Comparison

    AI Coding Assistant IP Indemnity Exclusions: GitHub Copilot, Cursor, Claude Code and Amazon Q Developer

    IP indemnity for AI-generated code is a conditional contractual remedy, not a blanket guarantee. Across GitHub Copilot, Cursor, Claude Code and Amazon Q Developer, procurement should compare three exclusion families (modified output, combination with other materials, and use despite knowledge or reason to know of infringement), plus any required settings and plan limits. Ordinary workflows such as human editing and merging can fall outside coverage depending on the wording, so enterprises need evidence of how each piece of code was produced and handled.

    Talk to an Expert See How Evidence Is Produced

    Procurement questions to put to each vendor

    • Which products, plans and tiers are covered, and where is this stated in the contract?
    • Which settings or filters must be enabled and maintained, and what happens to coverage if an administrator or developer changes them?
    • How are human-modified output and output combined with other code or materials treated?
    • What constitutes knowledge or reason to know of infringement, including acting on a licence-match warning?
    • What notice, cooperation and defence obligations does the customer carry, and within what timeframes?
    • What logs, attestations or provenance data will the vendor provide, and what must the customer retain itself?

    Runtime controls and evidence needed to stay within conditions

  1. Lock and monitor required assistant settings centrally, with change control over who can alter them.
  2. Record which assistant, plan and version produced a suggestion, with a timestamp.
  3. Retain the origin and licence context of generated code, including any match warnings raised.
  4. Capture the modification history from suggestion to commit, so edits are attributable.
  5. Define and document an escalation path for flagged matches, with the decision and approver recorded.
  6. Keep dated copies of the vendor terms in force when code was generated.

    7. Indemnity is a condition-bound remedy

    Enterprises often treat vendor IP indemnity as a backstop for AI-generated code. In practice it is a contractual promise with eligibility conditions, and the conditions differ by vendor, product and plan. Some products may not offer a comparable indemnity at all, so the first question is whether a given assistant, on the plan you intend to buy, is covered.

    Three exclusion families recur in this kind of term. The first concerns developer modification of suggested output. The second concerns combining output with other code or materials. The third concerns use despite knowledge or reason to know that the output infringes. Some terms also depend on vendor-side filters or settings being enabled, which turns an engineering configuration into a contractual precondition.

    This page is educational and not legal advice. Clause interpretation belongs with counsel, and indemnity should not be assumed to address every kind of IP question. Regulators themselves distinguish questions about the copyright status of AI-generated works from questions about training data, so a vendor commitment on one should not be read as covering the other.

    What to establish for each of the four assistants

    The table sets out the comparison dimensions to apply to GitHub Copilot, Cursor, Claude Code and Amazon Q Developer. Fill each row from the vendor's current contract documents for the exact plan under consideration, and record the version and date reviewed. Terms can be revised, so a comparison is only as good as its date.

    • Existence and plan scope: Does the product carry an indemnity or copyright commitment, and which plans, tiers and output types does it cover?
    • Modified output: Is edited code still covered, and does the term define a threshold for modification or require output to be used unaltered?
    • Combinations: Is output covered when merged with proprietary code, open-source code or third-party materials, and is coverage limited to the output itself?
    • Known infringement: How is knowledge or reason to know defined, and does a licence-match notice or an internal flag count?
    • Required settings: Which filters, duplication detection or configurations must be enabled, who can change them, and how is this documented?
    • Notice and defence mechanics: What are the notice deadlines, cooperation duties, control of defence and settlement rights?

    Mapping exclusions to everyday development practice

    Human editing is the clearest tension. Developers rarely accept suggestions verbatim, and a modification exclusion, depending on how it is drafted, can mean that the code that actually ships is not the code that was generated. Procurement should ask how the term treats edits, and engineering should recognise that a refactored suggestion is the normal case, not an edge case.

    Combination is the second tension. Generated code is almost always merged into a codebase that includes proprietary modules and open-source dependencies. If coverage reaches only the output as delivered, a claim that arises from the interaction of that output with surrounding code may sit outside it. The wording on this point deserves close reading by counsel.

    The third tension is warnings. If an assistant surfaces a licence-match notice and a developer proceeds, the enterprise may later face an argument that it had reason to know. That makes the handling of warnings a process question: who reviews a match, what is decided, and where the decision is recorded. An unrecorded decision leaves the enterprise unable to show it acted reasonably.

    Where Trussed fits

    Trussed enforces policy in the execution path of coding assistants, alongside models, agents, tools and MCP servers. Policy applies to individual interactions and tool calls, with actions to allow, redact, block, rate limit or escalate for human approval. Enforcement is at runtime, not reviewed after the fact.

    Trussed also provides code provenance, covering the origin, licence and security context of code, and generates audit-ready evidence from enforcement. This helps a regulated enterprise show how code was produced and handled. It does not make legal determinations or establish whether any code is covered by a vendor's indemnity. Those questions remain with counsel and the vendor's terms.

    Where coverage conditions meet development workflows

    Modified output

    Human edits to suggested code may change whether output is still treated as covered.

    Combinations

    Merging output with proprietary or open-source code raises scope questions.

    Known infringement

    Acting on a licence-match warning may be argued to create knowledge or reason to know.

    Required settings

    Some terms may depend on filters or configurations that must stay enabled.

    Establish the evidence before you rely on the remedy

    Talk to an expert about enforcing policy on coding assistants and producing audit-ready evidence of how code was produced and handled.

    Talk to an Expert