I try to write these essays to be evergreen, and the 2021 version of this post has mostly held up (curation matters, good information is worth paying for, and a vague gesture at ‘the news’ is still a non-answer). But the ground has shifted enough since then that it deserves a full update.
The premise behind both posts is Clay Shirky’s old line: “It’s not information overload. It’s filter failure.” There is no such thing as too much information, only inadequate filtering. In 2021, my filters were editorial: choose good sources, ignore bad ones. That was about all an individual could do. What’s changed is that the filters have become programmable.
The short version: every source becomes a feed, every feed becomes searchable by meaning, and an assistant reads it all before I do.
Everything funnels into one place: a self-hosted instance of Miniflux, a deliberately minimal open-source RSS reader. Currently about 130 feeds across law, tech, AI, data and finance.
RSS keeps getting declared dead, and keeps being the only thing that actually works. It is the last open standard that lets you own your information diet rather than rent an algorithm’s idea of it. No engagement optimisation, no inserted outrage, no ‘you might also like’. A feed reader shows you what your chosen sources published, in order, once. That property gets more valuable every year, especially now that an increasing share of what algorithms surface is generated noise.
Self-hosting it matters less than using it. But hosting my own copy means the archive is mine, which is what makes the rest of this possible.
The problem with building your life on RSS is that many of the most useful sources don’t offer it, either because they never did or because they’d rather you came to them and scrolled.
So I manufacture the missing feeds. I run n8n, an open-source workflow automation tool, and any source without a feed gets one built for it. The pattern is always the same: a scheduled workflow fetches the source, extracts the full text of each item, stores it, and a webhook serves the result as a standard RSS feed that Miniflux subscribes to like any other.
Some examples of what this produces:
One rule across all of these: full text, always. A feed of headlines only queues up clicks (and the click usually lands on a page that wants something from you). Full articles are reading material.
A reader full of full-text articles is good. A searchable one is something else entirely, and the economics of it surprised me.
I forked Miniflux to add semantic search. The fork adds a background worker that gives every article a vector embedding, a numerical fingerprint of what the text means rather than which words it contains. The mechanics, for the technically minded:
For the model I use Qwen3-Embedding-8B, an open-weights model served via OpenRouter at $0.01 per million tokens. It natively produces 4,096-dimensional vectors, but I truncate to 1,024, for four reasons:
And the cost, which is the part I find genuinely absurd: a stripped article averages well under a thousand tokens, and roughly 250 articles arrive a day. That’s under 0.2 million tokens a day, about a fifth of a US cent, or roughly 70 cents a year. Embedding the entire archive from scratch costs about seven cents. The semantic search layer over everything I read costs less per year than a single newspaper costs per day. Five years ago this capability didn’t exist outside well-funded search teams; today it’s a rounding error on a hobby server.
What it unlocks is two things keyword search can’t do:
This quietly changes what a feed reader is. A normal reader is a river: things float past, and once they’re gone, they’re gone. With embeddings, the river silts up into a research corpus. When I’m writing about, say, data licensing, the first stop isn’t Google but a semantic query over thousands of full-text articles from sources I already trusted enough to subscribe to (better signal-to-noise than the open web, by construction).
The last layer is the newest. A self-hosted AI assistant (a heavily-forked nanobot) has tool access to the same reader and archive, and it reads the firehose so I don’t have to.
Every morning, before 10am, it sends me a briefing over WhatsApp. It’s triaged rather than summarised (a digest is just a smaller firehose):
The design point: the assistant queries the same curated corpus I read. It is not summarising the open internet; it is triaging sources I already chose. Skip the curation step and you have a very confident noise amplifier.
And during the day it’s a research tool: I can message it “what’s the recent coverage on X?” from my phone and it runs the semantic search and comes back with the relevant pieces, linked, from my own archive.
Rereading the 2021 post, the foundations survive contact with all this machinery:
Every layer here narrows. The reader only contains sources I chose. Semantic search ranks by proximity to a question I already knew how to ask. And the assistant scores the overnight arrivals against the projects I am already working on, which is the narrowest filter of the three, because it is the only one that knows what I did yesterday. All three point the same way, and what they screen out is the same thing each time: whatever I wasn’t already looking for.
The 2021 version had accidental breadth built into it, mostly through inefficiency. You skim a feed and read something irrelevant because it happens to be sitting there. A triaged briefing removes exactly that, deliberately. Serendipity is a waste of time that turns out not to be, and I have not found a way to write a scoring prompt that protects it.
The embedding layer has a sharper version of the problem. Nearest-neighbour retrieval returns what is close in meaning to the query, and the genuinely useful piece is often the distant one (the paper from another field that turns out to be about your problem in a different vocabulary). Cosine similarity is close to the wrong instrument for finding that.
I am not sure this is bad, though. Serendipity gets romanticised by people who have not counted how much of it was noise. And there is an argument the other way: ‘more like this’ across ~9,200 articles from feeds that never cite each other does surface connections I would not have made by hand, which is a manufactured version of the same thing. Whether it replaces what it displaces, I don’t know. I have been running the whole stack for months rather than years, which isn’t long enough to tell.
Shirky’s line is nearly twenty years old now, and it has aged into something more practical than he probably intended: filter failure is no longer just a diagnosis, it’s an engineering problem, and one an individual can now actually solve, with open-source software, a modest server and an AI bill measured in cents. The explosion of information is real enough. It’s the filtering that decides whether it matters, and filtering is finally something you can build for yourself.
I do still ask the interview question. But the bar has moved: anyone can ask a chatbot “what’s new in my field?” and get something fluent back. The interesting answer now is having an information diet a machine can usefully work on: chosen sources, full text, owned archive, searchable by meaning. Which is mostly curation, and curation is still the slow part.
]]>I think that’s wrong. I think the barrier between “I have an idea” and “it exists on the internet” has never been lower. And I think more people – especially people who aren’t engineers – should just build things.
Here is a partial list of things I have shipped:
I built STRIDE – a digital regulation tracker that monitors draft laws across dozens of jurisdictions. It’s used by in-house legal teams at large companies. It’s a proper product, with users and infrastructure and a roadmap. I built it because we were tired of regulatory horizon-scanning being a PDF someone emails around once a quarter.
I built AI Collider – a visual diagnostic for comparing AI strategies across 72 dimensions – because I wanted to see where AI policies agree and diverge, not read about it in a table.
I built AI Contract.ing because the Society for Computers and Law published useful AI Act template clauses as a 60-page PDF, and a 60-page PDF is a bad way to use template clauses.
I built Magic Story Club because my kids wanted bedtime stories about themselves.
I built Operation GoGoGo because getting three children out of the house on a school morning is a logistics problem, and logistics problems deserve dashboards.
I built LessIsMortgage because I wanted to compare mortgage scenarios side by side and nothing free let me do it properly.
I built GoodKnight because my son and I play chess on a Kindle at bedtime, and there wasn’t a single over-the-board chess game for Kindle. Then I added Stockfish so we could learn to spot pins and forks.
None of these required a computer science degree. None of them required a team. Most of them started as “this annoys me” or “wouldn’t it be nice if.”
The hard part of building things is no longer the code. The effort used to be so high, most things would have to be a business, and so was about knowing what to build that would be valuable to others. I now think that great value, and products, can readily just come from solving personal irritation, and continuing from there.
If you work in a domain – law, finance, education, whatever – you have something most engineers don’t: deep context. You know which problems are real and which are imagined. You know what “good enough” looks like. You know who will actually use the thing, because you’re one of them.
The tools have caught up. Open source gives you the components. Cloud hosting means you don’t need a server room. AI assistants will pair-program with you, explain error messages, and scaffold things you’ve never built before. The distance between “I wonder if I could…” and a working prototype is measured in hours now, not months.
You will write bad code. Your first version will be ugly. You will deploy something and immediately find a bug. This is normal. This is how it works for everyone. The difference between someone who builds things and someone who doesn’t is not talent – it’s a habit, the development of a muscle, and tolerance to increase your surface area for being criticised.
I write better technology contracts because I’ve deployed my own infrastructure. I give better advice on data protection because I’ve built systems that process personal data. I understand AI regulation better because I’ve built AI products.
The legal profession talks constantly about legal technology, but an uncomfortable amount of that conversation happens at a safe distance from actual technology.
Building things changes how you think. Not because writing code is inherently enlightening, but because shipping something real, something with users, something that can break, forces a kind of honesty that reading about technology never does.
Pick a thing that annoys you. A process at work that’s held together with email. A spreadsheet that should be an app. A PDF that should be a website. An evening routine that deserves a dashboard.
Build it badly. Ship it. Improve it. Show it to someone.
You can just build stuff. Here’s my little contribution.
]]>Everyone talks about data rights (even when they mean rights in data). There is much less conversation about data custody — who actually has the thing, where it sits, and what that means.
This matters because of an asymmetry that most commercial discussions skip over: custody matters most when rights are weakest. If you have strong IP rights — a patent, a registered trade mark, a clear copyright — and use is visible, you can normally enforce those rights. Sue for infringement, get an injunction, it doesn’t matter who has the copy. But when rights are weak or non-existent — which is the case for most raw data, and arguably for a lot of what’s inside AI models — then custody is the power. Whoever has the thing controls the thing.
The first kind of property is the obvious kind. You hold the thing. A coin, a painting, a barrel of oil. Custody is physical. Property rights are inherent — they exist just because the thing exists. You don’t need to register them or create them. The barrel is yours because you have it, until someone proves otherwise. English law calls this a chose in possession — literally, a thing you possess.
Then people realised that being owed something was itself a kind of asset. A debt, a share, an insurance claim — you don’t hold anything, but you have a right to demand something from someone. The asset is a legal relationship, not a physical object. You can’t pick up a debt and put it in your pocket, but you can enforce it in court. David Graeber set out that debt was a pre-cursor to money, so the ‘claim against someone having value’ concept is very old. In the second century, Gaius classified these as res incorporales — incorporeal things. Bracton received that idea into English law in the thirteenth century as the chose in action: a thing you can only claim by action, not by taking physical possession.
These two categories did an extraordinary amount of work. In 1885, Fry LJ declared there was nothing else: “All personal things are either in possession or action. The law knows no tertium quid between the two.” 💬Colonial Bank v Whinney (1885) 30 Ch D 261, 285. Fry LJ was dissenting in the Court of Appeal, but his view was upheld by the House of Lords. That dictum hardened into orthodoxy. For over a century, everything had to go in one of the two boxes.
Then the boxes started creaking. In 1987, the Privy Council dealt with export quotas that didn’t fit either category (Nai-Keung). In 2015, the Court of Appeal saw a “powerful case” for recognising a third category for intangible information (Your Response v Datateam). The courts were circling a problem they could see but hadn’t yet been forced to name.
Then came bitcoin. And it didn’t fit.
In “Data is the new oil” I set out a hierarchy: information, data, a copy of data, and rights in data. That hierarchy is useful here too, because it shows where the law gives you something to enforce, and where it doesn’t.
| Thing | Protectable rights? | What custody gives you |
|---|---|---|
| Information (bare facts — the FA Cup score, the base rate, how much rain fell) | None. No IP rights in facts about the world. | Custody is the only control. Once someone has a copy, there is no legal basis to restrict use unless there’s a contract. |
| Data (recorded/structured information) | Maybe. Database right if there was substantial investment in obtaining, verifying or presenting it. Copyright if the selection or arrangement of the database was original. | The rights attach to the database, not the data. Only if a human did something original or substantial. Most raw data has nothing. |
| The medium (hard drive, server, paper) | Yes — traditional property (chose in possession). | Clear physical custody, but a red herring when data can be copied off the medium without diminishing the original. |
| Software (code) | Copyright — well established. Code is a literary work. | Custody of source code gives practical power beyond the legal right. Trade secrets, competitive advantage, the ability to modify. |
| Crypto assets | Third category — the Property (Digital Assets etc) Act 2025. Neither possessed nor owed. | Custody is the asset. “Not your keys, not your coins.” Control of the private key is the entire relationship. |
| AI model weights | Probably nothing. No copyright (machine-generated, not expressive). No database right in the US (doesn’t exist) or UK (wrong jurisdiction). Trade secrets and contracts only — both dependent on custody. | The open question is not what rights exist. It’s what happens when they don’t. |
The row I’m going to go on to talk about is the last one. But before getting there, it’s worth understanding why Parliament created the third box — because the reason tells you what might come through the door next.
A bitcoin is not a chose in possession — you can’t hold it, touch it, or point at it. It has no physical manifestation. But it’s not a chose in action either — nobody owes you anything. There is no counterparty. No bank holds a balance on your behalf. No company has issued a share. You are not owed a debt.
What you have is a cryptographic secret — a private key — that gives you control over an entry in a distributed ledger. You don’t hold anything physical. You’re not owed anything by anyone. You know a secret that gives you control.
In AA v Persons Unknown [2019], Bryan J held that bitcoin was property — without needing to decide whether it was a chose in possession or a chose in action. But the reasoning left a tension. Was bitcoin property because it was a chose in action after all? Because property law admits a third category? Or was the whole thing a mistake — bitcoin simply isn’t property? More cases followed, each agreeing that bitcoin is property, none fully consistent on why.
The Law Commission — a national treasure, an independent body that keeps the law under review and recommends reform where it is needed — consulted on the classification of digital assets against this property framework. All 549 pages of it are a great read, full of the history and context and tensions. I led on drafting a response to that consultation when I was at Deloitte Legal (page 446 here).
The consultation recommended a third category of personal property: things that are neither possessed nor owed, but that exhibit certain qualities that make them property-like. Parliament agreed. The Act that followed skipped all that detail in an elegant one-pager — my favourite consultation-to-legislation ratio of 549:1 — that says a thing is not prevented from being property just because it is not a chose in possession or a chose in action. 💬Of course it’s very unfashionable to talk in Norman French these days, so the legislation uses thing instead of chose.
In the meantime, cases were still arriving in the courts. In D’Aloia v Persons Unknown [2024] — handed down literally one day after the Bill was introduced to Parliament — the High Court reached the same conclusion at full trial, and noted that its reasoning “aligns with” the new Bill. The courts were building the law in real time. Parliament confirmed it.
The Law Commission went further in its final report: Fry LJ’s dictum that there was no tertium quid, it said, “is almost certainly no longer correct (to the extent it ever was).” That parenthetical — to the extent it ever was — feels quite Whiggish though.
And then Yuen v Li [2026] — the first case to apply the Act — showed why calling something ‘property’ is only half the story. This is where the murkiness and opaqueness of English litigation history really becomes relevant. In researching this essay, I uncovered this banger from Sir John Salmond, penned in 1905 💬JW Salmond, ‘Observations on Trover and Conversion’ (1905) 21 LQR 43, cited in OBG Ltd v Allan [2007] UKHL 21 at [223]:
“Forms of action are dead, but their ghosts still haunt the precincts of the law. In their life they were powers of evil, and even in death they have not wholly ceased from troubling. In earlier days they filled the law with formalism and fiction, confusion and complexity, and though most of the mischief which they did has been buried with them, some portion of it remains inherent in the law of the present day. Thus if we open a book on the law of torts, howsoever modern and rationalized, we can still hear the echoes of the old controversies … and we are still called upon to observe distinctions and subtleties that have no substance or justification in them, but are nothing more than an evil inheritance from the days when forms of action and of pleading held the legal system in their clutches.
In no branch of the law is this more obvious than in that which relates to the different classes of wrongs which may be committed with respect to chattels. In particular the law of trover and conversion is a region still darkened with the mists of legal formalism, through which no man will find his way by the light of nature …”
In Yuen v Li, the claimant’s estranged wife had allegedly stolen 2,323 bitcoin from his cold wallet by covertly recording his seed phrase. He sued in conversion — the strict liability tort for interfering with someone’s property. Attractive, because conversion doesn’t require you to prove fault. Salmond’s ghosts were however also in the courtroom. Cotter J struck the claim out. Bitcoin is property, yes. But conversion is a tort for tangible things — chose in possession. The Act creates a third category, but it doesn’t import the remedies that attach to the first. You can own bitcoin as property. You cannot, in the common law, have it converted.
The claimant wasn’t left without remedies — he could proceed on proprietary restitution, constructive trust, unjust enrichment. But those are equitable claims, not common law torts. They require different things to be proved and give different relief. Being recognised as property is necessary but not all property is the same. The custodial architecture — the cold wallet, the seed phrase, who physically held the device — determines also who has practical power. The legal architecture hasn’t yet built remedies that match.
Cotter J left a door open, noting that “a discrete cause of action drawn by analogy with conversion” might yet emerge for wrongful interference with third-category things. That’s the law reaching for something it doesn’t yet have a name for — a tort of digital custody interference, perhaps.
The important structural observation across all of this is that the how you hold it caused the what it is to change. The legal category had to be invented because the custodial relationship was fundamentally new. Custody of a cryptographic key is a different relationship between a person and a thing than holding a coin or being owed a debt. The architecture of custody drove the architecture of property law — and it is now driving the architecture of property remedies.
The law has periodically stretched the incorporeal-property idea to absorb new forms of value — from Gaius placing obligations among res incorporales in the second century, through Bracton’s reception of that idea into English law as the chose in action in the thirteenth, through to the 2025 Act. Each stretch reshapes what can be owned, transacted, and enforced. Yuen v Li suggests the next stretch will be in remedies, not just classification.
Even before any of this, the gap between “who has the thing” and “who has the right to the thing” needed legal machinery. The history of that machinery is worth knowing, because the same structural tensions keep recurring.
The pattern across all of these is the same: when custody and ownership separate (whichever way), you need legal and commercial architecture to manage the gap. Bailment. Trust law. Warehouse receipts. Nominee arrangements. Escrow agreements. Each is a technology for bridging the distance between the person who has the thing and the person who has the right to the thing, or a duty in respect of it.
Digital custody has properties that physical custody never had. They cut both ways.
Digital custody runs from “you definitely have it” to “you think you have it but others might also have it without you knowing.” That spectrum doesn’t exist for physical things. Either someone has your painting or they don’t. There is no state in which a third party has a copy of your painting without your knowledge while you continue to believe the original is safe on your wall.
The takeaway is: the certainty of custody is itself uncertain. Physical custody is binary. Digital custody is probabilistic.
This brings us to the row in the table that had question marks. And the answer, once you work through it, is not that model weights need a new category of property. It is that they probably have no IP protection at all — and that custody is therefore the entire game.
Start with what a trained model actually is. Billions of numerical parameters — floating-point weights — produced by running an optimisation algorithm over a training corpus. A structured representation of learned patterns. That sounds a lot like a database. And database law is well settled, at least in the UK and EU: if there was substantial investment in obtaining, verifying, or presenting the contents, a sui generis database right attaches.
But almost nobody trains frontier models in the UK. The database right requires the maker to be established in the UK or EEA. If training happens in California — which is where it does happen — the right doesn’t attach. And even if it did, the BHB v William Hill distinction matters: database right protects investment in obtaining contents from third-party sources, not in creating new data. Model weights don’t exist before training. They are created by the process. The investment is in creation, not obtaining.
And the US? The US has no database right. Congress tried to create one four times between 1996 and 2003. Every bill failed — constitutional concerns after Feist v Rural Telephone [1991], First Amendment objections, opposition from the science community and the tech industry. No bill has been introduced since 2004. The idea is legislatively dead.
Copyright? In the US, no. Model weights are machine-generated numerical parameters — billions of floating-point numbers produced by an optimisation algorithm minimising a loss function. No human selected or arranged the individual values. The US Copyright Office has been explicit: human authorship is a bedrock requirement (Thaler v Perlmutter [2023]). The weights are not “original works of authorship” under 17 U.S.C. section 102(a). They encode a learned function — a “process” or “system” excluded by section 102(b). No expression, no author, no copyright.
The UK is more interesting. The CDPA has an unusual provision — section 9(3) — that grants copyright in “computer-generated” works where there is no human author. The author is deemed to be “the person by whom the arrangements necessary for the creation of the work are undertaken.” A lab that assembles the training data, designs the architecture, provisions the compute, and launches the training run has a plausible claim to be that person. The UK is one of very few jurisdictions where machine-generated output can attract copyright at all. 💬The provision dates from 1988, when Parliament was thinking about computer-generated databases and compilations. Whether it stretches to cover LLM weights is untested.
But this is academic twice over. First, nobody trains frontier models in the UK — the data centre capacity isn’t there. Training happens in the US, where section 9(3) doesn’t exist. Second, even if someone did train in the UK, they would face a problem the US labs don’t: the UK has no commercial text-and-data-mining exemption. Section 29A of the CDPA permits TDM only for non-commercial research. Training a commercial model on copyrighted material without licences would be infringement. The government proposed a broader exemption in 2022, consulted on it, and then shelved it after rightsholder opposition. The one jurisdiction whose copyright law might protect model weights is the one where you can’t practically or lawfully train them.
Patents? You can patent a novel model architecture or training method (subject to the Alice eligibility hurdles). But you cannot patent the specific weight values. They are the output of a known process applied to specific data. That is not an invention. 💬There are interesting developments in the UK on patenting software methods for LLM training, but that protects the method, not the resulting weights.
So what actually protects model weights? Two things, neither of which is a property right.
Trade secrets. The US Defend Trade Secrets Act (2016) and the Uniform Trade Secrets Act (48 states) protect information that derives economic value from not being generally known, provided the holder takes reasonable steps to maintain secrecy. Model weights qualify easily: enormous economic value, maintained behind API access controls, NDAs, and physical security. The DOJ has already prosecuted AI trade secret theft — a Google engineer was charged in 2024 for stealing over 500 files containing TPU architecture and ML model details (United States v Linwei Ding).
Trade secret law does have reach beyond the thief. Under the DTSA, anyone who uses a trade secret while knowing, or having reason to know, that it was derived from misappropriation is liable — even if they are several steps down the chain. If Bob steals Alice’s model weights and passes them to Charlie, and Charlie knows or should know the provenance is tainted, Alice can get an injunction against Charlie. It ain’t the end of things: the law follows the taint, not just the theft. 💬Alice, Bob, and Charlie are the traditional placeholder names in cryptography, as Blackacre is in property law. It felt right.
But compare that with a patent or a copyright. If Charlie infringes Alice’s patent, Alice sues Charlie. She doesn’t need to prove how Charlie got access, what Charlie knew, or whether Charlie acted in good faith. Infringement is infringement. The right runs against the world. Trade secret protection is structurally weaker in two ways.
First, the evidential burden is harder. Alice must prove that Charlie knew or had reason to know the secret was misappropriated. That means tracing the chain of custody, establishing what Charlie knew and when, and showing the taint. With a patent, you show the patent and the infringing product. With a trade secret, you are litigating the knowledge and conscience of the defendant — a far harder case to make, especially when the secret has passed through multiple hands.
Second, and more fundamentally, trade secret protection can be permanently and irreversibly destroyed — and property rights cannot. Release the weights — as Meta did with Llama — and the trade secret evaporates instantly. It cannot be restored. Once the secret is public, every subsequent user is a good-faith acquirer. Reverse engineering is an express defence. Independent development is a complete defence. You cannot accidentally destroy a patent by leaving the specification on a train. But you can destroy a trade secret by losing custody of it for a single moment. The protection is only as strong as the custodial architecture that maintains the secrecy.
And sometimes the destruction is the strategy. Meta released Llama’s weights deliberately — not a custody failure but a custody move. Commoditise the weights layer so nobody can charge for it, while retaining custody of the training pipeline, the data flywheel, and the social graph that feeds both. You don’t need custody of the thing if you have custody of the inputs to the next version of the thing. Destroying trade secret protection at one layer to consolidate power at another is a play the existing legal categories don’t capture well.
Contracts. API terms of service that prohibit model extraction and distillation. Employment agreements with confidentiality clauses. Licensing terms for open-weight models that restrict downstream use. These bind the parties to the contract — but they don’t bind anyone else. A contract is a relationship between specific people. It doesn’t run with the thing.
In England, there is a freestanding equitable doctrine of breach of confidence (Coco v AN Clark [1969]) that can protect confidential information without a contract. The US doesn’t have this — the UTSA preempts common law confidentiality claims in most states. What remains is trade secret law and contract.
The picture is not that model weights are entirely unprotected. It is that the protection is custodially contingent in a way that property rights never are. A patent holder who loses custody of the patented device still has the patent. A trade secret holder who loses custody of the secret has nothing. That asymmetry is the whole point.
So model weights sit in a familiar place. Not a new category that needs a third box. An old gap — the same gap that bare facts and raw information have always occupied. No IP right attaches. The only protection comes from architecture (keeping the weights secret) and contract (binding the people you give access to).
When there are no property rights, practical power flows from who has the thing:
Everything above is about the model-holder’s position: weak rights, so custody is everything. But the training data rightsholders are in the mirror-image position. They had strong rights — copyright, database right, the full armoury of IP — and they gave up custody. They published their work. They put it on the internet. They relied on their rights to protect them.
That reliance turned out to be fragile, because the party who acquired custody used it to build something that became too embedded to unwind.
The pattern is the same in each case. The rightsholder relied on rights — property or relational — instead of controlling custody. The party who acquired custody built on top of it until enforcement became disproportionate. Then the rightsholder was left negotiating the terms of a reality they didn’t choose. Rights set the terms of the deal. Custody set the power dynamic. 💬I am not setting out an opinion here on the moral stance of product development as a means of legal reform. Laws are not perfect — they keep changing them — and improving them is a social good. But deliberately breaking the law to establish a fait accompli is a different thing from building something that exposes a gap. Breaking the law, good laws and bad ones, should be a last resort in the face of tyranny.
This is sharpest for AI training data, because training is a one-way function. The data goes in. The trained capability comes out. The original data is not meaningfully recoverable from the weights. If the model never outputs verbatim copies, how does anyone prove infringement? That is why New York Times v OpenAI focused on verbatim reproduction — because verbatim output is the only smoke that makes the infringement visible and provable. Without smoke, there is no practical enforcement, regardless of what the rights say on paper. The New York Times is not suing to shut OpenAI down. They are suing to get a seat at the table. The outcome will be a commercial deal — licensing, revenue share, attribution — not an injunction.
The iron rule is this: if you have rights but not custody, your rights are a negotiating position. If you have custody but not rights, your custody is the position. The model-holder who keeps the weights behind an API has practical power. The rightsholder who published a book and now objects to how it was used has a lawsuit. Both are real. They are not equal.
“Possession is nine-tenths of the law” has been true for centuries because the person who has the thing has practical power regardless of paperwork. In the digital world, the equivalent of “possession” is access and control — determined by architecture (encryption, API keys, cloud infrastructure, deployment model) as much as by contract.
The commercial architecture and the technical architecture are inseparable. That is why custody, not just rights, needs to be at the centre of any data or AI deal.
The 2025 Act cracked open a third box for crypto because the custodial relationship didn’t fit the existing categories. Model weights are a different problem. They don’t need a new box. They sit in the oldest gap of all — the gap where no IP right exists, where bare facts live, where the only protection is keeping hold of the thing. The state could create a new right. It hasn’t. And until it does, the commercial architecture being built now — the custody arrangements, the API access terms, the deployment decisions being negotiated today — will be the architecture the law inherits when it finally arrives.
It usually is.
The Society for Computers and Law put out template clauses for contracting for AI in respect of the AI Act. It’s a 60 page pdf though, which needs a fair bit of scrolling around to read.
I took their clauses and put it on its own website, so it’s a little easier to filter, change the defined terms, select drafting options, and copy them to the clipboard.
Take a look - https://www.aicontract.ing
]]>The attention given to open data goes up and down – but very little of it is on the licence that makes the data ‘open’. The recent conversations about ‘open’ and ‘closed’ AI models is giving a little more attention to the licences those AI models are distributed under. It’s a good opportunity to talk about how we licence things to be ‘open’, or even ‘free’.
To understand things properly, we need to cover the history of two distinct concepts: free software, and IP rights. You can see the foreshadowing here: the fact that these have separate histories is what has created some of the today’s tensions.
There are various principles of freedom and openness in software that were created back in the 80s and 90s. The ‘Free Software Definition’ in 1986 set out four essential freedoms:
11 years later, the Debian Free Software Guidelines were published, setting out 9 guidelines💬PedantsYes, and an example to make ten. to determine if a software licence is free.
This list was used to create the ‘Open Source Definition’ (OSD) published by the ‘Open Source Initiative’ (but with technology neutrality added at the end).
Key here is that this was focussed on software, and that for software to truly be free, you needed to have access to the [human readable / editable] ‘source code’, not just the [machine-readable / not practically editable] ‘object code’ – along with rights to modify such code, etc.
Many licences were created on the back of these definitions, such as GPL, MIT, BSD, Apache 2, etc. and groups like the Open Source Initiative or SPDX keep lists of which licences they consider meet the ‘Open Source Definition’. These are the opinions of engineers and a few lawyers and academics – however there was very little litigation of these issues over the years to provide judicial clarity.
In the early 2000s, legal hero Lawrence Lessig brought forwards the case Eldred vs Ashcroft arguing that the repeated extension of copyright periods under US law did not meet the constitutional requirement that the period of copyright be for “limited Times”.
In the end, Eldred lost, and the copyrights were extended under the Sonny Bono Act, and it was only in 2024 (rather than 2004) that pre-1978 works became public domain. However, the case led to the establishment of ‘Creative Commons’ – a structure and licensing approach to allow people to licence their creative works (not just software) for public purposes (with the ‘some rights reserved’ tagline). There are many varieties of Creative Commons licence depending whether the works can be re-mixed, attribution is needed, etc. – but the idea is to give a ‘free’ licensing framework for creative works that are not software.
When you first encounter the phrase ‘free and open-source software‘ you might wonder if it means the union of the two categories (all free software, and all open-source software), or the intersection (all software which is both free and open-source). This is a good question if you are thinking of ‘free‘ as in ‘no-charge‘. However, as we can see above, the ‘free‘ is akin to freedom, and so ‘open-source‘ is necessary, but not sufficient, for ‘freedom‘. It is part of it, and so the intersection or union question is the wrong one.
Getting ahead of ourselves, the way people create and release AI models is complicating this. For example, the Open Source Initiative is proposing a definition of ‘Open Source AI‘, in which parts of the training material might be subject to a commercial licence.
For simplicity, let’s consider ‘intellectual property’ rights as a state-granted monopoly over [some activity] that relates to [some kind of idea]. The policy reason for this, at a very high level, is that the monopoly allows for creators to get revenue in respect of their idea for a period of time, which they would not be economically incentivised to do if copy-cats could also do the same. There are many nuances to this, of course – trade marks don’t expire, patents involve the trade-off that work-arounds are sort of encouraged (the patent brings the invention into the light, when it might have otherwise remained a trade secret), copyright is the expression of an idea, not the idea itself, etc, etc. – but the broad theme is right.
Copyright and patents are hundreds of years old (15th Century ish). Trade marks are very old (Roman times), but state monopolies over them came about in the 19th Century.
‘Data’ can be protected in different ways under different IP rights, but it wasn’t always so, and indeed isn’t always so today. Under English law, the Copyright, Designs and Patents Act 1988 didn’t contemplate databases until 1998 when we implemented the Database Directive. This allowed for copyright protection of a database (e.g. the new section 3A to the CDPA), and also a separate database right (directly in the Database Regulations).
There is a lot of caselaw here on what exactly is protected, and what constitutes an infringement. In broad strokes however a database gets:
copyright protection if the selection and arrangement of the data into the database was an original intellectual creation (it doesn’t matter what the data is – but how it was selected or arranged)
the database right if there has been a substantial investment in obtaining, verifying or presenting the contents of the database
The IP rights apply to the database – not the data. Each protection does (in a different way) restrict the use/extraction of data from the database, but the state granted monopoly is because of the database (very broadly interpreted).
If the database doesn’t meet the criteria for those IP rights, then there is no IP right in the data itself, and therefore no IP based restriction on someone copying, publishing, or commercialising the data or database.
The reason the law came at it this way, is the individual data items in a database are typically not the original expression of an idea (normal text copyright), a trading brand (trade mark) – and are typically bare facts about the world (e.g. the FA Cup final score, the Bank of England base rate, how much rain fell this summer, etc.) – which it is doesn’t meet any policy goals, and is not appropriate or enforceable, to restrict the use of.
Note however that this was all a creature of EU law, and these sorts of database rights are very much not the case in lots of other parts of the world – importantly including the US.
You can perhaps see where this is going: ‘openness’ isn’t typically needed over data or a database – as it is directly readable – you don’t need the ‘source code’ version in addition to the data/database.
‘Freedom’ isn’t needed over something that doesn’t have IP rights, as you don’t’ need a licence to use ideas that don’t have intellectual property protections (for example data in the US, or a very small portion that isn’t original of a work) – once you have a copy of it you can use it how you want💬WatchoutThere might however be some other non-IP based restrictions on using the data (trade secrets, confidentiality, or that you have agreed in a contract not to use the data in certain ways)..
The third piece of the puzzle after ‘openness’ and ‘freedom’, is ‘copyleft’ – the mechanic that makes ‘open source’ code ‘go viral’. The catch is that if you want to redistribute derivative works, you have to make them available under the very same licence (and typically include a notice). It’s not enough to just give the first recipient permission to use the works, the author wants to bind the first recipient to themselves use a similar process if they go on to distribute derivative works. Some popular free software licences are copyleft (e.g. the GPL) and some are not (e.g. MIT).
And this brings us to one of the key uncertainties surrounding ‘free licences’ – are they licences, or are they contracts?
There has been a conversation for many years as to whether free software licences (such as the GPL) are a copyright licence, or a contract. A licence is a permission to do a thing that would otherwise be unlawful (in this case, copy, distribute, etc. the works). A contract is a 2 way bargain to do/not do things, which can relate to works whether they have IP rights or not.
Many groups like FSF, have historically put forward the view the GPL was only a copyright licence. The idea in the GPL that the licence is conditional on complying with the licence requirements – if you don’t meet the conditions the licence doesn’t apply and you are in breach of copyright.💬UpdateExcitingly, Conservancy is now arguing in California court that its own guidance on this, and FSF’s was entirely wrong all along, you shouldn’t listen to engineers giving legal opinions - and these were contracts all along - link to the skeleton at bottom of article.
Alice and Bob might contract in respect of Alice sharing some information with Bob, where Bob agrees not to use it for a particular purpose – and that restriction would be enforceable whether or not the information benefits from IP rights. Contracts however have a few more formalities to them than licences however – such as ‘consideration’ meaning you have to give something up to enter into it, and also only relates to the parties in the contract – so Alice and Bob might have a contract, but Charlie isn’t bound by the contract it if they got hold of a copy through other means.
More modern open source licences state that they are both licences and contracts – attempting to handle this situation.
For example ,Creative Commons Attribution licence places an attribution obligation on recipients of the works. In version 3 they added a line that:
“to the extent this Public License may be interpreted as a contract, the Licensor grants You the Rights contained here in consideration of Your acceptance of these terms and conditions…”.
The Blue Oak licence states:
“In order to receive this license, you must agree to its rules. The rules of this license are both obligations under that agreement and conditions to your license. You must not do anything with this software that triggers a rule that you cannot or will not follow.”.
I am not aware of any English judgment setting out whether GPL (or any other ambiguous open source licence is a contract or a licence). The French case Entr’ouvert vs Orange set out the GPL as a contract (seemingly so plainly that it doesn’t get any analysis in the judgment, and it is just described throughout as a “contrat de licence”). GPL-violations.org has brought some actions in Germany, e.g. in 2004 a preliminary injunction was granted, including analysis that the GPL was incorporated into a German law contract (and the terms were not in breach of German Civil Code).
Chris Simkins gave me a fascinating backdrop to this – that philosophical differences between civil law and common law may have driven differences in the importance of consideration to form a contract. The idea is that common law systems are grounded on enforcing ‘promises’, which makes consideration critical (though recent English caselaw would seem to have deviated from this). We can contrast this with civil law systems where contracts take their authority more from the civil code, which allows more unilateral contracts without consideration💬See further reading for an academic article on this theme.
We now know there are 2 questions – is content under a licence open source, and is it free.
The ‘open source-ness’ is on a spectrum, and depends on your perspective. On the one hand, we have GenAIaaS offerings like OpenAI or Anthropic – very much not open source. At the other end, are people like the Open Language Model who make available the training data and the weights in the model – so with enough compute you could make some changes and create something a bit different💬Differently to fine-tuning. In between are ‘open-weight’ models where you can download the weights (and read them, and in theory check them and edit them), but not the materials used to create the model (e.g. Llama, Grok and Mistral).
If we consider the classic ‘source code’, ‘object code’ and ‘SaaS’ framework, it becomes clearer why people end up talking past each other when they talk about AI model licences. An AI model released for use without charge has some elements of being ‘source code’ (you can run it yourself, inspect it, run it on any infrastructure you want, create derivative works by fine-tuning it, etc.). It also has some elements of being ‘object code’ (it is the output of a previous process which the software user doesn’t have access to, or a copy of, and so you are limited in how you can modify and make derivative works).
From one perspective, these ‘open weight’ models are like ‘closed source’ software, where you can operate it, but can’t tinker with it. There’s no conclusive answer as to whether ‘open weight’ AI models count as ‘open source’ or not – views differ (e.g. the Open Source Initiative seem to be adopting a half way house approach in their Open Source AI definition). The most important thing is clarity, I think, more than one approach being better necessarily superior.
Similarly, how free the licences for GenAI models are also varies. Closed source models are not provided under free licences. Fully open source models tend to be provided under the Apache 2.0 free / open source licence. In the middle, it varies. Some, like Mistral and Grok are licensed under the Apache 2.0 licence. Llama 3 however, is not provided under a free licence- the licence has a volume cap of 700million monthly active users (admittedly that’s a lot), and you have to comply with the Meta AUP (that prohibits for example warfare, planning activities that risk harm to individuals, impersonating people, representing the outputs are human generated, etc.), and also applicable laws and regulations.
Meta and others are very careful about agreeing to their terms in order to download their ‘open’ models. As much GenAI training data is owned by third parties, and the GenAI model can output verbatim portions of that training material – the original data owner could well bring a claim against the model user, who would then in turn look to recover their losses from the model developer. Those terms are in place to place exclusions and limits on the model developer’s liability.
Lots of open source licences have provisions that don’t quite make sense for data. For example, LGPL 2.0 famously addresses dynamic linking of libraries. AGPL addresses the operation of the software over a network. GPL requires you to make the source code available if you convey the work (to a third party). These don’t really make sense in respect of data – sometimes this is harmless, sometimes it might undermine the contract more seriously.💬some actual law…Certainty is a necessary part of forming a contract, and a contract will be ‘vitiated’ if it doesn’t have ‘certainty’.
Chitty tells us ‘The court will make considerable efforts to give meaning to an apparently meaningless phrase’ and that if a meaningless clause ‘s simply verbiage, not intended to add anything to an otherwise complete agreement, or if it relates to a matter of relatively minor importance, it can be ignored. But if the parties intend it to govern some vital aspect of their relationship its vagueness will vitiate the entire agreement.’</span></span>
Aside from bad grammar and requirements that don’t make sense, at a more fundamental level, the main problem you might face is a licence stated as a licence only, and not also as a contract. In the absence of IP rights in the underlying content – you may struggle to enforce a bare licence against a user that declines to licence it from you, but still gets and uses a copy. Apache 2.0 does not say it is a contract – just a licence.💬But then again, it says that it comprises terms and conditions of use - so it might not have been given much thought when they wrote it in 2004
Because data: (a) doesn’t come in open and closed forms like software; and (b) doesn’t attract IP rights like software, it seemed to some that an update to the definitions of ‘open’ needed some adjustments to properly consider the openness of a data licence. The Open Knowledge Foundation felt this way, and created an ‘open’ definition to use in relation to data and content. This is a derivation of the FSD and DFSG principles set out above – but with lots of bells and whistles added.
The first is that there are a few non-licence based requirements (somewhat similar to the integrity and availability pillars in data protection), of access being given, and the data being machine readable and in an open format.
In terms of the licence, it starts with the use, redistribution and modification, like in the four essential freedoms and in the OSD. Later on, we have ‘propagation’, ‘no charge’, ‘non discrimination against persons’ and ‘application to any purpose’ much like in the OSD. The ‘separation’ and ‘compilation’ requirements are worth noting. Arguably ‘separation’ (the licence allowing any part of the work to be used and modified separately to the rest) is a subset of ‘modification’. ‘Compilation’ however (that the licensed work must be allowed to be distributed along with other distinct works without placing restrictions on those works) is quite anti-copyleft. Some GPL type licences are notorious for requiring linked works to be licensed under the same GPL licence.
In an exercise of pragmatism, the open definition then lists seven permitted derogations from those requirements (such as allowing a requirement to attribute certain people, or allowing a requirement to change the name). In the context of the ‘compilation’ requirement above, the derogation that mandatory copyleft provisions are permitted is interesting. An ‘open definition’ licence must allow distinct bundled works to be under any licence, but can require distributions of the work (and presumably, but it doesn’t say so, derivative works?) to be under the original licence.
Of course there are a number of free data licences out there. Most famous of these is Creative Commons Zero (CC0) ‘no rights reserved’ which first tries to waive all rights in the works, and as a fallback grants a licence to use the works in any way. In both cases, trade marks and patent rights are carved out.
The UK Government’s Open Government Licence (OGL) is another free licence one used by many UK government departments. The OGL does not mention ‘contract’ at all, and its name and webpage give the impression it is a licence. Some parts of the website do however refer to the licence as a set of ‘terms and conditions’ – implying perhaps it should be taken to be a contract. The OGL licences the use of copyright and database right material – so it doesn’t give any rights over content or data which does not attract those IP rights (none are generally needed – see above), nor does it grant licences to use any trade mark, patent, or any other IP rights – so you should still consider if you would need those. It seems that, if you didn’t want to agree to the OGL, you could do things with the relevant government data that don’t require a licence (e.g. fair dealing and fair use, like the OGL says, or insubstantial extraction from a database (which is not a restricted activity in respect of the database right).
For years, a key message in the open-source movement is that it’s mainly about ‘free as in freedom’ 💬not just as in beer, not just about software being ‘open’. The increased importance of data, and the huge commercial uses that GenAI is unlocking, have placed a new emphasis on things – the ‘openness’ of the data is taking a back seat, with the freedom to use it getting a closer look. About time.
Kyle Mitchell’s writing helped me get my thinking straight on some of this, and also really useful on the latest developments.
Chris Simkins – who contributed, in particular on common law vs civil law history, and the contrast of a promises grounded common law system versus a legislation grounded civil code system.
I want to try to provide a breakdown of where I see the analogy as being helpful, and where it risks misdirecting us.
I have to admit an irritated feeling now when I hear the phrase. The speaker could just say “data is really important“, if that was their message, or they could set out why they think data has similar properties to oil if that was relevant – but they typically don’t. Toxic oil and intangible data of course feel so different, which is what has made the saying catch on. However it is often left as an exercise to the audience to figure out why data and oil are in fact comparable – which makes it not much of a teaching tool, or explanation of things 💬the real message in many cases is ‘I am the sort of person that has profound insights about the world in a cross-domain, cross-era manners’ not as an insight in itself.
I think the straightforward meaning of the analogy is to say that, like oil, data is:
Let’s define 💬not aiming for dictionary definitions - just to give a framework a few terms:
This gives another insight in line with the analogy: oil is superior to coal partly because of its higher energy density (about double). Data is a valuable manifestation of information because it is a high density version of it.
With this framework, we can start applying different verbs or qualifiers to these concepts.
Having more copies of data does not mean there is more data (or information, or rights in the data). Having more data, equally, does not necessarily mean there is any more information (in fact it might mean the real information is harder to find, and so the data less valuable). Generally though, when business people say refer to ‘more’ data it implies they have more information, which therefore carries more value. To the technologist however, ‘more data = more value’ is a much more qualified statement than, for example, saying ‘more oil = more value’.
Transforming information to data, and data to derived data is fundamental to its use, value and life-cycle. Choices about what sort of sensor can receive information, how to capture it, filter it, encode it, and what format to structure the resultant data in require judgment and skill. The requirement of human effort, skill, or originality is part of the policy justification and trade-off for the state granting a monopoly over the output (ie. IP rights in the data).
For example copyright in a database arises from the original selection or arrangement of data in a database that uses judgment, taste or discretion. This originality needs to relate to the structure of the database itself, not the data within it 💬Notebut note the protection applies to the data and the database. A separate ‘database right’ exists from obtaining (from a third party source), verifying or presenting the data in a database.
We can also see that one can have custody of a data copy (and can own the medium it is on), and separately, there might be a variety of people with different rights in the data (Party A might own the hard drive, Party B the copyright, Party C the database right, Party D the data controller, Party E be a data subject, etc.). Each of these parties would have physical or legal methods to control the use of the data, and contracts with each other.
One might think that rights in the data and the medium the data is stored on, are independent of each other (see, for example the English law example that a lien is over a chose in possession, not a chose in action like a database). This is not always the case however, For example:
To use or distribute data you need a copy of it, and should have the necessary rights (to the extent they exist) in the data. For many commercial purposes, the data might be viewed as being the ‘rights in the data’ – because the data can’t shouldn’t be used or exploited in excess of those rights.
These rights in data are not legal technicalities – they are made in, and only exist in the legal system
These rights in data are not legal technicalities – they are made in, and only exist in the legal system. The legal permissions and restrictions that apply to them define them, and their lifecycle, entirely. Sometimes you hear of people tempted to discount rights in data as being of less importance because they are intangible. I would remind them that the data itself is also intangible💬as are the concepts of companies, contracts, laws, governments, countries, etc..
Analogies simplify and abstract – this can help with initial understanding, but of course they have limits, beyond which they are counterproductive. Analogies taken beyond their useful limits can prime us to use a wrong mental framework. And analogies between distant things (like data and oil) can prime us to use a very wrong framework. This is quite important, especially when the analogy is meant to be an aid to new people to the space.
Oil is a commodity which is largely fungible. A barrel of oil of a certain grade is just that – you can figure out what it is worth based on a price index, and you would be just as happy with the next one, as this one.
The whole point of data is that it is not fungible. A copy of data is (for most purposes) fungible with other copies. But the underlying information is not fungible for other information (and if it were, it would be the same thing). As data is not a commodity, it has to be consumed and used to understand its quality.
The whole point of data is that it is not fungible.
Property rights in oil and data arise differently. Property rights are inherently part of tangible objects (‘chose in possession’ to use the fancy term). Within a legal system, property rights will subsist in a gallon of oil just by it existing – without it being interacted with in any way. The property rights in data arise when a human does something to information or data, and the rights subsist in the newly created data. The rights reflect the outcome of an activity, and in a sense are a creature of, and reflection of, human dynamism and creativity.
When choosing to compare something to oil, one might be referencing oil’s role in the Industrial Era, it being an oligopolistic good, and a component of the comparative wealth of nations. Here, again, I think the analogy with data falls down. For oil, the default position is a state monopoly. For data rights, the default position is fragmented, with the initial owner being the person who did the activity. In large part, the data custody and rights accrue to the companies that create the data. Of course, we then see centralisation with data hoarders, wholesalers, etc. but that is downstream of fragmented creation.
The more that oil gets handled (on the whole, with important exceptions) the more the ownership becomes distributed. The more that data gets processed (on the whole, with important exceptions), the more the ownership becomes concentrated.
The classic ‘alternative’ analogy (which I have used in the past) is ‘data is like sunlight‘. it offers a few different comparisons to the oil analogy. Data and sunlight each:
I admit it does have a few of the ‘data is the new oil’ flaws that I point out above, but at least it is less of a trope.
We are now post-analogy on data
My advice is that we are now ‘post-analogy’ on data: no ‘data is like…‘ quip is needed. Data can be talked about in its own terms – plainly stating its properties. If a poetic attention-grabber is needed then go for it – but for teaching and analysis, it’s time for straight talking.
We were asked to write the ‘computing and cloud computing’ chapter of an upcoming OUP book on FinTech law, and I was asked to write the ‘history of computing’ section (with a 2,000 word limit!).
Here’s what I put together, not perfect, but I hope helps someone orientate themselves.
The modern information age began on 15 November 1971 with the announcement by Intel of the ‘4004’ general purpose microprocessor, under the helm of Andy Grove. Seven years earlier, another Intel founder, Gordon Moore, put forth a ‘law’ that the density of transistors on an integrated circuit doubles every year. This timeframe was later amended to every two years.
There are three remarkable features of Moore’s Law. The first is that it has held true for 50 years, from 2300 transistors on the ‘4004’ in 1971 through to 50 million or so in a modern CPU. The second is that the rate of increase is logarithmic, increasing at an ever-growing compounding rate. The third is that it is not at all a ‘law’ – there is nothing written in the stars that processing technology must progress at this rate. Moore’s ‘Law’ is a prediction and a target, the culmination of marginal gains of human ingenuity and insight arising from the dogged pursuit of advancing calculation power; a testament to human determination and target fixation, which has brought humanity millions-fold improvements in computational power.
Moore’s ‘Law’ is a prediction and a target, the culmination of marginal gains of human ingenuity and insight arising from the dogged pursuit of advancing calculation power; a testament to human determination and target fixation, which has brought humanity millions-fold improvements in computational power.
The rest of this section will address what humans have done with this dividend of processing power. There are three main themes, two technological and one a business model. The first theme encompasses technologies that allow the aggregation of processing between different locations – be it network connectivity, the internet, multi-core computing, or parallel processing. These are all ways for groups of processors to compute more than they could individually. The second theme is increasing levels of abstraction: more and more levels of software and framework, taking the user and developer further and further from the transistors and memory blocks, allowing them to stand on the shoulders of giants, and achieve more with less. These advancements include operating systems (in particular Linux), programming languages, database products, APIs and open source software. The third theme comprises the business model of renting computing power only when it is needed (‘cloud computing’) and the swift expansion of that service from pure processing-as-a-service into everything-as-a-service – with all the technology advancements set out above available on a ‘pay-per-second’ basis with no set up costs, and fees accruing only when you are using it.
In general, two simultaneous changes followed from the increased processing power: putting more transistors into the same large data centres; or putting the transistors into smaller and more portable packages.
Initially computers had a large capital cost, required specialist skills to operate, and had limited availability. They were only available in elite environments such as universities and research labs, and access was time-allocated – people would prepare their punch cards of processing instructions in advance and load them into the computer during their pre-booked slot.
This ‘mainframe’ era of computing saw enormous advances and improvements in processing power, complexity, availability, and stability, yet the ‘mainframe’ remained a destination – a place where humans brought themselves to the computer to do computing tasks. Computing was not available where consumers were, largely because useful computers were too large to be in the home.
The next era of modern computing was the ‘desktop’ era. This saw the cost, size, stability, and user interfaces of computers improve sufficiently, along with the standardisation of components, to put ‘a computer in every home’. Computing became available to business executives, researchers, affluent (and then almost all) western families, parents and children. Computers were used as tools and toys, mostly by individual users, but sometimes for small groups in one location. Computing was now available where consumers were located, but for most of this era there were not adequate network communications to allow regular and abundant interactions between computers.
The ‘mobile’ computing era’s totemic launch came with Steve Jobs’ iPhone announcement in January 2007. Jobs announced the bringing together into one package of the iPod, a cellular phone, and a computer, along with a full phone touchscreen. Each of these became hallmarks of the ‘mobile’ era of computing. This era saw the promise of a computer in everyone’s pocket achieved. The combination of the screen and input methods enabled the screen to be both the input and the display method, allowing it to mimic endless tools, games, websites and widgets. The more powerful development, however, was the subsequent release of an ‘App Store’ of sandboxed apps, allowing the low development cost, fast distribution, in-built charging model, and therefore the mass proliferation, of mobile apps.
‘Mainframe, desktop, mobile’ is the typical formulation of computing eras in the modern information age and must be understood. It is all focussed on where the computing takes place however.
Another model is to consider the changes in when computing was done through these various stages. In the mainframe era, people performed ‘batch’ computing – preparing their materials, performing their computing, and then returning to their places of work. In the desktop era, people performed deliberate computing – they sat down at their computer to do computing tasks (which of course still happens today). In the mobile era, the real advancement provided by the ‘app’ model was not the flexible location of computing, but that networks were fast and reliable enough, that ‘mainframes’ (now data centres and cloud services, more on this below) were cheap and available enough, and software stacks commoditised enough. Computing became continuous: a continuous stream of on-desktop and mobile inputs (with those edges to the network doing lightweight computing), working together with mainframe-based power-computing which interacts with other users, computers or systems, with the whole arrangement creating an indistinguishable stream of computing activity, whether the user is engaged with an interface or not.
While the desktop-to-mobile transition does not, in itself, need more than ‘just’ smaller processors, touchscreens, batteries and a suitable OS, the transition from deliberate to continuous computing has additional pre-requisites.
Continuous computing means the processing is split between various processing environments, running on various operating systems. This means that rapid data networks, secure communications, identification systems, and trusted computing environments are also needed. These are all complex problems, each with their own industry histories. By the time of widespread mobile computing, these elements however were all either priced as a commodity (e.g. network connectivity), or carried no or minimal direct cost (e.g. public key encryption available through open source software, or access to the iOS App Store for hundreds of dollars).
Another requirement is a central processing computer – a mainframe – which traditionally carried a large upfront cost of buying and operating a mainframe to run the background processing operations. Data centres began a business model innovation of renting computing power on demand, which had the effect of decoupling the large capital costs of owning a mainframe (hardware purchase and replacement, rent, physical security, power, telecoms, cooling, etc.), from the ability to use and access a mainframe. By providing computer power in a scalable manner, without up-front costs (infrastructure-as-a-service, “IaaS”), mainframe suppliers managed in a few short years to abstract an entire industry into a set of APIs and commoditised functions, giving birth to ‘the cloud’.
Further investment and development of this service allowed for other mainframe upfront costs to be avoided: setting up, maintaining, and supporting the operating systems; and ‘basic hygiene’ of a modern computing environment – allowing work on differentiating products and features to begin much earlier. These were the core developments that allowed for the operation of financial services in a ‘cloud’ environment.
Since those building blocks for financial services computing in the cloud environment were put in place (2006 – 2008), most of the changes have been incremental, but compounding. More and more computing operations, operating systems, software suites, databases, and cutting edge analysing and processing such as AI, are available ‘as-a-service’ in what is now sometimes dubbed ‘everything-as-a-service’ – meaning developers can work at higher and higher levels of abstraction away from the core infrastructure – doing more with less, and commoditising parts of software development and software operations.
The increased importance of cloud computing has placed greater focus on security and resilience against downtime, data loss, data manipulation, data leakage, errors, privilege escalations, etc. – leading to increased security processes in cloud environments, simpler arrangements to implement those processes, and automated monitoring, such as intrusion detection. As desktops, laptops, tablets and phones became more powerful, that local processing power was increasingly used to deliver rich user experiences, and in-built hardware security features (such as fingerprint and face scanning) were deployed to help authenticate users and securely communicate that authentication to the data centre. These are all iterative in core technology terms (as compared to the pre-requisites set out above) – but they were necessary steps for the affordable, mass-market deployment of many of the products and services we associate with ‘cloud-based financial services’.
The range and complexity of software services available via the cloud will continue to grow, as the main suppliers compete. For the purposes of ‘FinTech in the cloud’ we are likely to see iterative and incremental steps to improve the service.
There are two main disruptive threats to this cloud computing model. The first is truly distributed processing, in which financial services are established that don’t use a centralised organisation, and the need to operate in a transparent way that removes all and any authority to change the software code, or how it is run. This requires a different type of computing environment, a problem solved today by having redundant duplicative computing and verification take place, with a consensus established as to the correct answer (e.g. via Ethereum) – but perhaps with other solutions in the future. It is, however, hard to see how a centralised cloud offering, as we currently understand it, could perform the role of a decentralised computing network in this way.
The second disruptive force is quantum computing which, if established, would offer a very significant increase in processing power, far beyond the pace of Moore’s Law. This would have the possibility of providing an abundance of processing power which unlocks categorical changes in how cloud computing is priced or what it can be used for, but would take time to develop, productise, and turn into a commoditised cloud-based offering, and for developer users to understand and build on the new algorithm types and capabilities.
Computing over the last 50 years has become faster and smaller, but also cheaper and more commoditised. A mesh of technologies has changed the experience of computing from a serious academic pursuit, to the background vibrations of a busy life. The builders of these technologies have become the largest and most powerful companies in the world, yet even their growth is eclipsed by the advances in the technology itself. The culmination of the emergence of a common platform and set of standards is that it allows software, businesses, banks, messaging platforms, payment systems, and more to be deployed globally, instantly, securely, on entirely rented computing power.
]]>This list will always be incomplete, but it’s very incomplete for the time being. My aim is to expand this out into a general reading list in time.
I think some context is needed though before we get to ‘how’ part of this:
I’m mainly writing this for a younger version of myself. Hopefully helping some people leap some of their career, hopefully emboldening some people, and hopefully surfacing some information that isn’t normally written down publicly.
This is an unnecessarily contentious question that people waste a lot of time on Twitter and conference stages defining.
Some people define legal tech so narrowly that it almost doesn’t exist (ie. technology that only solves legal user stories, and so if the technology is also useful outside of the ‘legal domain’ it is not legal tech). I don’t see the point of this definition, unless the point is that any given technology is normally useful across industries. It’s also tempting to take the opposite approach – to point to the long and rich history of lawyers embracing and using technology, and call any use of technology by lawyers legal tech – including sending emails, or typing a letter in MS Word. I think this definition is more helpful because it is a something, not a nothing.
If we go further, I think we can identify the ‘something’ at the core of that definition which gives us a useful platform to use for the rest of this essay. I might later write more on this, as it could be an essay in itself.
Stealing a line from someone that won’t mind me taking it: ‘tech’ is anything that removes the need for humans or makes things faster, cheaper, more secure or powerful. To me you’re doing legal tech anytime you’re working on a legal problem and make or use some tech which wasn’t in your or your peers’ baseline method for working on the problem. Note that this is a relative definition, and it keeps moving. Efficient methods that become the way that everyone does it, stop becoming legal tech at some point.
So, using the telephone, or email, or a word processor: no longer legal tech. Automated drafting, ML based meaning extraction, scripted approval and signature flow systems, ‘no-code’ deal flow platforms: all definitely legal tech. e-billing of legal matters, automated client on-boarding and KYC, matter management systems: also legal tech.
So this is a broad definition, but it doesn’t cover everything. For me, to be legal tech there still has to be a way that reasonable competent people would still attempt to do the task without the legal tech tool. Once that method is pervasive, it’s not legal tech any more – it’s just the way.
This is a hugely important aspect, don’t just skip to the how.
You only get one life, and it should be fulfilling. There is a tension here between following your passions, and following your competencies. Common advice is to ‘follow your passion’. On the whole this is poor advice, and you are better served becoming excellent at stuff, and you’ll then become passionate about being a leader in your field (ie. commanding top pay, having agency and autonomy as to how you work, being respected by your peers and clients, understand the methods well enough to be creative and groundbreaking, etc.) These are more rewarding, on the whole, than a middling position in the field that you are, or had, a passion for. The passion grows anyway (see here for more on this).
I’ll still answer the ‘why legal tech?’ question for completeness, but it comes with the heavy caveat above.
To me, working in legal tech raises the stakes from providing classic legal services. It’s legal services with added leverage. There is more upfront cost, compared to the late-majority / post-chasm way of solving the same problem, but also more potential upside. You get it wrong, you get no customers – sure, you learned some lessons, but you lost money. You get it right, there is far more opportunity to delight clients, earn revenue, sweep the market, make a name for yourself, etc. Getting it right is value creating (not zero-sum), meaning you can both deliver more value to users & clients, and capture more value for yourself. Higher variance, higher risk, but more reward if it goes right.
I get an intrinsic, pleasure out of solving a problem through a new process, that is efficient or elegant. I am in flow when working on these sorts of problems, and time disappears, I think in ways I can’t properly recall or describe, etc. This led to me spending quite a bit of time as a kid hacking around music, file sharing, Photoshop, Dreamweaver, remote controls, modems, PC parts, etc. etc. I built up competencies in being a heavy user, and also a lightweight builder, of tech stuff.
I also get an extrinsic pleasure from showing this stuff to people – seeing delight on people’s faces from surprisingly good solutions, being regarded as having a good shot at doing things that other people can’t: taking the problem from 0 to 1, getting a 10x solution, etc. These are vain thoughts, maybe not even healthy thoughts, and I probably have a bias around how often this happens – but I can’t deny the thoughts exist and that they are motivating.
So, I want to maximise impact, get an intrinsic kick out of elegant system based solutions, and am a junkie for adoration: that explains why to do tech, but not legal tech.
The honest answer is I got into legal tech because I got into law first. I went to law school, became a solicitor, and built up those skills and expertise. I then had a chance to differentiate by creating new tech based things within that context. This highlights the importance of skill-stacking. I am a good lawyer. I am a moderately good tech user / hacker. I am in no way a proper coder. I however have a differentiated skillset at that combination of skills (I’ll tackle the old ‘should lawyers code?’ another day). Each of those areas are well-established markets in which it takes years of work, and lots of talent, to stand out. In combination however, you’re competing with far fewer people, but also established methods in one field can be novel and exciting, or be even more effective, in another field. ‘Stacking’ skills, and then using the combination of them to exceed the greats (in utility and in fame) in any one of those areas alone, is an established method (see Range for example).
There are a few specific advantages to the ‘[industry] + tech’ 💬CheatNote, this is cheating because tech is not an industry (for these purposes), it’s more of a method. skill pair: for example, if you have an idea or a hunch, and you are able to yourself go and build a proof of concept, then you don’t need permission, you can decide to break a few rules doing to see if it would work, and the thing you build is probably far better at communicating the idea, than just the description is.
So, my path here happened in part because, from legal, ‘tech’ was a differentiator (even in a technology law practice).
There is an interesting side thought here – what level of intrinsic interest in law is necessary for it to be worth going into legal tech or, even law? You might read what I wrote above, and think the law part is entirely arbitrary – it could be accounting, or surfing, or anything else in there. That’s not quite right. Looping back to the ‘don’t just follow your passion’ bit above: I had an interest, and good indicators I could be good, in law – then made a somewhat arbitrary choice to go into that industry, and then became more interested in legal issues and legal business issues – so that when I started applying a ‘tech’ lens to those legal issues, I care enough about them intrinsically, and understand them enough through experience, to find the work motivating, and to avoid pitfalls. I say this because of one of Justin Kan’s post-mortem reflections on Atrium was about not going into an industry you don’t really care about. His strong tech competencies could not just be turned to the legal industry (which he had not worked in before), and give him intrinsic motivation. This made life hard when success was not coming quickly for Atrium, and so the extrinsic motivation was not forthcoming. I would also suggest, based on his other observations, that more experience in the industry profession 💬I’m teasing 😉 , before he started, would have helped.
This is now getting to the idea that got me thinking about this post.
First, note the breadth of the definition of legal tech above. I have not cheated and defined it broad, so that I have a long list here. I suspect all the people in the list below would say they ‘do’ legal tech (or at least, they’re doing legal tech, when doing these things).
I think all of these personas are doing legal tech:
A portion of these are outside the control of just one person (they require budget for example), but quite a few don’t. A portion of these require full time focus, but quite a few don’t. A portion of these require ‘hard’ technical skills, but quite a few don’t and are surprisingly accessible.
Some of these look a lot like just ‘running a business’. If you’re a senior partner in a law firm, you may well be involved in major legal tech initiatives as a stakeholder or for budget approval. This may well be even if you did not operationally ever become involved in such things – still, if you’re buying that stuff, making the final decision on vendors, on project go/no-go, on approval gates, or risk appetite – in my book, you’re also doing legal tech.
Some of these are only legal tech because they happened to be doing law. If you were doing the same of these tasks in another context, it might be called [something else] tech. I don’t think this is problematic however – the skills might have general application, but when you’re doing it in the legal sector, it’s fair to call it legal tech.
I hope the above list of examples of legal tech activities helps to frame this – you can start doing legal tech from most places, I think. This can be broken down into: (a) activities you can do; and (b) decisions you can make.
In a small, non-tech-driven practice, there are opportunities: the marginal difference of small efforts can be higher. Widespread adoption of inefficient processes means ‘simple’ adjustments can reap large returns. Look at what is inefficient, frustrating, repetitive, expensive, or unsatisfying – in your practice, and imagine it being better. Two main ways to go from there:
(1) Without breaking things, with sensitivity to regulatory duties, using dummy data, have a go at fixing it. Get a book on python, learn AutoIT, learn visual basic, learn PowerAutomate, and see if you can make a demo of a better way of doing it. Find an ally to talk to, show them what you’ve done, get their thoughts, and think about who to show it next to.
(2) Read voraciously, attend conferences (online and physical) and seek to understand what commercial products could help. Scout out the market, see if you can get free demos, try them with dummy data, and understand the costs, and work on the business model / RoI model for adoption.
In both cases, keep working on it iteratively, hone that idea, address the key objections, and work towards showing the leadership what you’ve done, how it is better, how the risks are mitigated, and your clear ask for what you want next (budget, time, access to clients, intro to someone, etc.)
In a mid-size and up, more tech-enabled practice – firstly everything set out above can still be done. Secondly – there is probably some more sophisticated tech and software available to you. It almost certainly does more than you are using it for. Learn all of it. The vendor will have manuals, there will be training, they will probably be happy to come in and give extra training, they may well be happy to share their roadmap, or meet to discuss feature requests. Find those opportunities / vendors / problems, turn up, put in the work, and interesting opportunities will follow. Learning how to be the best person in the practice at using some particular software will make you the person people talk to about this stuff: asked to help on the pitch, or if there is another way, or why it doesn’t work. Contribute value, be useful, learn more skills, and a positive feedback cycle will form.
There have always been lots of choices in legal services about who to work for – the market is highly fragmented (and I haven’t looked into it, but I think it has been highly fragmented for a long time in the UK). There is now however also a lot of choice of structure in which you work to do legal tech (LLPs of all sizes, ABS (inc. limited co’s), publicly traded law firms, Big4, start-ups of all sorts, huge tech company…)(e.g. see here, in relation to just one region).
If you look at the list of ‘people doing legal tech‘ above – have a think about which of those you think you would be good at, and map it up against the business structures where their business model involves training and investing in you in these areas (and where solid work would add the most value), and also against particular businesses with synergies to your skills / ambitions, and which are performing well – particularly look at investments in (read the industry press, look at, or set alerts on, Crunchbase). Then simply find a way to work in those places 💬…I’m being deliberately facetious here, this is of course hard - and ‘head-hunting yourself’ deserves a whole post in itself.
You’ll notice a portion of what I put down as people doing legal tech are in senior or stakeholder positions. I think there is a useful observation there – that promotion in an organisation will tend widen the scope of what you’re asked to manage, and it will increasingly include software decisions. So, another ‘way’ to do legal tech becomes – “be involved in strategy” in a legal organisation – and this then will include (now, and increasingly in the future) being involved in the use of tech & software in that strategy. This is not very actionable advice at the start of your career, but I think a neglected observation for people asking this question mid-career.
I hope you’ve found some original and helpful ideas in here. Lots of people seem to define things in a way that makes themselves rare, special or elite. I think high agency people however can actually do legal tech from lots more environments than classic thinking says – and people can make much more difference in the ‘staid, conservative, profession of law’ 💬yawn on this pov, btw than people (particularly young people) think.
]]>Update (August 2026): my answer has changed enough to deserve a full rewrite — see How do you stay up to date? (2026). This post stays up as the original.
One of my favourite interview questions is to ask people how they stay up to date. I have never heard what I consider a good answer. Smart, successful, well educated, people – but it seems they have a poor information diet.
I am setting out my approach this to try to help people improve here – and open myself up to to feedback.
In my view, the best, most concise, most consistently high quality information I read is from newsletters, not newspapers. Analysts make a name for themselves and trade on their brand. Yes, you have to pay for this for the full content. As I’ve got older, I’ve become happier paying directly for good content. I appreciate this is a luxury, but it is also an investment. Most of these also have free content too.
Matt Levine Money Stuff
Same benefits as newsletters – just delivered in a different format (and generally free). More and more newsletters and blogs are the same thing delivered in both ways, of course. For example:
Just for information gathering, probably better than newsletters, but you need to put a lot more in, to get anything good out: curating your feed, deciding how much to weight each source, and the incessant nature of the feed meaning it’s not a good way to try to get an overview of things. It is outstanding at throwing lots of ideas into the mix, for you to assess and contemplate, and come to new views. Some of the greatest minds in every field, put their thoughts out for free on Twitter.
Great resource – super high quality information – surfaces lots of information to then go and read into in more detail.
a16z
Unchained
What Bitcoin Did
Again, very underrated, and I think a part of a solid and respectable answer. For example HackerNews or Slashdot for tech, or a well curated list of subreddits (for any topic) might be some of the best ways to stay up to date and have a diverse set of new sources pushed to you, with (sometimes) high quality discussion surrounding it.
Another great resource – the exact resources will depend on your industry. For example:
These can be very good. The legal ones which I have access to can be a little dry (and very broad) – and so I don’t always believe people when they say they read it a lot. Still, the right sources here, read diligently would be a solid base for legal areas – but you would have to factor in the lag time between new events and these sources having proper write-ups of things. Examples in law:
I generally consider this to be a weak answer. Fine for entertainment or general social matters, but to really be up to date in your professional area, I generally find them them (on the whole) too vague, too broad and too superficial. FT is nearly the exception here, which I read a lot, and do pick up some good info, but it’s mostly for entertainment.
Yes, these can be very good. But everyone gets them. They is a lot of delay often between an event to the session. It doesn’t show much hunger or proactiveness, and is not enough. Someone needs to run those sessions, and they need to stay up to date – where does that person get their info from?
In my view, these sit somewhere between newspapers and industry specialist sources for usefulness. They are likely to have more detail than the newspapers, but the breadth of topics each magazine needs to cover means that minor but still important topics will slip through, and there will not be enough nuance or opinions on the critical topics. In an interview, I don’t see this as a very impressive answer – not bad, but not great.
Books are great. An important part of the information diet. For ‘staying up to date’ purposes, the delay in books coming out should be balanced by also reading fast information sources – but that helps to create a rounded range of sources and information types.
]]>