When a publisher sues an AI company, *where's the evidence*?

The lawsuit

In October 2024, News Media Canada, representing Canadian news publishers including The Canadian Press and the Toronto Star, filed a lawsuit against Anthropic in Ontario's Superior Court of Justice ^[1]. They allege the AI company scraped thousands of copyrighted news articles to train its Claude large language models, without permission or payment, and that Claude can reproduce those articles almost verbatim on request.

The claim is for damages amounting to 20,000 Canadian dollars per infringed work ^[1]. Anthropic has not yet filed a defence.

The case joins a growing list of copyright disputes over AI training data, including lawsuits against OpenAI and Meta in the United States. What makes the evidentiary question interesting is how much of it comes down to records neither side can easily produce.

The evidence problem

Proving copyright infringement in an AI context means answering two questions: which material was in the training data, and how does a given output relate to it?

Think of it like asking someone to remember every book they read at university and then explain how a specific sentence in an essay connects to one of them. It's not impossible, but without a reading list written at the time, you are reconstructing from memory.

For the plaintiffs, the obstacle is access. They don't have Anthropic's training data manifests or logs. They can point to outputs that look like their articles and to public statements about scraping practices, but unless Anthropic's own records are disclosed, much of the argument rests on inference.

For Anthropic, the obstacle is reconstruction. Even if the company kept detailed records of what went into which training run, showing how a model arrives at a particular output is a research problem, not a lookup. Models don't store copies of training data in a filing cabinet; they learn patterns. Tracing a specific output back to a specific input is harder than it sounds.

What the law asks for

Canadian courts, like Swedish ones, apply free evaluation of evidence ^[2]. That means anything can be presented, and the court decides what weight to give it based on how reliable it appears. A screenshot, a witness statement, a contract and a server log all get assessed on their merits.

In a copyright case, that typically means the plaintiff shows the protected work, shows the alleged copy and argues similarity. If the defendant claims no copying took place, they need to explain why the similarity arose some other way, or show their records prove the work wasn't used.

Without good records, both sides end up relying on expert testimony, statistical arguments and circumstantial evidence. That works, but it's slower, costlier and less certain than being able to point to a manifest and say: this is what was in the training set on that date, unchanged since we froze it.

How sealing a manifest would work

This is a case where a digital witness fits well, because the core dispute is about what existed when.

Here, the thing to seal is the training data manifest: a list or snapshot of which data sets, articles or corpora went into a training run, recorded when the data set is frozen. The content stays with the organisation; what gets sealed is a fingerprint of the manifest.

Sealing happens at the moment the data set is locked for training. Anyone the organisation later shares the manifest with, whether in disclosure, in court or to a customer asking about provenance, can calculate the fingerprint again and check it against the sealed one. If it matches, the manifest is exactly what was recorded at that time. Change a single entry and it won't match.

What it shows is which version of a data set existed when it was frozen for training, and that it hasn't been edited since. What it doesn't show is that the data was lawfully obtained, representative or actually used in the training run, or that the model's outputs are derived from it. Those are separate questions.

The same approach works for generation logs: sealing a record of what the model generated, when and with which prompt, so that if a dispute arises months later, both sides have a checkable record of what happened.

How it would work

1. At the point a training data set is frozen, the system sends a fingerprint of the manifest to WitniumChain and gets a witness ID back.
2. When the manifest is later shared, the recipient calculates the fingerprint again and compares it with the sealed one.
3. If it matches, the manifest hasn't changed. If it doesn't, someone has edited it, intentionally or otherwise.

You can do the same with generation logs, sealing a record of each output as it happens. The content itself never leaves your systems. The first 2,000 witnesses a month are free, and you can integrate through the REST API, the SDK or the MCP server. Read the docs.

What this means for you

If you are training AI models, ask yourself:

• Could you show, two years from now, exactly which data sets went into a particular training run?
• If a customer or a court asked for that record, would you be reconstructing it from notes, or could you point to a sealed manifest?
• Do you have a record of what your model generated in response to a given prompt last month?

If you are a publisher or rights holder worried about unauthorised training:

• Are you keeping records of when and where your content was published, in a form that would hold up if you needed to show it was available at a certain time?
• If an AI company claims they didn't use your material, could you point to evidence that it was in a corpus they admit to scraping?

Neither sealing a manifest nor sealing a generation log decides the legal question of whether the use was lawful. What it does is make the factual question, what was in the training data and what did the model output, easier to answer with evidence rather than argument.

What to watch

The Canadian lawsuit is at an early stage, and Anthropic has not yet filed its defence. We will update this article when more is known.

In the EU, Article 10 of the AI Act requires high-risk AI systems to use relevant, representative training data with documented governance, including data provenance ^[3]. That applies to high-risk systems under Annex III from 2 December 2027. It doesn't require sealing, but it does require documentation, and sealed manifests are one way to make that documentation checkable.

Article 12 requires high-risk systems to log events over their lifetime, for traceability ^[4]. For Annex III systems, that also applies from 2 December 2027. Again, it says what to log, not how to protect the logs, but a log you can show hasn't changed is easier to rely on when something is questioned.

If your organisation trains AI models, builds them for others or uses them in ways that could one day be disputed, deciding now what records to keep, and how to keep them checkable, is cheaper than reconstructing them later under pressure.