the short answerYou own it — but "own" means three different things.
People say "who owns the code" and mean three separate questions stacked on top of each other. One: can it be copyrighted at all? Two: does the AI vendor claim any rights to it? Three: where does the code physically live and who controls that repository? Conflating them is where teams get burned. You can have clean vendor terms and still have your IP sitting in a custody you don't govern. Sort the three out and the fear evaporates.
- Copyrightability — is the output a protectable work?
- Vendor rights — does the model provider keep a license to it?
- Custody — whose repository, whose account, whose audit trail?
the copyright layerCopyright needs a human author. Pure machine output doesn't qualify.
The U.S. Copyright Office and most jurisdictions are consistent: copyright protects human authorship, and material generated wholly by a machine isn't registrable. Code an AI produces with no meaningful human direction sits in a gap — you can use it, but you may not be able to defend it as exclusively yours. What restores protection is human creative judgement: directing, editing, refining, deciding what good looks like. Contract language from a vendor allocates responsibility, but it can't manufacture authorship that copyright law refuses to grant. So the practical question becomes: can you show a human shaped the result?
- Wholly machine-generated code may not be copyrightable — a real gap.
- Human direction, editing and refinement restore a protectable claim.
- Vendor terms allocate liability; they don't create copyright on their own.
the vendor layerRead the terms — most providers don't claim your output, but conditions hide there.
On the major coding tools — Claude Code, Copilot, Cursor — the provider typically does not claim ownership of what you generate; GitHub's own terms say it claims no ownership rights to your content. But "you keep it" isn't the whole story. Free vs. paid tiers differ, some plans train on your code unless you opt out, and there's a separate, real risk: a model can reproduce licensed open-source verbatim, dragging a GPL obligation into a product you meant to keep proprietary. That's not a vendor claiming your code — it's your code accidentally inheriting someone else's license. Both need governing, and prompting-and-hoping is not governance.
- Most providers disclaim ownership of your output — but check the tier.
- License contamination: a model can echo GPL code into your repo.
- Indemnification and training-data clauses vary; the liability stays with you, the shipper.
the layer that's actually yoursCustody is the question you can fully control — so make it the answer.
Copyright and vendor terms are mostly out of your hands; custody is entirely in them. Custody is: which GitHub does the code land in, under which account, with which commit history, behind which review. If AI output flows through a black-box SaaS and lands in someone else's repository, you've outsourced your most important asset. Agentation inverts that. Every change agents produce is a commit, with a real author and message, opened as a pull request in your own GitHub organisation, on your existing AI plan. The provider never holds your code; we never hold your code. You own the repository, the history, and the chain of evidence that proves a human governed the work.
- Code lands in your GitHub org, not a vendor's locker.
- Every change is a commit + PR — real author, message, diff, review.
- The commit history is your audit trail: proof a human directed the work.
the bigger pictureVibe coding makes ownership worse — unless there's a method underneath.
"Vibe coding" — describing software to an AI and shipping what comes out — is exploding, and in a company it quietly wrecks the ownership story. Code nobody reviewed, of uncertain provenance, with no record of who decided what: that's not an asset, it's a liability you can't even audit. The way out isn't to ban the AI; it's a method. We call it the Digital Native Method: a Product Owner describes intent on the live product, a Tech Lead encodes the rules once — architecture, conventions, security, the maintainability bar — and agents deliver inside a structure that verifies everything with deterministic gates (lint, types, tests, security) before anything reaches production, all through your GitHub. Ownership stops being a hope and becomes a property of the pipeline.
- Unreviewed, untraceable AI code is a liability, not an owned asset.
- A Tech Lead encodes the rules once; agents can't ship outside them.
- Gates run before prod; provenance is recorded in commit history.
cocoricoSovereign on the tools, even when you're not sovereign on the models.
Agentation is a French company, built by a French team — and that shapes how we think about who controls what. You probably won't be sovereign over the foundation models; Claude and GPT aren't European. But with just a model you don't do much — the orchestration is where the leverage and the data live, and that you can absolutely keep close. Agentation runs in the EU (Hetzner, Germany), stores its data in the EU (Supabase), routes your code through your own GitHub, and is built to be RGPD-clean. We don't see your code, and your IP never leaves a custody you control. Sovereignty over the tools that wield the models is most of the battle — and that one is winnable.
- French company, French team — European by design, not by retrofit.
- EU hosting (Hetzner), EU data (Supabase), RGPD-aligned.
- Sovereign on orchestration even when the models aren't European.
FAQIf an AI wrote it, do I legally own the code?
You generally own the right to use it, but pure machine-generated code may not be copyrightable, because copyright requires a human author. The fix is meaningful human involvement — directing, editing and refining the output — which restores a protectable claim. Separately, custody is what you fully control: with Agentation the code lands in your own GitHub with a commit history that documents human governance.
Does the AI vendor (Claude, Copilot, Cursor) own what I generate?
On the major coding tools the provider typically disclaims ownership of your output — GitHub, for instance, claims no ownership rights to your content. But terms differ by tier, some plans train on your code unless you opt out, and a model can reproduce licensed open-source. Read the terms, govern the inputs, and keep custody of the output in a repository you control.
What's the risk of AI reproducing open-source licensed code?
It's real. Models trained on public repositories can emit passages of licensed code verbatim, which can drag a copyleft (e.g. GPL) obligation into a product you intended to keep proprietary. That's why prompting-and-hoping isn't governance: Agentation runs deterministic checks before code lands, and every change is a reviewable commit, so provenance and license risk are inspectable rather than invisible.
Where does Agentation's AI-generated code actually live?
In your own GitHub organisation, on your existing AI plan. Agents produce real commits and open pull requests in your repositories — the provider never holds your code, and neither do we. You keep the repository, the history and the audit trail. Custody is the one ownership layer you can fully control, so we hand it entirely to you.
How does Agentation help prove a human governed the code?
Every agent change is a commit with an author and message, gated by deterministic checks (lint, types, tests, security) and opened as a pull request for review. A Tech Lead encodes your standards once so agents work inside them. The resulting commit history is a chain of evidence — it shows human direction and review, which is exactly what strengthens both your IP claim and any audit.
Is Agentation a sovereign / EU-friendly option for AI coding?
Agentation is a French company. You won't be sovereign over the foundation models themselves, but you can be sovereign over the tools that orchestrate them — and that's most of the value. Agentation hosts in the EU (Hetzner), stores data in the EU (Supabase), routes code through your GitHub, and is built RGPD-aligned, so your IP and data stay in a custody you govern.