Generative AI: legal and regulatory challenges

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

What AI produces: who does it belong to?

ChatGPT, Midjourney, DALL-E: generative AI tools have changed the content creation market. But behind every image created in 10 seconds there is a question that courts around the world are still trying to resolve: who owns what the AI created?

Under the Copyright Act, 5768-2007, the first owner of the copyright is the “author” (section 33), and the right lasts for the author’s whole life and another 70 years after their death (section 38). The Act does not define “author”, but AI is not a legal person and cannot hold rights. In other words: content created automatically by AI without a person’s creative involvement may fall into the public domain, and not be protected.

What is protected: if a person wrote an original and detailed prompt, made significant edits and managed the creative process, an Israeli court may see that person as the author. But the boundary line is still not clear.

Training AI on protected content: infringement or fair use?

Generative AI models were trained on huge amounts of text, images and music, most of them protected by copyright. In the United States, OpenAI, Stability AI and Google face huge lawsuits from writers, artists and newspapers. In Israel, the question is open.

Section 19 of the Copyright Act, 5768-2007 defines “fair use”: use of a protected work without the right holder’s permission, for purposes such as research, study or criticism. Does training an AI model amount to “fair use”? In an opinion from December 2022, the Counseling and Legislation Department of the Ministry of Justice took the position that, except in exceptional cases, using protected content for machine learning is a permitted use: usually fair use under section 19, and sometimes also incidental use (section 22) or temporary copying (section 26). The opinion does not bind the courts, and the issue has not yet been decided in case law.

It is recommended that Israeli companies that develop AI models document the sources of their training data; a provider of a general-purpose AI model placed on the market in the European Union must publish a detailed summary of the content used for training (Article 53(1)(d) of the AI Act). An Israeli court that has to decide the question will consider: what the purpose of the use is, whether the AI replaces the original market, and what the economic effect on the right holder is.

The EU AI Act: relevant to you too

The European AI regulation (EU AI Act), which has been entering into force in stages since 2024, classifies AI systems by level of risk: high risk (biometrics, screening employees, credit scoring), limited risk, and minimal risk. Systems at “high risk” (Article 6 and Annex III) are subject to duties of transparency, documentation and human oversight, and some uses are prohibited altogether (Article 5); the provisions apply in stages (Article 113).

An Israeli company that markets an AI system in the EU, or whose system’s output is used in the EU, is subject to the regulation (Article 2(1)). So every Israeli SaaS with European users that integrates AI should examine its status under the AI Act.

Legal liability: when the AI gets it wrong, who pays?

Generative AI “makes things up”, which is called “hallucination”. It may produce incorrect medical information, attribute quotes to people who said nothing of the kind, or produce misleading content. When damage is caused, who is responsible?

Under the Torts Ordinance [New Version], tort liability requires a causal link between an act and the damage. Who “acted” here? The AI provider? The developer who integrates it? The user? In the absence of dedicated legislation, Israel will rely on general tort law, and there may be arguments of negligence, vicarious liability and, for bodily injury, also product liability under the Defective Products (Liability) Law, 5740-1980; it all depends on who sent the prompt and who integrated the model into the product.

An official document created by AI that contains a factual error, incorrect medical advice that AI helped produce, a contract with a problematic clause drafted by AI: these are possible causes of action, and they are already coming up around the world.

Privacy: what the AI does with the information you enter

When you enter data into an AI tool (documents, customer names, medical details), you are transferring information to a foreign provider’s server. Under the Protection of Privacy Law, 5741-1981, using or passing on information other than for the purpose for which it was given is an invasion of privacy (section 2(9)); a provider that receives access to a database requires an agreement under regulation 15 of the Protection of Privacy Regulations (Data Security), 5777-2017; and a transfer to a server abroad is subject to the Protection of Privacy Regulations (Transfer of Data to Databases Abroad), 5761-2001 (תקנות הגנת הפרטיות (העברת מידע אל מאגרי מידע שמחוץ לגבולות המדינה), התשס״א-2001) (regulations 1–3).

Lawyers, accountants and doctors who enter client information into AI tools may breach duties of professional confidentiality and the Protection of Privacy Law at the same time. The challenge: most of the major AI providers are cloud-based abroad, and their terms of service have direct consequences for compliance with Israeli law.

And what is the effect on data security? Under section 17(a) of the Protection of Privacy Law, the controller of the database and the holder that processes information for it are each responsible for the security of the information in the database. Entering information from the database into an external AI tool may be considered processing through a holder, so it is worth updating the database definitions document, which must set out processing through a holder and the transfer of information outside the borders of the State (regulation 2(a)(4) and (5) of the Protection of Privacy Regulations (Data Security)), and examining the risks of the engagement in advance (regulation 15(a)(1)). A leak from a database subject to a medium or high security level may be a “severe security incident”, which requires immediate notice to the Privacy Protection Authority (regulation 11(d)).

What Israel is doing, and what it will do soon

As of 2026, Israel does not require a special license for generative AI solutions. In a policy document from December 2023, the Ministry of Innovation, Science and Technology and the Ministry of Justice determined that there is no room at this stage for horizontal framework legislation, and that each regulator will examine regulation in its own field; the Privacy Protection Authority published, on 28 April 2025, a draft guideline on the application of the Protection of Privacy Law to artificial intelligence systems; and the Ministry of Justice published, in December 2022, an opinion on machine learning with protected content. For now, there is no “Israeli AI law”.

Businesses that adopt AI now will give themselves an advantage if they document: data sources, the chain of responsibility, quality checks and a human oversight mechanism. These are also the subjects that existing regulation, such as the AI Act, focuses on.