Audio is where the copyright and identity questions hanging over all of generative AI have come to a head first and hardest, because a voice and a song are so personal. The image and video labs will face versions of this; the audio companies are living it now. Two threads run through everything in this part: who owns the training data, and who owns a voice.
The turn toward licensed data
The dominant story of 2025 and 2026 is a decisive pivot toward licensed or owned training data as the basis for commercial safety, and two camps emerged. The first is the licensed-data pure plays, Stability and ElevenLabs, who trained on rights-cleared catalogs (Stable Audio on licensed and Creative Commons data, Eleven Music under opt-in deals with Merlin and Kobalt) and market indemnification and clean provenance as the product. The second is the litigate-then-license path of the incumbents: Suno and Udio were sued by the major labels, then converted those suits into licensing deals, Udio by settling with Universal, Warner, Merlin, and Kobalt into a walled garden, Suno by settling with Warner while fighting to keep downloads. Critically, the settlements are not universal. Sony has settled with neither, and Universal's case against Suno was unresolved as of mid-2026, so a definitive US fair-use ruling could still land in 2027 and reshape everything.
A voice is now legally you
The law is racing to treat a voice as a protectable part of a person's identity, with consent as the organizing principle. Tennessee's ELVIS Act, effective July 2024, was the first state law to explicitly protect a voice, including simulations of it, and notably it reaches the makers of the cloning tools, not just the end users. The federal NO FAKES Act, which would create a nationwide right against unauthorized digital voice and likeness replicas, has been introduced repeatedly but not enacted, and it is genuinely contested, with critics warning its takedown-style obligations could burden lawful expression. On the labor side SAG-AFTRA has moved fastest and most concretely, striking deals that require informed consent both to create a replica and, separately, again to use it, plus compensation, time limits, and disclosure.
Provenance, and the through-line
The technical answer to all this is provenance, and it comes in two flavors that are often confused. Embedded watermarks, like Google's SynthID, Resemble's PerTH, and Meta's AudioSeal, hide a signal inside the audio itself that survives some editing and supports detection. Content Credentials, the C2PA standard backed by Adobe, OpenAI, and Microsoft, attach cryptographically signed metadata that proves origin when present but strip easily when a file is re-encoded. Both help; neither is a guarantee. Recent research is blunt that watermarking and detection remain an arms race that can be gamed, so provenance should be treated as a deterrent and an audit aid, not proof.
The week the distributor became the defendant
Between September 15 and September 18, 2026 the music rights fight moved one layer down the stack, away from the model and onto the pipe. UMG Recordings and affiliated labels sued the distributor DistroKid in the District of Delaware, case 1:26-cv-01156, docketed as a copyright action; trade coverage of the complaint describes claims under Delaware's deceptive trade practices act alongside direct and vicarious infringement, and reports allegations that the service floods streaming platforms with AI-generated tracks while continuing to distribute recordings it has already been told are infringing. Three days later UMG, Sony and affiliated labels filed a second complaint against Suno in the District of Massachusetts, case 1:26-cv-14275.
In between, 404 Media published the demonstration. A reporter generated a song in Udio and got it published to a real Brooklyn band's verified Spotify page, along with the band's Apple Music, Tidal and Amazon Music pages, without the band's knowledge, by signing up with a digital distributor and claiming to be the artist. No model was compromised to do this. The failure was entirely in identity verification at the point of upload.
For anyone shipping AI-generated audio, this is the shift that changes operating practice. The compliance surface is no longer only the model you generate with and the rights to the training data behind it. It is the upload: who you say you are, what catalogue you claim, and whether the distributor between you and the platform can verify it. Identity at ingestion is the control the whole chain skipped, and it is now the one being litigated.