AI-Assisted Work Needs a Rights Trail

Singapore's existing computational data analysis exception is intended to cover commercial generative-AI training, subject to safeguards including lawful access. The consultation asks whether that position remains appropriate, how responsibility for outputs should be allocated among developers, deployers and users, and how human contribution should be understood and evidenced. ²

Those questions do not make every training use lawful or every output cleared. Access restrictions, contracts, licensing, the material used, the output produced and the intended market can each change the answer. Treating the consultation as a new permission would create exactly the risk it is helping leaders see.

The control can be compact. For consequential work, capture five records at the point where they are created. First, identify the source material and its owner or authority. Second, record the basis for access: licence, permission, statutory exception or applicable terms. Third, name the provider, model or tool and the terms and safeguards relevant to the use. Fourth, show the human contribution through framing, selection, arrangement, editing, validation and judgment. Fifth, name the owner who reviewed the result, its intended markets and the final release decision.

This is not a demand to preserve every keystroke. It is a way to make the few facts that determine commercial use available to legal, product, creative, R&D and assurance teams. The record should be attached to the asset or decision, searchable, retained for the relevant period and exportable if the supplier changes.

The supplier can document model terms, training policies, controls and known limitations. The deployer can define approved systems, sources, use cases and escalation paths. The user can follow the workflow and disclose material human choices. The approving owner can decide whether the intended use, audience and market make the residual risk acceptable.

These duties should be explicit in procurement, policy and release design. A supplier indemnity may matter commercially, but it does not tell an employee whether a source was authorised, prove authorship or ensure the output has been reviewed in the market where it will be used.

The useful record is not how many prompts a person typed. It is what that person decided: the problem framed, material selected, alternatives rejected, arrangement chosen, claims checked and expression revised. The US Copyright Office's analysis under existing law likewise centres human authorship, while Singapore is asking how contribution should be assessed and evidenced. ²⁵

A generated declaration is not proof. The newest arXiv research reinforces the distinction. One preprint found that a system could retrieve a financial disclosure accurately yet fail to use it in the final judgment when irrelevant context grew; another found that visible medical reasoning could remain plausible after the reasoning chain was meaningfully damaged. ⁹¹⁰ Both are early research, but the operating lesson is sound: retain source events and accountable decisions, not just polished explanations.

The European Union now has enforceable AI Act obligations for applicable general-purpose AI providers, including copyright-policy and training-content transparency duties. ³ The United Kingdom's March report and impact assessment set out policy options but are not themselves new law. ⁴ In the United States, copyrightability and training analysis remain fact-specific under existing law. ⁵

WIPO's new infrastructure dialogue is exploring attribution, watermarking and rights management, but it is voluntary and does not set law or standards. ⁷ Rights-data concerns raised by Philippine and Korean music institutions show why the operating problem extends beyond major Western markets. ⁸ A common trail can support these different decisions; it cannot make the law identical.

Research teams are testing automatic model-card generation and controls that check agent actions before execution. Early results are promising, but both cited studies are version-one preprints, and the quality of generated documentation depends heavily on the source material available. ¹¹¹²

Use automation to make the rights trail easier to complete and review. Do not let it manufacture missing authority or approve its own record. The accountable owner still needs a clear exception path and the authority to stop release.

Choose one process that creates an external asset or potentially valuable IP: a campaign, product design, research report, software component or training resource. Add the five fields to the existing approval record. Name legal, operating and release owners. Define which missing field stops the work and which uncertainty requires specialist review.

Run the control on real work for 30 days. Count missing records, delayed decisions, supplier-term gaps and assets stopped before release. Then simplify the trail without removing the facts decision-makers actually use. The result should be a faster, more defensible release decision—not a new archive that nobody reads.