Context: So far, assertions of intellectual property rights against OpenAI and other AI providers have typically been copyright infringement lawsuits. The potentially most impactful AI copyright case at the moment is the Bartz v. Anthropic class action (July 15, 2025 ai fray article). To the extent that patents have been asserted at all, those cases targeted hardware, such as Singular Computing v. Google (January 25, 2024 ai fray article), ParTec v. Microsoft (November 13, 2024 ip fray article) and ParTec v. NVIDIA (October 28, 2024 ip fray article). The only previously-known patent infringement action against OpenAI, brought by a company named Engajer, went nowhere as the plaintiff couldn’t find or afford counsel and wasn’t allowed to represent itself. But there will be more and more AI-related patent litigation.
What’s new: As we have just reported on ip fray, a French company named KeeeX (which competes in the file verification space) filed a lawsuit against OpenAI, Adobe, Truepic and a broad-based industry group named Coalition for Content Provenance and Authenticity (C2PA; February 18, 2024 ai fray article) in mid June. The filing was made with the Unified Patent Court (UPC), a common patent court of 18 European member states that can, depending on the specifics of the case, order patent injunctions and award damages with respect to only those 18 countries (such as Germany, France and Italy), but has long-arm jurisdiction over 21 more, among them the UK and Spain. The case number is ACT_28303/2025. The purpose of this article is to explain some aspects of patent law in general and the UPC in particular that ip fray‘s readership, which largely consists of patent professionals (even a number of patent-specialized judges), is already familiar with, but the wider tech ecosystem may not know yet.
Direct impact: This case must be taken seriously. It was brought by a reputable patent law firm; the plaintiff is not just an individual inventor, but a small tech company; and the invention was made by a major French university together with a research institute. The UPC is a powerful court, and its significance is illustrated by the fact that SAP, at around the same time as KeeeX sued OpenAI, decided to bring its first-ever offensive patent case in the UPC (July 21, 2025 ip fray article). A hypothetical injunction would not shut down OpenAI, but it would prevent it from implementing the C2PA’s content authentication method, which is key to combat deep fakes and (deep)fake news. OpenAI and the other defendants (Adobe, Truepic, C2PA) would probably tell the court that such enforcement would be against the public interest, but the UPC has so far not appeared to be overly receptive to such arguments.
Wider ramifications: The C2PA is a Linux Foundation project and supported by a variety of major playes. Besides the companies KeeeX elected to sue (OpenAI, Adobe, Truepic), potential future defendants include (but are not limited to) Amazon, Google, Microsoft, Meta, Intel, Sony, Samsung and TikTok. A hypothetical injunction against the C2PA would not bind all of its members, so KeeeX might have to bring some follow-on lawsuits. Presumably its objective is to get OpenAI, Adobe and Truepic to pay, and to then go after some others, bringing follow-on lawsuits if necessary.
Let’s try to explain this to those not intimately familiar with patent litigation and the UPC.
What is the patent about?
On ip fray we published the claim language. It involves digital fingerprints for data blocks and their verification. There are many conceivable applications for that technique, and content authentication (so as to tell deepfakes and deepfake-based fake news from original material) is one of them, at least in KeeeX’s opinion.
Is this patent valid?
OpenAI and the other defendants can and likely will bring a revocation counterclaim, meaning that they will argue the patent should never have been granted in the first place and should now be revoked.
The mere argument that this is a software patent and the European Patent Convention (EPC) does not allow patents on computer programs “as such” won’t solve the problem. Security patents are routinely upheld by European courts.
Does the C2PA standard infringe this patent?
KeeeX obviously believes so. At first sight, there could be C2PA implementations with respect to some file formats where the patent-in-suit would not be deemed to infringe, but they may have infringement theories that work, at least based on a reasonably broad claim construction (i.e., interpretation of the patent claims) so as to cover C2PA’s cryptographic hashes. For example, the term “digital identification fingerprint” can have a broader or a narrower meaning.
With a broad claim construction comes an increased risk of the patent being deemed invalid, however. That’s because it would then be easier to find some prior art (earlier publication, such as an earlier patent application) that falls within its scope.
What would OpenAI, Adobe, Truepic and the C2PA have to do if KeeeX prevailed?
They could appeal and ask the UPC’s Court of Appeal (CoA) to suspend enforcement, but the hurdle for such stays is high.
An injunction would require OpenAI, Adobe and Truepic to stop implementing this data block authentication method. It could be that, hypothetically speaking, they could still authenticate JPEG files, but not some other file formats. It could also be that they can’t use that method at all.
It is too early to tell whether the injunction would be so broad as to make it impossible to work around the patent without losing the relevant functionality.
In a worst-case scenario, OpenAI would be out of compliance with the EU AI Act if it obeyed the injunction.
KeeeX has no reason to want to put OpenAI out of business in Europe, or to cripple its functionality. But Adobe and Truepic are clearly competitors, and KeeeX might want to get a substantial share of the C2PA implementation business.
In the end this will be about money.
We can’t say for sure that KeeeX is seeking both damages and an injunction, but that’s what UPC plaintiffs do almost all of the time, so it is a safe assumption.
What countries does this lawsuit relate to?
The list of countries with respect to which KeeeX is seeking remedies is not public, but just like the remedies sought are anyone’s guess, so is the geographic scope of the case.
The UPC started to accept filings on June 1, 2023, and is a common patent court system for 18 EU member states, the largest ones being Germany, France and Italy. But there are other major EU member states such as Spain and Poland that are not members yet. And non-EU member states like the UK, Switzerland or Turkey can’t become members, at least not under the current treaty named UPC Agreement (UPCA).
In the UPC, one can only sue over patents that were granted by the European Patent Office (EPO), which applies to the patent-in-suit here: EP2949070 (“Verification process of the integrity of numerical data block”). The EP in the patent number shows it was granted by the EPO. The EPO conducts a single examination process, and then patentees can obtain national patents in designated countries. Here, they had a much longer list, but currently the patent is in force in 16 countries.
Half of those countries are UPC contracting member states (CMS): Austria, Belgium, Denmark, France, Germany, Italy, the Netherlands, and Sweden. The other eight countries are members of the European Patent Organisation (EPOrg), which runs the EPO, but not UPC CMS and some of them not even EU member states: Ireland (where the UPCA is pending ratification; the Irish government decided to join, but Irish voters would have to approve accession through a referendum), Liechtenstein, Norway, Poland, Spain, Switzerland, Turkey, and the UK.
The UPC can exercise long-arm jurisdiction over non-CMS provided that a given EPO-granted patent is in force there. Last month, the UPC granted its first UK injunction (July 18, 2025 ip fray article). Long-arm jurisdiction is subject to certain criteria, however, and those are presumably not met here, at least not until KeeeX brings in additional defendants from the relevant corporate groups. Long-arm jurisdiction requires at least one anchor defendant to be based in UPC territory (May 25, 2025 ip fray article).
A multi-country injunction can do significant damage to a defendant’s business, and a multi-country damages award could be substantial, though it would take much longer as UPC plaintiffs typically seek a decision on the merits first, then request an accounting that enables them to calculate a damages claim, and then they start (absent a settlement or other major developments) a lawsuit in which they seek a particular damages amount.
Where is this litigation going to unfold and in what language?
KeeeX filed this case in the UPC’s Paris Local Division (“Paris LD”). It selected French as the language of proceedings. Defendants can request that the language of proceedings be changed, but in this case the only alternative to the language of the relevant LD is none: it would be the language of the patent, which is French as well.
The Paris LD is not the busiest UPC LD: most cases are filed in the German LDs (Munich, Dusseldorf, Mannheim, Hamburg) followed by the Hague (Netherlands) LD. But the Paris LD also has significant patent law expertise, and one of Europe’s most competent patent judges, part-time Heidelberg University professor Peter Tochtermann (whose main job at the UPC is to preside over the Mannheim LD), is on the panel as well. That is so because UPC panels must not consist of judges from only one country, so they need at least one judge with another nationality sitting there by designation. Judge Prof. Tochtermann has previously helped out in Paris, so he may be fluent in French (if not, they could provide simultaneous interpretation).
There might be a fourth judge on the panel: the UPC has both legally qualified judges (LQJs) and technically qualified judges (TQJs). The LQJs have a full law degree, and the TQJs have a full engineering or scientific degree. For patent infringement cases heard by a UPC local division, a TQJ is not mandatory, but the LQJs will involve one if the complexity of the patent requires technical knowledge. In this case, given how much is at stake, the LQJs may very well decided that they are more comfortable with a TQJ on board. The nationality of the TQJ does not matter. There is a Europe-wide pool of TQJs and selections are made based on the relevant field of technology. For example, some TQJs are pharma-specialized and would obviously not become involved here.
Where is the Paris LD in the wider UPC system?
The UPC (official website) has two levels. Its appeals court (CoA) is based in Luxembourg. Below the CoA, there’s the Court of First Instance (CFI), which is spread out all over Europe. There are local divisions from Portugal in the West to Finland in the East. In principle, a case can be brought in a local division if an infringement has occurred, or is imminent to occur, in its relevant country. There’s also the Nordic-Baltic Regional Division (RD), which entered its first-ever injunction on Thursday (July 31, 2025 LinkedIn post by ip fray). It is at the same level as the LDs, just that it covers Sweden and the three Baltic states (Estonia, where one of its judges is from; Lithuania; and Latvia). And there’s the Central Division (CD), which is not higher than the LDs, but has the exclusive jurisdiction over revocation claims (complaints seeking to invalidate patents proactively, not just in response to an infringement lawsuit) and has three seats (Paris, Munich, Milan).
All LD, RD and CD decisions can be appealed to the CoA, but the CoA is the court of final appeal. Theoretically, the CoA could refer certain questions of EU law to the European Court of Justice (ECJ) in the form of a preliminary reference, but that has not happened yet and will be rare. The EU has not legislated much on patents, so there aren’t many questions that could be referred to the ECJ in the first place.
How fast is the UPC?
The UPC prides itself on the swift and efficient resolution of patent cases, even of cases that are significantly more complex than this one. The target is to take a case from filing to trial in about a year, and decisions are typically issued a few months after the oral hearing (which is a trial, typically taking a day or two).
Some UPC divisions, particularly the Munich LD, are so busy that they can’t keep that timeline at the moment, but the Paris LD may.
In order to keep its timelines, the UPC stresses that its proceedings are “frontloaded”, meaning that both sides must raise all of their arguments as early as possible. Of course, sometimes there are legitimate reasons for making an argument or presenting some evidence later, but only if it is justified. The standard for that is fairly strict.
Why is KeeeX suing the C2PA (and the company running it) and not just the service provider (OpenAI) and product (Adobe, Truepic) providers?
We don’t know, but we may find out as the proceedings unfold. During the course of such UPC lawsuits, some decisions and orders tend to become public, and they may shed a light on a litigant’s objectives and strategy.
The C2PA itself does not offer a service that could be accused of infringing the patent-in-suit, but there could be an inducement theory (meaning that C2PA encourages others to implement a technique that allegedly infringes KeeeX’s patent). The C2PA will probably try to get any claims against it is dismissed through what is called a preliminary objection, but the UPC may decide that it wants to have all the facts on the table before deciding on whether C2PA can be deemed an infringer or not.
A ruling against the C2PA might be part of KeeeX’s plan for becoming a key provider of content authentication software to C2PA’s members, and a basis for suing more of those members in a subsequent step.
If KeeeX wins an injunction, can it afford to enforce it?
Assuming that KeeeX wins a multi-country injunction against OpenAI (and maybe others, too) in the Paris LD, it can enforce even during an appeal, but it may have to provide collateral. The purpose of that is to ensure that if KeeeX ultimately loses, OpenAI (and possibly others) will be made whole for the enforcement that would then, with the benefit of 20/20 hindsight, have been wrongful. The security amount is neither a minimum nor a cap for the actual damages award. It is just an estimate so as to ensure that a reasonably anticipated amount of money will be available even if KeeeX went out of business, possibly because of its inability to compensate for wrongful enforcement.
KeeeX will tell the UPC, however, that security should not compromise a party’s access to justice. So there could be a major fight over enforcement security later on, but KeeeX presumably hopes to settle the case ahead of trial.
Why did the C2PA group, which consists of sophisticated and partly deep-pocketed companies, define a standard that may infringe this patent?
There are too many patents out there, and the C2PA group presumably thought that if any patent claims were to be brought, they would defend and either prove such patents invalid or not infringed. If it came to worst, they probably assumed that they could always settle, looking at patent licensing as a cost of doing business. But with the UPC and its ability to order remedies with respect to a large number of countries, patentees can get a lot of leverage, provided that their patents are valid and infringed.
Will there be a lot more patent litigation against AI providers and their technology vendors?
At the moment, there are dozens of copyright infringement lawsuits against AI providers, but not a lot of patent litigation. That is why this case is the first serious patent case in the world (by a party that has the resources to enforce) to have been brought against OpenAI. But there is a sizable and rapidly increasing number of AI-related patents, plus there many patents that are not AI-specific (such as this one) but can be more or less reasonably alleged to read on AI services and the technologies they rely on, such as chipsets or, in this case, security components. Therefore, we will see many more cases of this kind, and the UPC could be a key venue, but there will also be a lot of activity in U.S. district courts and elsewhere.