You Probably Can't Copyright the Prompt. You Can Still Own It.
For a large share of AI products, the differentiator is a few thousand words of system prompt. It is the most valuable asset in the company and the one with the least legal protection — mostly because founders reach for the wrong body of law.
Copyright: Real, but Almost Never the Protection You Want
A prompt is text a human wrote, so the copyright question is ordinary. Two doctrines limit it hard.
First, short phrases and functional instructions are not protectable. "Act as a senior tax accountant and answer concisely" has no more copyright than a recipe title. A 4,000-word system prompt with worked examples, an unusual reasoning scaffold and distinctive phrasing is a different case, and it can clear the originality bar.
Second — and this is the one that makes copyright the wrong tool — the idea/expression dichotomy means copyright protects your words, not your technique. A competitor who reads your prompt, understands the approach, and rewrites it in their own words has taken everything of value and infringed nothing. Copyright stops verbatim copying. Verbatim copying is rarely what hurts you.
Trade Secret Is the Operative Regime
Under the Defend Trade Secrets Act and state UTSA equivalents, information qualifies if it derives independent economic value from not being generally known or readily ascertainable, and the owner takes reasonable measures to maintain secrecy. Trade secret protects the method, which is what copyright refuses to do — and it has no originality threshold, no registration, and no expiry.
The value prong is easy for any prompt that took real iteration. The reasonable-measures prong is where AI companies lose, routinely and avoidably:
Shipped in a client-side bundle, committed to an open-source SDK, or left in a public example. Once it is genuinely public, it is generally known and the claim is over. Check your JavaScript bundle before you check anything else.
Courts look at whether you treated the information as secret. A prompt in a shared Notion page open to the whole company, unmarked, is evidence you did not. Restrict, label, and log access.
The prompt engineer you hired for six weeks has your entire system prompt and, absent a signed NDA and assignment, few obligations about it. This is the most common single hole.
If a user can ask your assistant to repeat its instructions and it complies, the information is arguably readily ascertainable by proper means. Extraction resistance is part of your legal posture.
Prompts pasted into consumer AI tools, prompt-management SaaS on a free tier, or logging vendors under permissive terms. Check whether any of those providers may use submitted content for training.
Prompt Extraction Is a Legal Event, Not Just a Security One
Prompt injection and system-prompt leakage are usually filed under security. They belong in the IP column too. Secrecy is not a property of the document; it is a property of your conduct and your controls. Every successful extraction weakens the argument that you took reasonable measures.
The distinction that matters in litigation is proper versus improper means. Reverse engineering a publicly available product is generally proper means. Breaching your terms of service, defeating a technical control, or inducing an employee to disclose is improper. So the practical defence is layered: make extraction technically hard, prohibit it explicitly in your terms of service, and keep the genuinely differentiating logic out of the prompt entirely — in retrieval, in tool definitions, in post-processing, in evaluation data.
Ownership: Employees, Contractors and Users
Prompts written within the scope of employment are work made for hire for copyright purposes and are the employer's confidential information regardless. Make sure your invention-assignment agreement is broad enough to cover non-patentable, non-copyrightable know-how — many older templates are not.
No automatic assignment. Commissioned works only qualify as work made for hire within nine statutory categories, and prompts are not among them. You need an express written assignment plus a confidentiality clause. Without it, your contractor can lawfully reuse the prompt for your competitor.
If users write prompts inside your app, your terms decide who can do what with them. Asserting ownership over user prompts is aggressive and increasingly resisted; a broad licence to operate and improve the service is the normal middle ground. Say which one you are doing.
Selling prompts is selling something with thin copyright and zero secrecy after first sale. The durable business is a service or a hosted product, not a text file — price accordingly, and use contract terms rather than IP theories to restrict redistribution.
What to Actually Do This Quarter
- Grep your client bundle for your system prompt. If it is there, nothing else on this list matters until it is not.
- Move prompts into access-controlled storagewith a confidentiality label and an audit log of who read them.
- Paper every contractor with assignment plus confidentiality, and go back and paper the ones already finished.
- Add an anti-extraction clause to your terms: no attempts to elicit, reverse engineer or reproduce system instructions.
- Test extraction quarterly and record the results. A dated internal test log is evidence of reasonable measures.
- Check provider and tooling terms for training use of submitted content, and turn it off where it is optional.
- Shift differentiation out of the prompt — proprietary data, evaluation sets and tool orchestration are much harder to copy than a paragraph of instructions.
See what your live product is exposing
Your shipped front end is public by definition. RatedWithAI scans your live pages and reports what is exposed on the surface — compliance, accessibility and disclosure gaps — free, in under a minute.
Scan Your Site for Free →Frequently Asked Questions
Can a prompt be copyrighted?
A substantial, original prompt can be protected as a literary work. Short functional instructions cannot — they fall below the originality threshold and into the short-phrase exclusion. Even where copyright attaches, it covers only your specific wording, not the technique, so a paraphrased competitor prompt does not infringe.
Should I register my prompts with the Copyright Office?
Rarely worth it, and it carries a real cost: registration deposits become part of a public record, which is directly contrary to maintaining trade secret status. If a prompt is your competitive edge, secrecy is the protection you want, and registering it undermines that. Registration makes more sense for published prompt collections you are selling openly.
Does a prompt make me the author of the output?
No, not on its own. The Copyright Office has taken the position that prompts do not give the user sufficient control over the expressive result to constitute authorship, and that purely AI-generated material is unprotectable. Protection attaches to your own human contribution — selection, arrangement, editing — and to whatever contractual rights the model provider grants you.
Is my system prompt a trade secret if users can extract it?
Reliable extraction is a serious problem for the claim. An opponent will argue the information was readily ascertainable by proper means and that you failed the reasonable-measures test. You can improve your position with terms of service that prohibit extraction attempts and technical controls that make it non-trivial — that converts some extraction from proper into improper means.
A former employee took our prompt to a competitor. What do we have?
Trade secret misappropriation under the DTSA or your state's UTSA is the primary claim, plus breach of the confidentiality and assignment agreement, and copyright infringement if they used it verbatim and it is protectable. The strength of all three turns on evidence you generated before the departure: access controls, confidentiality markings, signed agreements, and a documented secrecy programme.
Can we claim ownership of prompts our users write in our product?
Contractually you can try, but it is a poor trade. Broad ownership grabs over user content are a recurring source of public backlash and are increasingly unenforceable in consumer contexts. A limited licence to host, process and improve the service achieves everything you operationally need without the fight.