Not legal advice — a systems person reading the cases for what they mean for models, corpora, and infrastructure. Case status as of 2026-08-20.
A model is a function of its corpus — the trillions of tokens it trained on. A meaningful fraction of every web-scale corpus is copyrighted. The lawsuits about that have now produced real rulings, the largest copyright settlement in U.S. history, and one explicit demand that trained models be destroyed. So the question people keep asking is the right one: will models actually get shelved — or do companies just pay and keep serving?
The scoreboard, as it stands
- Bartz v. Anthropic (N.D. Cal.): Judge Alsup ruled (June 2025) that training on lawfully acquired books is fair use — "transformative" — but that hoarding ~7M pirated books in a central library is not. Result: a $1.5B settlement (~$3,000/work across ~500k works), finally approved July 2026 — the largest in U.S. copyright history. The remedy: money plus destruction of the pirated dataset. Not the models.
- Kadrey v. Meta (N.D. Cal.): Judge Chhabria granted Meta summary judgment on fair use (June 2025) — pointedly noting the plaintiffs failed to show market harm, not that training is categorically safe.
- NYT v. OpenAI/Microsoft (S.D.N.Y., now an MDL): motion to dismiss largely denied (April 2025); summary-judgment briefing concluding through 2026; no trial date. Two things make it the main event: the Times documented near-verbatim regurgitation of its articles, and its complaint asks for destruction of the models and training sets that incorporate its work. Shelving is literally on the docket.
- Thomson Reuters v. Ross Intelligence: fair use rejected (Feb 2025) for a non-generative legal-AI product — and Ross itself had already been litigated out of existence years earlier. The one true shelving so far killed a startup, not a frontier lab.
Where liability actually attaches
The pattern across these rulings is surprisingly precise. Picture the pipeline:
Training itself is trending toward fair use. Acquisition is where Anthropic lost — the tort was piracy, and the destroyed artifact was the pirated library, with the models untouched. Outputs are where OpenAI is most exposed — verbatim regurgitation looks like ordinary infringement no fair-use story covers. The weights sit in a remedial no-man's-land: no U.S. court has ordered a frontier model destroyed.
So: shelved, or pay-and-serve?
The evidence so far says pay-and-serve — with two honest asterisks.
The economics make the choice almost automatic. $1.5B is the largest copyright settlement ever and still amounts to a retroactive licensing fee — painful, budgetable, and small against frontier-lab revenue trajectories; it is also per-incident cheaper than not having the model. Every incentive says: settle, license forward (the News Corp / Axel Springer / AP / Reddit deals), indemnify your customers (Microsoft, OpenAI, Adobe all now offer copyright shields), and keep serving. Paying turned out to be a feature of the strategy, not a failure of it.
Asterisk one: shelving has precedent — just not for frontier LLMs yet. Ross Intelligence was shelved (the company died of the litigation). And the FTC has ordered algorithmic disgorgement — destroy the models trained on ill-gotten data — in Cambridge Analytica, Everalbum, WW/Kurbo, and Rite Aid. The remedy exists, tested, on the books. The NYT complaint asks for exactly it. Courts have been reluctant to aim it at a deployed frontier model — the economic blast radius is enormous — but "no court has yet" is not "no court ever."
Asterisk two: the statutory-damages tail. U.S. statutory damages run up to $150,000 per work for willful infringement. Anthropic settled at ~$3,000/work. If a court ever applies willful-tier statutory damages to a corpus-scale count of works — 500,000 works × $150,000 is $75B — the fine stops being a licensing fee and becomes an existential number. That tail, not model destruction, is the scenario that could actually shelve something: not by court order, but by making the company that owns the weights insolvent.
And jurisdiction splinters the answer: the EU's AI Act demands training-data transparency and its TDM exception honors opt-outs; Japan's Article 30-4 is famously permissive; the UK is litigating (Getty v. Stability). A model shelved in one jurisdiction may serve freely in another — "shelved" is not even a global concept.
The systems takeaway: provenance becomes infrastructure
Read as an engineer, the rulings hand down a spec:
- Acquisition provenance is now a first-class model attribute. The $1.5B distinguished lawfully bought from pirated copies of the same books. Where every token came from — receipts included — is the difference between fair use and the largest settlement in history.
- Output filtering is a serving-stack requirement, because regurgitation is the live exposure — a copyright reason to care about the decode path.
- An auditable corpus is the structural fix — exactly the AI-BOM thesis (OpenWALDO: a Git-governed, content-addressed, license-tagged corpus from which a model can be rebuilt and disputed in public). The industry's slowest-adopted fix, and the only one that converts the legal question from litigation into engineering.
- Licensed and provenance-clean corpora stop being idealism and start being insurance — the cost comparison is now against a measured $3,000/work retroactive price, plus counsel.
Bottom line: on the current record, models don't get shelved — datasets get destroyed, checks get written, and the weights keep serving. The realistic threats to that equilibrium are the NYT's regurgitation record, the willful-statutory-damages tail, and the FTC's already-tested disgorgement power. Which is why the smart money — and the interesting engineering — has moved upstream, to corpora that can prove where every token came from.
Related: The tokenizer tax · Why benchmark scores lie (contamination is the scientific face of the same provenance problem) · The agent loop.