Legal and reputation risks when assistants quote your content — what marketing leaders must know

AI assistants quoting your words can help or hurt you. The legal risks fall into three buckets: copyright (how your content is used), misattribution (what assistants say you said), and provenance (can anyone prove what’s genuine). Here’s the concise playbook I give UK marketing and legal teams to stay safe and act fast when things go wrong.

What’s the actual legal risk when assistants use our content?

• Copyright and training: In the EU, the AI Act now obliges general‑purpose AI providers to publish “a sufficiently detailed summary” of training data and to meet copyright‑related transparency duties when they place models on the EU market. This raises expectations on provenance and rightsholder choices, even while fair use/fair dealing questions remain unsettled across jurisdictions. See the EU text and guidance. (EUR‑Lex, Regulation (EU) 2024/1689; European Commission guidance).
• US litigation context: High‑profile cases continue. A US judge allowed parts of the New York Times v OpenAI/Microsoft case to proceed in 2025, keeping core copyright issues live. (AP). Separately, courts have knocked back some DMCA §1202 claims about “removal” of copyright management information during AI training, emphasising a high knowledge standard and identical‑copy requirements. (Skadden analysis; ABA review).
• UK developments: The Getty Images v Stability AI proceedings in England & Wales produced the first major judgment touching AI and IP here, but left the lawfulness of training largely unresolved; the court rejected some claims and offered only limited findings on trademarks relating to watermarked outputs. (BAILII judgment extract; case summary).

Bottom line for marketers: the law is still moving. You can’t rely on litigation to protect your brand day‑to‑day. You need practical controls for training use, clear labelling and fast takedowns when misquotes spread.

How can we control whether our site is used for model training?

Control is improving but imperfect. Today, major providers say they will honour a shared robots.txt signal that lets publishers opt out of generative‑AI “training” while keeping normal web crawling. (OpenAI). Cloudflare also blocks many AI crawlers by default for new customers, giving sites a permission‑based model to manage bot access. (Cloudflare; Wired).

Three practical steps I recommend:

• Use robots.txt to permit ordinary search but disallow clearly identified training bots (e.g., GPTBot) if that’s your policy. Remember robots.txt is voluntary and not a hard access control. (HTTP Archive Web Almanac).
• Deploy bot protection (e.g., at CDN level) if you need enforcement beyond polite compliance. (Wired).
• Treat llms.txt as a helpful map for assistants rather than a gate. It’s not a standard access control and has low adoption. (Kinsta explainer).

What are the misattribution and defamation risks when assistants “quote” us?

Assistants can misquote, strip context or wrongly attribute claims. In the UK, a defamation claim requires “serious harm” to reputation under section 1 of the Defamation Act 2013, which sets a real threshold and focuses on actual reputational damage. (Defamation Act 2013; judicial guidance). That bar won’t be met by every error, but false statements about safety, prices, clinical efficacy, or allegations of unlawful conduct can cross it.

Your risk increases when:

• An assistant fabricates a quote and attributes it to your spokesperson.
• A summary removes qualifiers (e.g., “pilot” becomes “launched in all markets”).
• Old statements are resurfaced as current fact, with a fresh publication effect.

Treat this like any media risk, but faster: monitor, evidence the misquote and its spread, and correct publicly and at‑source.

How do we prove provenance and protect our brand from fakes?

Content provenance standards can help you show what’s real and when it changed. C2PA “Content Credentials” are being adopted across cameras, creative tools and platforms, enabling tamper‑evident metadata that records capture, edits and AI generation. Major tech and media players support it, and platforms like YouTube and LinkedIn now display or rely on these credentials in parts of their ecosystems. (European Parliament study; YouTube policy; CGA guidance with supporter list).

Minimum viable actions:

• Publish official statements, press assets and price lists with embedded C2PA credentials via tools that maintain the chain (e.g., Adobe Content Credentials). (YouTube help centre on labels).
• Keep an uncredentialled HTML copy too; assistants still prefer fast, readable pages.
• Maintain a public “Latest statements” hub to anchor corrections that assistants can cite.

What governance should marketing and legal sign off now?

Create a short, joint policy that everyone can use. Mine has five parts:

1. Site access and licensing

• Robots.txt policy by crawler type; when and how to allow training.
• Where relevant, link to your licensing terms for AI use of content (AI‑specific TDM licence statements are encouraged by current practice). (EU guidance).

2. Source‑ready content

• Write pages that are quotable with dates, definitions and clear qualifiers. Our GEO Writer checklist explains how to make content AI‑preferred. (Luciqo GEO Writer checklist).
• Add author names and roles; assistants often surface byline authority.

3. Provenance labelling

• Embed C2PA where it matters (press releases, CEO letters, product specs). Document the workflow in your style guide. (EU study on C2PA adoption).

4. Monitoring and evidence

• Track what assistants recommend and cite about you vs competitors, and log screenshots/URLs, timestamps and prompts. Luciqo can automate this and link it to revenue data you already have in GA, Matomo or HubSpot. (Luciqo; From GA to AI revenue).

5. Response and takedown

• Pre‑authorised playbook (see below) with owners, templates and SLAs.

What should our takedown and correction playbook include?

When an assistant publishes a harmful error, minutes matter. Keep this to a one‑pager.

Trigger conditions

• Defamatory or materially misleading statements (UK Defamation Act serious‑harm threshold). (Defamation Act 2013).
• Safety, legal compliance, regulated claims, or price/availability misstatements.

The four‑step response

1. Capture evidence

• Save the exact prompt, full answer, date/time, country, model/version if shown, and any links the assistant cites.

2. Publish a correction anchor

• Post a dated correction on your site (and provenance‑label it). Keep language factual and linkable.

3. Notify the assistant/platform

• Use official reporting channels. For video or social surfaces, use the platform’s AI‑content disclosure or label routes as well (YouTube requires labels for realistic AI‑altered media and may add them itself). (YouTube policy).
• If the assistant cites a third‑party page as the source of the error, send a targeted notice to that publisher with your correction link.

4. Escalate where needed

• Where there’s serious reputational harm or clear IP misuse, instruct counsel to send a formal notice referencing the factual inaccuracy, harm, and your correction. For cross‑border issues (e.g., US‑hosted services), your counsel may consider parallel US notices referencing DMCA norms for removal of infringing copies or untrue attributions, noting the evolving case law around §1202 CMI claims. (Skadden; ABA).

Ownership and SLAs

• Name an operational owner (usually Comms) and legal approver.
• Set service levels: acknowledge internally in 15 minutes, publish the anchor in 60 minutes, file notices in 2 hours, update leadership daily until resolved.

What should we publish so assistants quote us accurately?

• Make facts machine‑readable and current: server‑rendered HTML, clear H2s, bullets, and up‑front dates (“Updated 13 November 2026”).
• Write canonical answers to buyer questions. Our prompt‑testing playbook shows how to simulate buyer queries and audit answers at scale. (Luciqo prompt testing).
• Add a “What we don’t do” section; assistants often compress nuance.
• Maintain a “Latest statements” hub and link to it in your footer and newsroom.

Quick checklist for UK marketing leaders

• Robots.txt updated with a clear AI‑training stance; bot protection configured. (OpenAI robots signal).
• C2PA credentials embedded on priority assets; process documented. (EU study).
• Monitoring in place for assistant answers, citations and competitors; link AI visibility to revenue. (Luciqo).
• One‑page takedown playbook agreed by Legal and Comms; SLAs tested.
• Canonical, quotable product and pricing pages with clear update dates.

What next

• Pick one product page and make it “assistant‑ready” this week: tighten copy, add dates, embed Content Credentials on your press PDF, and test how assistants quote it.
• Publish your correction hub, even if empty, and wire a 60‑minute response SLA.
• Align Legal, Comms and RevOps on measurement. If you want a benchmark of what ChatGPT, Claude, Gemini and Perplexity say about you today—and who they recommend instead—run a Luciqo audit and connect it to GA/HubSpot so you can see impact on pipeline.

Frequently asked questions

Does opting out of AI training in robots.txt block assistants from quoting our public pages?

No. The new signals focus on training. Assistants can still visit or ground answers on public pages unless you block their crawlers or use access controls. Robots.txt is voluntary; use bot protection if you require enforcement. See OpenAI’s announcement and Cloudflare’s defaults.

Is C2PA required by law?

No. But adoption is growing across tools and platforms, and the EU AI Act’s transparency push makes provenance good risk hygiene. See the European Parliament study and YouTube’s disclosure policy.

When is a UK defamation claim realistic against an assistant or platform?

When a false statement causes or is likely to cause serious harm under section 1 of the Defamation Act 2013. Capture evidence, publish a correction, and seek legal advice quickly.

Should we use llms.txt?

Treat it as a navigation aid, not a control. There’s no broad evidence of adoption as an enforcement mechanism. Use robots.txt and bot protection for access control.

Can we license our content to AI companies instead of blocking them?

Yes. Several publishers now use a permission‑based model (some via Cloudflare) and strike direct licences. Make sure your site’s policy and robots.txt reflect your position.

What if an assistant cites a third‑party article that misquotes us?

Publish a correction on your site, then notify both the assistant and the third‑party publisher with the link. Ask for updates or labels where platform policies allow (e.g., YouTube’s AI disclosure labels).