In the past, when launching AI products, our compliance efforts were largely concentrated at two ends of the pipeline. On the front end, we focused on data scraping—checking whether proper licenses were obtained; on the back end, we handled generation safeguards by adding sensitive-word filters and guardrails. As for the model weight parameters produced in the middle during training, we were accustomed to treating them as mere probability matrices and mathematical features, rarely checking whether the model file itself posed copyright risks.
However, a preliminary ruling issued on July 31, 2026, by the Munich I Regional Court in GEMA v. Suno (Case No. LG München I 42 O 763/25) serves as a wake-up call for this habitual approach. Moving beyond data input and text output, the court brought model weights—long overlooked by engineering teams—directly under the scope of copyright infringement review. It should be noted that this is a court of first instance ruling that has not yet taken final effect, though several remedies can be provisionally executed once GEMA provides security. Details of the ruling can be found in the court press release.
GEMA, the German music copyright management society, filed a lawsuit against the music generation platform Suno on behalf of several composers and lyricists. During their investigation, they conducted a set of experiments: when submitting prompts to Suno, they included only the original lyrics, work titles, and musical style descriptions, without inputting any of the original tracks’ melody, harmony, or rhythm into the model. Notably, the lyrics served purely as test inputs here; the case adjudicated the musical compositions’ expression, and lyric copyright infringement was not within the scope of the dispute. The testing covered five classic tracks—“Atemlos durch die Nacht,” “Daddy Cool,” “Rasputin,” “Big in Japan,” and “Forever Young”—plus the chorus section of “Mambo No. 5 (A Little Bit Of).”
After performing repeated generation sampling ranging from 4 to 176 times, the testers ultimately submitted only one output per work, where Suno generated audio whose melody and harmony clearly exhibited the original works’ characteristics. The court understood this logic: while the user prompts contained no melodic information whatsoever, the model still regurgitated the musical expression of the original works. This indicated that the internal weights of the Suno v3.5 and v4 models still retained the expressive forms of the works. Detailed trial records can be found in the openJur judgment text (an unofficial transcript; as of publication, the court’s official website has not yet released the certified full text).
Under German copyright law, as long as a work is fixed in a specific medium and can be perceived, it meets the essential conditions for legal classification as a copy. Following this principle, the court ruled that the Suno model files deployed on servers themselves constituted infringing copies. However, the court explicitly noted that “not all models memorize training data,” meaning this ruling does not dictate that any use of training data renders an entire model an infringing copy; rather, it is a specific determination regarding the six works and the two model versions in question. This also implies that our previous compliance mindset—focusing solely on data provenance and output filtering—is no longer sufficient. Model weight files themselves must now undergo compliance reviews.
In traditional machine learning, overfitting—or whether a model has verbatim memorized its training set—has long been a loosely defined academic concept. In research, rigorously proving that a model has memorized specific data typically requires expensive white-box techniques, such as inspecting neuron features, running linear probes, or calculating complex gradient influence functions. In the Suno case, however, the Munich court made a landmark determination: the legal system officially accepted a low-cost black-box testing methodology (prompt sampling) as admissible evidence that model parameters retained memories of protected works.
GEMA’s testing team did not breach Suno’s servers to retrieve internal model weights, nor did they run any expensive white-box analysis. They simply fed the original lyrics, track titles, and styles as prompts into the model. Without providing any melodies, they induced the model to output the original melodies and harmonies through black-box sampling repeated between 4 and 176 times.
The court understood and accepted this probing logic: given that the input consisted solely of text while the output produced highly complex melodic expressions, such alignment could not be coincidental. Rather than dwelling on abstract academic definitions of overfitting, the judge used prompt extraction testing as evidence to infer that the protected works persisted inside the model.
This line of reasoning reveals a profound clash between legal standards and engineering practice. According to the test logs, GEMA’s team often had to sample dozens or even hundreds of times—submitting only one final output per work—to capture a single recognizably similar output by chance. Can triggering the reproduction of a work via high-frequency sampling in the long tail of a probability distribution directly imply that the specific work is fixed within the parameter matrix?
This happens to be a potential core issue as Suno evaluates its options, including an appeal—as of publication, it has not been verified whether Suno has formally filed an appeal. For engineering teams, however, the signal is clear: black-box extraction testing is no longer just an attack vector for security enthusiasts or a vague concept in academic papers. It has become an effective courtroom probe used to allege model infringement. Whenever a prompt successfully hooks out a work from the training set, judges lean toward ruling that the weight files retain the work’s expression. Conversely, even if a single negative test fails to produce similar audio, it cannot be treated as a legal safe harbor against prosecution.
In the past, many teams building cross-border products operated under a comfortable assumption: as long as model training takes place in US datacenters, sheltered by the fair use doctrine of US copyright law, the entire model would be safe enough. The Suno case directly shatters this notion of cross-border isolation.
Copyright laws follow strict principles of territoriality. The US fair use defense only governs scraping and training activities that occur within US borders. Once a team copies and deploys trained weight files onto European servers, or opens inference services to European users, the compliance assessment automatically shifts under the jurisdiction of European and local laws.
During the trial, the Munich court broke down Suno’s complete workflow into four distinct legal stages: 1. Acquisition and Training: Extracting works and making training copies in the US. Because the scraping occurred in the US, the court reviewed Suno’s fair use defense under US copyright law and ruled that commercial scraping in this case did not constitute fair use even under US law; 2. Model Storage: Storing model weights containing fixed features of the works on German servers. Applying German law, the court held that this constituted infringing storage/reproduction; 3. Service Provision: Making models and applications containing these works available to the public. The court ruled that this constituted infringement of public communication rights; 4. Output Generation: Generating similar audio on user terminals via the model. The court determined that another instance of reproduction and public communication infringement occurred.
Although Europe’s DSM Directive leaves room for text and data mining (TDM) exemptions, allowing automated scraping for pattern analysis, this exemption comes with explicit boundaries: once analysis is complete, patterns may remain in the parameters, but the works themselves cannot be permanently fixed and re-served to users. Furthermore, when Suno scraped the data, it bypassed YouTube’s Rolling Cipher technology; because the means of acquisition were inherently non-compliant, the data mining exemption could not apply. Therefore, even if a team obtains a fair use defense in the US, once model files are deployed across borders onto European servers, European courts can still independently rule that model storage is infringing and issue injunctions against both the model files and online services.
To tackle these copyright risks, the industry has experimented with various technical and commercial measures. For example, Google’s promoted SynthID watermarking technology can embed digital watermarks into generated audio to verify provenance at the output stage. However, this technology cannot control whether licenses were obtained during the training phase, nor can it stop the model from memorizing original works within its parameters. On the commercial collaboration front, negotiation paths between Warner Music and Suno, as well as Universal Music and Udio, send a clear signal: record labels are not retroactively granting licenses for legacy models. Instead, the standard practice is launching freshly trained, fully licensed models while decommissioning older ones—coupling retraining with legacy model deprecation in tied iterations. Therefore, as courts extend their scrutiny to model weights themselves, engineering teams can no longer view code, data, and weights as isolated modules. We must treat every model release as a comprehensive risk governance process, embedding six engineering controls into the release pipeline:
Record Each Right Item by Item Independently tag distinct rights—such as musical compositions, lyrics, sound recordings/master tapes, and performer voices or likenesses—rather than lumping them into a generic metadata label.
Distinguish Acquisition Legal Basis from Training Legal Basis Public accessibility, paid subscriptions, or API access rights merely indicate that data acquisition channels are open; they do not equate to legal authorization for bulk copying and commercial training.
Establish an Immutable Release Tracing Chain Map end-to-end versioning from data snapshots, training runs, weight checkpoints, and deployment nodes to service endpoints, preventing online services from silently swapping underlying models.
Establish a Model Regurgitation Testing Mechanism Before formally releasing a model, conduct sampling extraction tests using sensitive training works and specific prompts. Record input prompts, sampling parameters, audio fingerprints, and review conclusions to evaluate memorization retention risks. Treat black-box prompt extraction as a quantitative pre-release probe to proactively catch memorization risks.
Review Model Storage by Region Completing training in US datacenters does not mean model weights can be automatically synced to global nodes. Any cross-border server replication and deployment of weight files must undergo an independent local compliance review.
Pre-build Fast Version Rollback and Retraining Paths Ensure online services can be flexibly isolated and taken offline by version and region, while maintaining alternative contingency plans for retraining based on snapshots with clear authorization.
Running model regurgitation tests provides a pre-release risk gate, not a legal liability waiver. To build a lasting compliance defense, the legal validity of underlying data sources and rigorous management of the release pipeline remain our most crucial foundations.