth item to check is maintaining the confidentiality of input data. Are your employees feeding confidential company documents into a chatbot and asking for summaries? Remember the 2023 incident where a Samsung Electronics engineer entered proprietary code into ChatGPT. That information was stored on OpenAI's servers. You must confirm that input data is not reused for model training and that you have an enterprise-grade security agreement in place.

Finally, you must verify data quality and bias. Google's dermatology AI app drew bias criticism due to insufficient data on darker skin tones. Does your data reflect diversity without skewing toward particular races, genders, or regions? Where significant imbalance exists, you must introduce sampling adjustments, synthetic data augmentation, and monitoring metrics.

Legal Review Items Before Deployment

On February 14, 2024, a man named Jake Moffatt won against Air Canada. His grandmother had passed away, and he needed to book a flight for the funeral. The chatbot on Air Canada's website told him: "Book at full price and apply for the bereavement discount within 90 days." Moffatt believed it. But it was a lie. Air Canada's actual policy did not allow after-the-fact applications.

Air Canada argued that the company could not be responsible for what its chatbot said. That the chatbot was a "separate legal entity." The tribunal member responded: "It should be obvious to Air Canada that it is responsible for all the information on its website. It makes no difference whether the information comes from a static page or a chatbot."

Suppose you have built your model and your data is clean. Now it is time to release it into the world. But one final gate remains: determining who bears responsibility, and how, for the mistakes this AI will make.

The first review item is making your terms of service and disclaimers specific. A single line saying "what the AI says may not be factual" is not enough. As the Air Canada case showed, courts treat AI as the company's agent. You must spell out in your terms the limitations of AI-provided information, whether its decisions are binding, and who bears responsibility when users act on AI-generated content. But remember: no matter how well you draft your terms, they are useless if you have deceived consumers. The U.S. FTC, through "Operation AI Comply," is cracking down on companies making exaggerated claims, like DoNotPay's "robot lawyer."

The second review item is the obligation to label AI-generated content. If you want to avoid lawsuits over deepfake sexual exploitation material or fake news, you must make it obvious that the content was created by AI. California and the EU have already made this mandatory. China's Interim Measures for the Management of Generative AI also require a "conspicuous identification mark" on AI-generated content. Have you applied watermarking technology? Have you embedded metadata following the C2PA standard? Have you ensured users cannot arbitrarily remove it?

The third review item is explainability and the appeals process. If your AI denies someone a loan or rejects a job application, that person has the right to ask "why?" Colorado's AI Act demands such an explanation. Do you have a reporting feature that can explain the basis for AI's judgment? Is there a button that lets people request a human agent to review the AI's decision? A "human-in-the-loop system" is a legal safeguard. Article 22 of the GDPR grants data subjects the right to object to automated decision-making.

The fourth review item is hallucination prevention and monitoring systems. AI lies as naturally as it breathes. The problem is that those lies sound perfectly plausible. Research shows that even in controlled environments, AI chatbots hallucinate between 3% and 27% of the time. In Mata v. Avianca, New York attorney Steven Schwartz submitted fabricated case citations generated by ChatGPT to the court and was sanctioned. Before deployment, did you implement fact-verification procedures such as retrieval-augmented generation (RAG)? After launch, do you have a control tower that can monitor and block harmful or incorrect information the AI produces in real time? The fifth review item is monitoring for third-party rights infringement. The Taylor Swift deepfake incident and the controversy over nonconsensual sexual images generated by xAI's Grok brought legal and social condemnation for platforms' failure to filter. Does your system properly refuse or modify generation when users input keywords with potential for infringing on celebrities, trademarks, or publicity rights? Have you established an accessible channel for rights holders or victims to report infringement? Is there an internal manual for immediate takedown and review upon receiving such reports?

Finally, you must clarify accountability and governance structures. Do you have a dedicated organization that monitors AI ethics and legal risk and has the authority to flip the "kill switch" when an incident occurs? The reason ISO/IEC 42001 requires an "AI management system" is that it expects companies to lock in policies, responsibilities, procedures, and improvements as a system across the entire lifecycle of building or using AI. Have you purchased AI liability insurance or set aside reserves?

Every item in this checklist is a lesson someone paid for in blood and tears. I hope your company does not appear as the "defendant" in the next chapter. Innovation matters. But something better than winning in court is never giving anyone a reason to take you there. Epilogue: An Era Not Yet Named. In January 2024, in an operating room in the Nevada desert, doctors were drilling a hole in a skull. The patient was Noland Arbaugh, a 29-year-old quadriplegic. He had lost all sensation below his shoulders in a diving accident eight years earlier. What the doctors inserted was a coin-sized chip: Neuralink's first human implant, equipped with 1,024 electrodes.

A few weeks after the surgery, Arbaugh moved a computer cursor with his thoughts alone. He played chess. He played Mario Kart. In an interview, he said: "At first, I imagined moving my hand to move the cursor. Now I just think about the cursor going there. The concept of a hand itself has disappeared."

Consider the implications of that sentence. The concept of a hand has disappeared. The way humans have used tools for millions of years, the body as a necessary intermediary between intention and action, has begun to vanish.

This book has examined the legal disputes triggered by AI. Copyright, discrimination, privacy, safety. Beneath all these disputes lay a single question: when machines enter human territory, do the old rules still hold?

Courts have struggled to answer. Judges applied copyright law written in the 19th century to 21st-century language models. They mapped 1960s civil rights statutes onto algorithmic discrimination. Sometimes the fit worked; sometimes it did not. The judge in New York Times v. OpenAI had to apply the old concept of "fair use" to the training of millions of data points. It was like trying to regulate self-driving cars with traffic laws from the horse-and-buggy era.

But the confusion in courtrooms is only the shadow of a larger confusion. What we are witnessing is not a crisis of the legal system. It is a redefinition of civilization itself.

There have been only a handful of such moments in human history.

The discovery of fire. The agricultural revolution. The printing press. The industrial revolution. At each of these moments, humanity gained a new capability, and that capability shook everything that existed before. Agriculture gave rise to settled life; settlement created cities; cities gave birth to nations. The printing press broke the monopoly on knowledge and led to the Reformation and the Scientific Revolution. The industrial revolution changed the meaning of labor and produced capitalism and socialism, two philosophies in opposition.

AI is the next chapter in that lineage. But one thing is different: speed. The agricultural revolution spread over thousands of years. The industrial revolution took centuries. AI is changing everything in a matter of years. ChatGPT launched in November 2022. Two years later, we live in a world where AI writes articles, produces code, makes medical diagnoses, and gives legal advice.

Law cannot keep up with this speed. That is the essence of every dispute in this book. Technology advances exponentially; law responds arithmetically. In that gap, harm occurs, lawsuits are filed, and judges agonize.

There is a more fundamental problem. We lack a philosophy to explain this new reality.

Copyright law is built on the concept of a "creator." But we are no longer certain what a creator is. When AI paints a picture, is the creator the AI, the company that built the AI, the user who typed the prompt, or the millions of original artists whose works the AI studied? American courts and Chinese courts have given different answers. The difference is not one of legal interpretation. It is a difference in philosophical premises about what creation means.

Employment discrimination law is built on the concept of "intent." Was there an intent to discriminate against someone? But what does intent mean for an algorithm? Workday's hiring system had no intent to discriminate against Black applicants. It simply learned patterns from historical data. If historical discrimination was embedded in those patterns, whose responsibility is that? The algorithm's? The company that built the algorithm? Or the entire society that produced the discriminatory data?

Privacy law is built on the concept of the "individual." My face, my voice, my data belong to me. But who owns a synthetic face that AI created by learning from millions of faces? An image that belongs to no particular person yet resembles everyone. Our law never imagined such a thing.

Let us return to Neuralink's Noland Arbaugh. He operates machines with thought alone. Right now it is a computer cursor. What will it be in ten years? A robotic arm. An exoskeleton. Perhaps another person's body.

Elon Musk has said the ultimate goal of Neuralink is "symbiosis between humans and AI." Connecting the human brain directly to AI. Exchanging information at the speed of thought. Whether he is right or wrong, it is hard to deny that technology is advancing in this direction. At that point, what is a human being? Is a person with a chip implanted in their brain a human, a cyborg, or something entirely new? Are their thoughts purely their own, or assisted by AI? Who holds the copyright to an idea that arose with AI's help? Who bears responsibility for a decision made on AI's recommendation?

We do not have the philosophy to answer these questions.

Since the Industrial Revolution, humanity developed two grand philosophical systems: capitalism and socialism. These systems were answers to the questions "What is labor?", "What is ownership?", and "What is just distribution?" They offered different answers, but at least they shared the questions.

In the age of AI, the questions themselves change. Not "What is labor?" but "What can only humans do?" Not "What is ownership?" but "What does it mean to own a thought?" Not "What is just distribution?" but "What is a just relationship between humans and machines?"

Answering these new questions requires a new philosophy. Just as Kant provided one for the Enlightenment, Marx for industrial society, and Rawls for the welfare state, someone must lay the philosophical foundations for the AI era. Whether it will come from an individual or a collective, from the West or the East, whether humans will create it or, ironically, AI will help, no one yet knows.

The judges, lawyers, victims, and business leaders who appeared in this book are all members of the first generation in this great transition. They are responding to imperfect problems with imperfect tools. Sometimes they make the right decision; sometimes they make the wrong one. But their very attempts become raw material for a new philosophy.

However the New York Times v. OpenAI case is decided, it will serve as one answer to the question "Does AI training infringe copyright?" However the Workday case is decided, it will serve as one answer to the question "Who bears responsibility for algorithmic discrimination?" These answers accumulate into patterns, patterns accumulate into principles, and principles accumulate into philosophy.

We are living before that philosophy is complete. It is confusing, uncertain, and sometimes unfair. But that is how every civilization began. A period before the rules were written. A period when the old order had collapsed and the new order had not yet risen. That is why this book is titled a "legal war." War is destruction and creation at the same time.

In January 2025, Noland Arbaugh posted a YouTube video showing himself composing documents and playing video games with his Neuralink chip. For eight hours straight. He said: "This is just the beginning."

He is right. This is just the beginning. What comes next, and what we will call it, no one knows yet.

January 25, 2026.

Attorney Kim Kyung-jin. Artificial Intelligence on Trial.

E-book published: February 5, 2026. Author: Kim Kyung-jin. Publisher: Kim Kyung-jin. Imprint: Attorney Kim Kyung-jin Publishing. Publisher registration: March 10, 2025 (No. 2025-000015).

Address: 304, Baekil Building, 91 Jeonnong-ro, Dongdaemun-gu, Seoul, Republic of Korea. Phone: 02-6338-1905. Email: kimkj008@gmail.com. ISBN: 979-11-24360-02-6. Copyright Kim Kyung-jin 2026. All rights reserved. Unauthorized reproduction or transmission of this book is prohibited.

Note: The photographs, images, and graphs in this book were generated using artificial intelligence. Portions of the text were also written with the assistance of artificial intelligence.