Adobe told the public it does not mine content from the web to train Adobe Firefly. That sentence sat on a marketing page, written to sound responsible.
A shareholder lawsuit filed against Adobe's named directors in April 2026 quotes that exact sentence back at the board. Not as praise. As evidence.
The complaint traces Firefly's training data through a small model called SlimLM, back through a dataset called SlimPajama, back through RedPajama, to a dataset called Books3, removed in 2023 for reported copyright infringement. It sets that chain next to Adobe's own proxy statement claiming Firefly trained only on "licensed and public domain content." Two statements. One chain of data. The lawsuit doesn't need a court to rule on the underlying infringement. It needs the gap between what Adobe said and what Adobe did.
This Is Not About Whether The Infringement Happened
Three of these lawsuits landed in 2026. Adobe in April. Microsoft in June. Nvidia in July. All three name individual directors and officers personally, not just the company. All three share the same structure, and it's worth naming precisely, because it inverts something most boards still believe.
None of the three complaints requires the plaintiff to prove the underlying copyright infringement actually occurred. That's not a technicality. It's the entire design. A derivative fiduciary duty claim only has to show the board knew about a risk and failed to act on it. And the fastest way to show a board knew is to find what the company told the public, then show the board kept operating as if that statement weren't true.
Microsoft's proxy statements told shareholders the board "maintains direct oversight over AI strategy risk." The lawsuit against Microsoft's directors doesn't dispute that sentence. It uses it. The complaint argues the board had exactly the oversight it claimed, kept approving the same practices after a federal court had already drawn a clear line between lawfully acquired training data and pirated data, and recommended shareholders vote against a proposal that would have added accountability for AI data sourcing. The company's own words about its own diligence became the yardstick the board is accused of failing to meet.
Nvidia's version is more direct still. When an employee asked, in an internal Slack message now quoted in a federal complaint, whether the company had legal approval for a video dataset, a research leader replied: "This is an executive decision. We have umbrella approval of all the data." Nvidia's own Code of Business Conduct instructs personnel not to use company resources to acquire or store improperly licensed copyrighted material. The Slack message and the Code now sit next to each other in a court filing, and the company wrote both of them.
Why Specific Claims Are More Dangerous Than Vague Ones
Here's the part that should change how every board thinks about its next public statement on AI. A vague commitment is hard to weaponize because it never creates a clear standard to fall short of. A specific, confident claim does the opposite. "We do not mine content from the web" is precise, checkable, and quotable. It reads well in a press release for exactly the same reason it reads devastatingly in a complaint: it gives a plaintiff a clean, exact sentence to hold up against whatever the company actually did.
This is why all three complaints follow the same pattern the Ropes & Gray attorneys who wrote up these cases named directly. The plaintiffs did not need to construct a standard of care from scratch. The company had already written one, publicly, in its own words, and the complaint's entire job became showing the gap between that sentence and reality.
Adobe's stock fell from $354.66 to $264.67 across the filing of the related copyright class actions. Its CEO, Shantanu Narayen, resigned on March 12, 2026. Whatever the eventual outcome of the derivative suit, the sequence itself is the lesson: the statement written to sound responsible became the reason the fall had a name attached to it.
What This Means For The Next Press Release
The instinct inside most companies is to say more about responsible AI, not less, because saying more sounds like leadership. These three cases argue the opposite discipline. Every specific, confident public claim about how a company sources or governs its AI is a sentence a future plaintiff can quote back verbatim, and the more precise the claim, the sharper that quote becomes.
This doesn't mean silence. It means reconciliation before publication: before any AI-related claim goes into a proxy statement, a marketing page, or a code of conduct, someone needs to confirm the claim actually matches current practice, not aspirational practice, not practice as it existed six months ago before a vendor relationship changed. A company that says less but means all of it is harder to sue than a company that says more and hopes nobody checks.
The boards that get this right won't be the ones with the most polished responsible-AI language. They'll be the ones whose public statements and internal Slack messages could sit next to each other in a courtroom without anyone flinching.
The Ropes & Gray attorneys who documented these cases flagged where the next wave is likely headed, and it's worth boards hearing this before it arrives rather than after. Agentic AI systems, ones that take actions on a company's own data with minimal human review, create a version of this exposure that doesn't even require a marketing claim to trigger it. An agent holds credentials the way an employee does. When agents coordinate with each other over machine-to-machine exchanges that never get logged, a company may not be able to reconstruct its own chain of decisions if a regulator or a plaintiff ever asks for one. The same goes for retrieval-augmented systems that pull outside material into a live query every time they run, creating a fresh copyright question with each use rather than a single training-time decision a lawyer can review once and sign off on.
None of this is abstract risk-modeling. It is the same mechanism already proven in the Adobe, Microsoft, and Nvidia complaints, extended to territory most boards have not yet been asked to govern. A code of conduct written for training data does not automatically cover an agent's access to a customer database, and a proxy statement about oversight of "AI strategy" does not automatically cover a system making thousands of small autonomous decisions a day with no single approval a director ever signed.
References
Michener, William, David M. McIntosh, Joshua Talicska, and Toby Shao. "AI in the Boardroom, Shareholders in the Courtroom: When AI Strategy Becomes Fiduciary Risk." Ropes & Gray LLP, ropesgray.com, September 14, 2026.
SEIU Pension Plan Master Trust v. Narayen, No. 3:26-cv-03521 (N.D. Cal. filed Apr. 24, 2026).
Anderson v. Nadella, No. 2:26-cv-02281 (W.D. Wash. filed June 30, 2026).
Berliner v. Huang, No. 1:26-cv-09153 (N.D. Ill. filed July 31, 2026).
