Who Owns The Algorithm? The Legal Gray Zone In AI Trading

Forbes

2 days ago

Brian Moynihan, CEO of Bank of America, is spending $4 billion a year on new technology initiatives ... More such as AI.
As artificial intelligence continues to reshape financial markets, it brings with it a core legal and strategic dilemma: who owns the algorithm? A recent Bank of England report raised alarm bells over the systemic risks posed by increasingly autonomous AI trading systems. While much of the concern has focused on market volatility, the equally urgent yet less discussed question is who controls, protects, and is accountable for the intellectual property these systems generate.
Under current law, AI systems lack legal personhood and cannot own anything, including copyrights. This means that any code, model, or strategy generated entirely by AI may not qualify for copyright protection unless there is clear human authorship involved. The U.S. Copyright Office has reinforced this position, ruling that non-human authorship cannot enjoy statutory protection. As a result, if an AI independently develops a novel trading strategy, the entity deploying that AI could be exposed, without patent protection, copyright coverage, or a clear paper trail. This creates a competitive vulnerability, especially in algorithmic trading, where uniqueness can deliver billions in edge. Firms have to rethink their IP strategy to make sure human review and oversight are part of the development loop.
Firms are increasingly turning to a mosaic of legal mechanisms to protect their proprietary algorithms:
Patents can protect novel and non-obvious algorithms with demonstrable utility. However, because algorithms are often deemed abstract ideas, patent eligibility is hard to secure and even harder to enforce internationally.
Copyrights protect the specific software implementation and expression of an idea, not the algorithm itself. Crucially, human authorship must be demonstrable, meaning that fully AI-generated code is unlikely to be eligible.
Trade Secrets are the most common and practical form of protection for algorithmic trading. Firms treat not only their code but also training datasets, model weights, and even failed strategies ('negative knowledge') as trade secrets. However, this protection is fragile and requires strict internal access controls and documentation procedures.
Trademarks, while not protecting the algorithm directly, safeguard the brand identity associated with algorithmic trading services, helping firms establish market dominance and trust.
For financial institutions, the strategic implications are clear. If your algorithm is your edge, and the edge isn't legally defendable, you've built a business on shaky ground.
The rise of generative AI complicates these protections further. As Dan Bosman, CIO at TD Securities, explained in a company podcast, 'You're not just protecting source code anymore. You're protecting the logic, the training data, the biases, some of which are inherited from external datasets you may not even fully control.' In a McKinsey report, financial executives cited intellectual property uncertainty as one of the primary reasons they have not scaled generative AI pilots beyond internal sandboxes. The fear isn't just regulatory, it's losing control of a core business differentiator.
In parallel with these challenges, regulation is catching up. The EU's AI Act, adopted in May 2024, introduces a tiered approach to risk classification for AI systems. High-risk systems, including those used in trading, must include clear human oversight, transparent decision-making, and documented model lineage. While this doesn't solve the ownership question outright, it does pressure firms to ensure there is a traceable human role in the development and operation of trading algorithms. On the U.S. side, policymakers are more fragmented. The SEC, CFTC, and FTC all have overlapping interests in how AI affects financial products, consumer protection, and market fairness. But none have yet addressed IP protection for AI-generated investment strategies head-on.
In the absence of a clear legal framework, here's what financial institutions and fintechs should be doing right now:
1. Build Human-in-the-Loop (HITL) Processes: Ensure that even if an AI system generates a new strategy or model, a human analyst or engineer reviews, modifies, or approves it. This not only improves quality control but can establish a stronger case for human authorship.
2. Audit and Document Model Development: Create a transparent pipeline showing how AI-generated content was developed, what data was used, and what decisions were made by humans. This 'model provenance' will be essential for IP protection and regulatory compliance alike.
3. Layer Your Legal Protections: Don't rely on a single form of protection. Use trade secrets to lock down internal know-how, copyrights for implementation, and patents where feasible. Also, enforce NDAs and internal security policies to preserve the defensibility of those protections.
4. Engage Legal Counsel Early: Too many firms involve IP counsel only after a product is market-ready. In the AI era, your legal strategy must be part of your R&D process, especially when AI outputs blur the lines of authorship and originality.
5. Monitor Regulatory Signals: Watch for updates from the U.S. Copyright Office, EU Parliament, and financial regulators. AI policy is moving fast, and what isn't protected today could be covered tomorrow, or vice versa.
As the financial sector races ahead with AI, the law is lagging behind. The institutions that succeed in this environment will not be those with the smartest algorithms, but those with the foresight to protect, document, and defend what their systems create. In a world where the next billion-dollar trading edge might be written by a machine, the real competitive advantage lies in knowing who truly owns the outcome and making sure you can prove it.
For more like this on Forbes, check out The Legacy Banks Quietly Building The Future Of Finance and The 3 Innovation Challenges Keeping Bank CEOs Awake At Night.