Ethics, copyright & policy

The most useful way to organize everything in this module, and much of the rest of the curriculum, is around the framework the American Library Association built for exactly this purpose. ALA's Guidance on the Use of Artificial Intelligence in Libraries grounds every recommendation in six core library values. Holding those six in mind gives a librarian a durable structure for reasoning about any AI decision, long after the specific tools discussed here have been replaced. The six values are Public Good; Intellectual Freedom; Privacy; Sustainability; Diversity, Equity, Inclusion, and Access (DEIA); and Labor. For example, when a vendor offers a new AI discovery feature, the six values generate the questions worth asking almost automatically. Does it serve a documented public-service purpose? Does it preserve transparent and non-personalized paths to information? Does it protect patron privacy? What is its environmental cost? Does it widen or narrow equitable access? What does it mean for the people who do the work? The framework does not make the decision, but it ensures the decision is measured against the profession's stated commitments rather than vendor enthusiasm alone.

The principle from this guidance that most directly governs day-to-day practice is its treatment of AI output. ALA states that libraries should treat AI outputs as "drafts requiring human review, not authoritative answers," and that "human expertise remains necessary for nuance, originality, contextual judgment, accountability, and trust." This is the sentence to internalize before any other in this module. It settles in advance the question that causes the most professional trouble: what standing does an AI response have? The answer is that it has the standing of a draft. For example, a chatbot's answer to a reference question, a tool's summary of an article, and a model's suggested subject headings are all starting points. A librarian composes with them and verifies them; they are never finished products to forward. This stance is not skepticism for its own sake. It recognizes that accountability for anything the library provides rests with a human professional. The ARL formulation "No Human, No AI," discussed later in this module, expresses the same principle from a different angle.

These values also carry a commitment that librarians sometimes find surprising: adopting AI is not always the right choice. The guidance is explicit that libraries should use AI only where it serves "clear user-centered purposes," not simply because a tool is available, and that patrons must always retain "a clear path to human assistance." For example, a library that keeps a non-AI, human-staffed route to every service it offers is not failing to modernize. It is honoring the Public Good and Labor values that the guidance places at the center of responsible practice. To use this framework well, a librarian does not need to memorize the guidance in detail. They need to hold the six values as standing questions and treat AI output as a draft. The rest of this module fills in the specific obligations that each value entails, around privacy, copyright, bias, and policy.

Hallucination, the term for when AI confidently states something false, is not a bug in the traditional sense. It is a direct consequence of how large language models work. The model is always predicting the most plausible next token, and sometimes plausible is wrong. Module 01 covers the mechanism in depth. The professional implication for ethics practice is that hallucination is structural and persistent, not something model updates will eventually eliminate. The question is not whether AI hallucinates but how to work with it responsibly given that it does.

In library contexts, the hallucinations that carry the most professional risk are the ones that look most authoritative. These include invented citations with plausible journal names, volume numbers, and page ranges; statistics that sound reasonable but cannot be traced to a primary source; incorrect dates for events or policies; wrong author attributions; and legal or policy characterizations that are outdated or simply wrong. These errors are not random. They tend to occur precisely where the model has learned that authoritative-seeming specificity is expected. A hallucinated citation does not announce itself; it is formatted correctly and plausible in content. Recognizing this pattern is the first step in the practice of verification that Module 05 covers in full.

Hallucination is not a reason to dismiss AI entirely. It is a reason to verify, always, in proportion to the stakes and claim type of the output. The same critical evaluation librarians apply to any information source applies here, with the added knowledge of which claim types carry the highest risk in AI-generated text.

Library confidentiality is foundational to professional practice. The ALA Code of Ethics commits librarians to protecting patron privacy, and that commitment has no technology exception. AI tools do not automatically honor patron confidentiality. That requires deliberate professional choices about what information enters a prompt and which tools are used for which tasks.

The risks are specific. Consumer-tier AI tools may log inputs and use them for model training. A patron's research question, entered verbatim into a free-tier tool, may be processed on the vendor's servers, retained, and potentially reviewed by company employees or incorporated into future training data, depending on the tool's terms of service. In most library contexts, that would be a meaningful breach of patron privacy. This is especially true for inquiries that touch on sensitive circumstances: health information, legal questions, immigration status, financial difficulty, crisis situations. Entering any patron information that could identify the individual into an unapproved commercial AI tool is not a minor procedural lapse; it is a professional conduct matter.

The practical guidance for using AI ethically in reference and patron services is straightforward. Strip all identifying information before putting any patron inquiry into AI. For example, instead of pasting a patron's verbatim question with their name and institution, describe the research need anonymously: "A nursing student is looking for peer-reviewed articles on postpartum depression for a capstone project." Where available, use institutional AI agreements that include contractual data privacy protections, rather than consumer-tier tools with opt-out checkboxes. Follow your institution's IT and legal guidance on which tools are approved for which data types. When the information is sensitive enough that you are uncertain, handle the interaction without AI. The judgment to decline a tool in a specific context is itself an expression of the competency this module addresses.

ALA's AI guidance turns this professional norm into a concrete prohibition. It is worth stating as a flat rule rather than a nuanced principle, because a rule is what staff can actually follow under time pressure at a busy desk.

Stating it this way removes the moment of judgment that leads to breaches. A librarian who has internalized the rule does not weigh whether a particular patron detail is sensitive enough to withhold. They withhold all of it by default and add only the anonymized description the task actually requires. This default is the practical form of the ALA Code of Ethics commitment to patron privacy. It is also the single habit that most reliably keeps AI use inside the profession's confidentiality obligations.

The copyright landscape for AI-generated content is unsettled in ways that will likely take years of litigation and legislation to resolve. Several positions, however, are clear enough to guide current practice. To navigate this landscape responsibly, librarians need a working understanding of two distinct copyright questions. First, who, if anyone, holds copyright in AI-generated outputs? Second, what copyright obligations arise from the training data that AI models were built on?

On the first question, the U.S. Copyright Office has been consistent: copyright requires human authorship, and content generated by AI without significant human creative input is not copyrightable. For library work, this means that communications, LibGuide content, or instruction materials generated by AI and lightly edited carry at most partial copyright protection, covering only the human-authored elements. This matters when libraries produce content intended for publication, grant applications, or official institutional documents. The authorship question is less critical for patron-facing materials, where accuracy matters more than attribution. It remains professionally relevant for any content the library publishes in its own name.

On the training data question, the situation is actively litigated, but one case has now produced an outcome specific enough to change how librarians should talk about it. Major AI models were trained on copyrighted materials, specifically books, articles, and other published works, collected without explicit license from rights holders. The New York Times filed suit against OpenAI in late 2023, multiple authors have brought class-action suits, and the outcomes of these cases will shape how AI-generated outputs can be used commercially. In Bartz v. Anthropic, Judge William Alsup ruled on June 23, 2025, that training a language model on lawfully acquired books is "exceedingly transformative" and therefore fair use. Acquiring and retaining pirated copies of those same books in a permanent internal library, however, is not. The distinction is provenance rather than purpose, and it carried into the settlement. On July 20, 2026, the court granted final approval to a $1.5 billion settlement covering 482,460 works, with Anthropic required to destroy the pirated datasets. The settlement sets no binding precedent, and a librarian should say so when asked: settlements resolve the parties' dispute, not the law. What it does establish, in a way no previous filing had, is that where a training corpus came from now carries direct financial weight. The archival protocols discussed in Module 09 apply the same logic from the library's side of the transaction. That is why provenance and attribution have moved from good practice to the central question. For current library practice, the broader implications are still developing. While the legal landscape evolves, several practices are defensible: being transparent about AI use when it is relevant to publication or attribution, following emerging institutional disclosure policies, and documenting AI-assisted workflows for content produced under grant funding or for official publication. The ARL Guiding Principles (2024) address this directly. Libraries have a professional stake in preserving copyright flexibility for nonprofit research and educational uses. The training data copyright debate is therefore not merely a legal matter for AI companies to resolve but a professional advocacy issue for the library field.

The Association of Research Libraries published seven guiding principles for AI in April 2024. They are worth reading in full. The principle that proves most consistently clarifying for library practice is Principle 4:

"No Human, No AI": consequential decisions must not be delegated entirely to AI systems. Human involvement is essential at critical decision-making junctures.

For library practice, this principle is clarifying. AI can help you draft, research, brainstorm, and organize. Decisions that affect patrons, however, require human professional judgment. These include what information to provide, how to support someone in crisis, whether to escalate a situation, and how to evaluate a collection.

This is not about AI being untrustworthy. It is about recognizing that accountability requires a human. When something goes wrong (and sometimes it will), there needs to be a professional who made a decision and can answer for it.

Dakan and Feller frame responsible AI use as a competency they call diligence. It shifts the question from what AI can do to what professionals are responsible for when they use it (Dakan & Feller, AI Fluency: Framework & Foundations, Anthropic Academy, 2025). The framework has three layers that map directly onto library practice. The first is creation diligence: before beginning any AI-assisted task, ask which system is being used, how it handles the data being entered, and whether institutional policies permit this particular use. For librarians handling patron data or confidential institutional information, this is not a one-time question but a habitual check before each new use case. The second layer is transparency diligence: who needs to know that AI was involved in this work, and how explicitly? The standard is not what is technically required but what maintains the trust of the people affected. For example, a committee report drafted with significant AI assistance calls for a different disclosure than a patron email lightly proofed by the AI. These decisions require judgment, not formulas. The third layer is deployment diligence: when AI-assisted work is shared (with a patron, a colleague, or the public), the professional who deployed it is accountable for its accuracy and appropriateness. The AI is not. To meet the standards that would apply to fully human-authored work, facts must be verified, bias checked, and AI output treated as a draft that needs professional sign-off before it goes anywhere.

Your institution either has an AI policy, is developing one, or should be. Either way, librarians have a professional role to play. They are not merely policy followers but the professionals best equipped to understand what responsible information use requires.

Reading a policy: When reviewing an institutional AI policy, librarians should look for the following elements. First, which tools are explicitly approved or prohibited, and whether the approval list is current, given how rapidly the tool landscape changes. Second, which categories of data may and may not be entered into AI systems, and whether patron-related data is specifically addressed. Third, whether there are disclosure requirements for professional communications or publications that used AI assistance. Check how those requirements apply to library-produced content such as LibGuides, research handouts, and instruction materials. Fourth, who holds institutional responsibility for AI-related decisions and incidents, and whether the library has a designated point of contact for AI policy questions.

Contributing to policy: Librarians bring expertise directly relevant to AI policy development, including information ethics, intellectual property, patron privacy, and information literacy. Yet they are rarely at the table when institutional policies are drafted. For example, an institutional AI policy written without library input may fail to address reference interactions, patron data protection, or the use of AI in instruction. To ensure that library concerns are represented, librarians should request inclusion in AI policy working groups and submit written comments when policies circulate for review. They should also position the library as the natural institutional home for the information governance questions that AI use raises.

A librarian who has to draft or review a local policy has few published models to work from. The most instructive one available states what its library will not do. Stony Brook University Libraries approved version 1.4 of its AI statement on December 3, 2025. Alongside eight guiding principles, it publishes an explicit list of what the libraries do not use AI for. They commit not to track, evaluate, or discriminate against individual patrons, including on the basis of search and borrowing history; not to determine eligibility for services or to replace the professional expertise of staff and faculty; not to sell sensitive data; and not to build or fine-tune models on sensitive information. Very few libraries publish such a list, and it teaches more than the positive one does. A statement of what a library hopes to accomplish with AI is compatible with almost any implementation, because aspiration constrains nothing. A statement of what the library has ruled out is a commitment that can be checked. It also gives a staff member a clear answer when a vendor, an administrator, or a well-meaning colleague proposes something that crosses one of those lines. For example, a proposal to use circulation history to generate personalized recommendations may sound like a service improvement in a meeting. A library whose policy already says it will not evaluate individual patrons on the basis of borrowing history has resolved the question before the meeting starts. To write such a list locally, do not draft it from first principles. Work through the ALA core values covered at the opening of this module and ask, for each one, what a violation would actually look like in this library's systems. Deciding which uses are incompatible with the library's obligations to its community is a professional judgment. It belongs to the people who understand those obligations, not to the office that will eventually approve the document.

ACRL subcompetency 2.5 specifically asks us to "understand AI related policies and regulations." At the professional level, this means both following them and helping to shape them. Module 12 covers the advocacy side of this work in more depth, including how to make the case for library leadership on AI governance to administrators who may not have considered the library's role.

In October 2025, ACRL published the AI Competencies for Academic Library Workers, the first framework from the national association to define professional AI competency for librarians. This is the document that provides the structure for this entire curriculum. Each module is mapped to specific subcompetencies, and the three levels of this learning pathway follow the framework's progression from foundational knowledge through applied practice to advanced work.

The ACRL framework is organized into four competency areas containing nineteen numbered subcompetencies in total. Ethical Considerations, numbered 1.1 through 1.5, addresses professional responsibilities around privacy, bias, intellectual property, labor, and accountability; it is the core of this module. Knowledge and Understanding, numbered 2.1 through 2.5, addresses what AI is, how it works, and its limitations, the territory covered in Modules 01 through 03. Analysis and Evaluation, numbered 3.1 through 3.4, addresses critical evaluation of AI output, AI systems, and vendor products, which Module 05 develops in full. Use and Application, numbered 4.1 through 4.5, addresses using AI tools effectively for library tasks, including prompting, tool selection, and workflow integration. The applied and advanced modules draw on this area most heavily.

For a practicing librarian, the ACRL framework is most useful not as a credential checklist but as a professional self-assessment tool. For example, a reference librarian who feels confident in Knowledge and Understanding but uncertain about the Analysis and Evaluation subcompetencies now has a published standard to anchor their development planning. They can also point to that standard when making a case for professional development time or funding. This alignment between individual development and an ACRL-endorsed framework carries weight in institutional conversations about the value of library AI training. The full ACRL framework document is freely available from ALA at ala.org/acrl/standards/ai. It is worth reading in its entirety rather than relying on summaries, including this one.

The ACRL framework is not the only structure available. Leo S. Lo's AI Literacy for All: A Universal Framework, released in 2025 as a preprint that has not yet been peer reviewed, organizes AI literacy into five components rather than four areas: Technical Knowledge, Ethical Awareness, Critical Thinking, Practical Use, and Societal Impact, each with four progressive levels (Lo, 2025). The two frameworks cover overlapping ground but serve different purposes. ACRL defines what academic library workers need as professionals. Lo's framework is deliberately universal, written for learners ranging from students to community members and industry professionals. It also gives Societal Impact, including labor markets, governance, and environmental effects, a component of its own. For example, a librarian designing AI literacy instruction for students or the public may find Lo's four-level progression easier to adapt than the ACRL subcompetencies, which were written for library workers themselves. Used together, the ACRL framework describes the professional standard, and Lo's framework offers one pathway for teaching AI literacy to the people libraries serve.

The patron privacy obligations covered earlier become substantially more complex when specific federal privacy laws apply. Two are particularly relevant for academic library practice: FERPA (the Family Educational Rights and Privacy Act) and, in health sciences and hospital library contexts, HIPAA (the Health Insurance Portability and Accountability Act). To work with AI responsibly in these contexts, librarians need a practical understanding of what these frameworks require. That does not mean legal expertise. It means professional judgment about what information should and should not enter an AI workflow.

FERPA protects the education records of students enrolled at institutions receiving federal funding, which includes virtually every college and university in the United States. Education records include grades, transcripts, financial aid information, disciplinary records, and any document containing personally identifiable information about a specific student. For example, a librarian may receive a request from a faculty member that includes a student's name alongside details about the student's research challenges, academic standing, or accommodation status. That communication may contain FERPA-protected information. Entering it into a commercial AI tool, even a paid institutional plan, without explicit institutional authorization for that data category would be a FERPA concern, not merely a privacy preference. Deciding which AI tools are FERPA-compliant for which data types is the job of the institution's compliance office, not the individual librarian.

HIPAA applies in health sciences library contexts, including medical school libraries, hospital libraries, and any library serving clinical environments where patient information may come up. HIPAA's minimum necessary standard requires that only the information needed for a specific purpose be accessed or disclosed, which has direct implications for AI prompts. For example, a clinical librarian helping a nurse with a literature search on a patient's condition should not include any patient identifiers or case-specific clinical details in an AI prompt, however helpful that context might seem. That information is protected health information (PHI) under HIPAA. Entering it into a commercial AI tool would be a potential breach even when the intent is purely professional.

To navigate these requirements without legal training, librarians should adopt a simple default: when uncertain whether information is subject to FERPA or HIPAA, leave it out of the AI prompt. Librarians should also consult their institution's privacy officer or general counsel about which AI tools have been assessed for compliance with applicable federal privacy laws. They should document that consultation, since having sought guidance is itself evidence of good-faith professional conduct.

Library vendors are integrating AI into the systems librarians manage daily, including catalog discovery, research databases, interlibrary loan platforms, digital repository software, and learning management system integrations. For example, multiple major vendors now offer a discovery layer with an AI-powered "research assistant" feature that suggests sources and summarizes article abstracts. Librarians are increasingly expected to evaluate and configure these features without clear guidance from their institutions. To do this with professional rigor, librarians need an ethics evaluation framework that applies to vendor AI features, not just general-purpose tools.

Several questions are essential to this evaluation. First: where does the AI feature process data? Does that processing happen on the vendor's servers, on third-party AI provider servers, or within the institution's infrastructure? The answer affects which data governance agreements apply and whether patron interaction data leaves the institution's control. For example, a discovery layer that sends patron search queries to an external AI provider for summary generation may be processing patron search behavior in ways the library's existing agreement with the discovery vendor does not cover. Second: does the vendor's AI feature have a training data arrangement that raises intellectual property concerns? Several vendors have faced questions about whether their AI tools were trained on licensed library content, which could implicate the terms of the institution's database agreements.

Third: what happens when the AI feature produces incorrect information and a patron relies on it? Vendor marketing rarely addresses error liability directly. Ask before deployment, and let the answer inform how the feature is presented to patrons. Fourth: does the vendor disclose which AI model or models power the feature, what training data was used, and how the outputs are grounded or verified? That transparency is not universal, and its absence should be treated as a flag, not a norm. Librarians should also consult ALA Core, LTI Choice360, and Library Technology Reports for community-sourced assessments of specific vendor AI features. In a rapidly evolving market, independent professional evaluation is more reliable than vendor documentation. The ARL Guiding Principles (2024) commit libraries to "advocate for openness and transparency in algorithms, training data, and methodologies used to create AI technologies that we license." The ICOLC Statement on AI in Licensing (March 2024) sets out what consortia expect AI clauses in licenses to permit. Together they are a useful framework for structuring vendor conversations and contract negotiations.

Three policy documents have appeared since the rest of this module was framed. Each speaks directly to the foundations laid above: the privacy framework, the copyright landscape, and the strategic horizon for research libraries.

The first is ALA's own. Following a public comment period in the spring of 2026, ALA adopted its "Guidance on the Use of Artificial Intelligence in Libraries" at the June 2026 Annual Conference. It is now the association's stated framework rather than a draft. The document to cite is the final text, ALA Council Document 44.2, dated June 2026; its six core values anchor the opening section of this module. Two of its commitments are worth remembering, because they make explicit principles this module has been building toward. The guidance states that "libraries will not adopt AI tools that fail to protect individuals' privacy, personal data, and security." That turns the patron privacy commitment covered earlier into a procurement standard rather than a best practice. It also requires that libraries obtain "algorithmic transparency" from AI vendors, which turns the vendor evaluation questions raised above into a formal professional expectation. A vendor's unwillingness to explain how its AI feature was trained and how its outputs are grounded is no longer merely a yellow flag. It violates an emerging professional norm. For example, a librarian negotiating a discovery layer contract that bundles in a new AI summarization feature can point to this language. It shows that the profession expects vendor transparency as a baseline condition of doing business with libraries.

The second development resolves, at least for now, one corner of the copyright uncertainty discussed earlier. In October 2025, the Library Copyright Alliance, which speaks for ALA, ACRL, and ARL together, issued version 4.0 of its "Statement on Copyright and Generative Artificial Intelligence." Its position is direct. Existing U.S. copyright law, including the fair use doctrine libraries have relied on for decades, is adequate to address generative AI, and no new legislation is required to resolve the training data and output questions raised earlier. This position does not settle the pending litigation; courts will still decide individual cases on their merits. It does give librarians a clear professional reference point when colleagues, faculty, or administrators ask whether new "AI law" is coming that will change how libraries operate. The field's collective position, through LCA, is that the legal tools already exist. What is needed is correct application of fair use principles to new technology, not a new statute.

The third document widens the lens considerably. In March 2026, ARL and the Coalition for Networked Information published "Strategic Implications of AI Futures for Research Libraries." The report moves past day-to-day policy questions to ask what research libraries need to anticipate over the next five to ten years, as AI reshapes scholarly communication, research workflows, and the library's role within the research enterprise. For example, the report considers how AI-assisted literature review tools may change what researchers expect from library research support. It also considers how AI's growing role in data curation and research data management may shift staffing and skill requirements within research libraries. This report belongs on the reading list of any librarian whose development plan, drawing on the ACRL framework, extends to strategic planning. It is squarely the kind of strategic document that Module 18 returns to.

None of these three documents changes the core judgment this module has argued for from the start. An adopted guidance document, however carefully worded, does not evaluate a specific vendor contract. A copyright statement, however authoritative, does not decide whether a specific use of a specific tool is fair use in a specific library's circumstances. A strategic report, however well researched, does not tell a specific library what to prioritize this year. Reading these documents, understanding their implications, and translating them into decisions that fit a particular institution's mission, resources, and risk tolerance remains a professional judgment. No policy document, however good, can make it for us.