Part 1 - Too Small to Sue, Too Small to License, Ingested all the Same
Part 2 - The Answer Without the Author
Part 3 - The Machinery of "No"
The first two posts in this series set out the problem: original work is ingested without consent or credit, and AI answers increasingly satisfy the reader in place of the source itself. The fair question to ask next is what, if anything, is being built in response. The honest answer is that it amounts to rather more than you might think, and rather less than you would hope.
The fastest mover is infrastructure
The fastest mover, perhaps unsurprisingly, has been the infrastructure layer. In July 2025 Cloudflare, which sits in front of a sizeable share of the web, simply flipped the default: new sites now block known AI crawlers unless the owner chooses to allow them. Its Pay Per Crawl marketplace lets a publisher allow, charge for, or block each crawler individually, and by Cloudflare's own April 2026 figures the network is now returning more than a billion "402 Payment Required" responses to AI crawlers every single day. A companion Content Signals Policy adds machine-readable lines to robots.txt that distinguish between three different uses: search, ai-input and ai-train. For the first time, "do not train on this" is a default that a small publisher gets for free.
A standard for licensing
Alongside the infrastructure, a licensing standard has been taking shape. Really Simple Licensing, or RSL (from the same people who gave us RSS), became an official standard in December 2025. It takes the blunt yes-or-no of robots.txt and turns it into machine-readable terms, including pay-per-crawl and pay-per-inference, while the RSL Collective exists to bundle the long tail (the smaller publishers who could never realistically negotiate on their own) into something an AI company will actually sit down and transact with. More than 1,500 organisations have now signed on, from the Associated Press to Yahoo, and there are one-click plugins available for the common content management systems.
Preferences and provenance
Underneath all of this, the IETF is working to standardise a shared vocabulary for AI-usage preferences through its AIPREF working group , the idea being that a single "Content-Usage" signal might eventually replace today's patchwork of competing approaches. It is real, and it is moving, but it is not yet finished: the core drafts are still working their way towards consensus, with a standards milestone targeted for later this year. In parallel, C2PA "Content Credentials" attach cryptographic provenance directly to a file, and are now built into cameras, phones and several of the major platforms; and the EU AI Act's machine-readable marking duties for AI-generated content come into effect on 2 August 2026.
Two honest caveats
So the machinery is, genuinely, arriving: a way to say no, a way to set terms, a way to mark provenance. Two honest caveats need to sit alongside that, though.
The first is that published is not the same as honoured. A signal only does its job if AI firms actually read and respect it, and adopting a signal is not at all the same thing as complying with it. The second, and this one cuts more sharply for researchers, NGOs and archives, is that none of it brings back the visit. A signal that blocks or prices a crawler is a defence; it is not discovery. Even on a fully licensed web, the answer engine still satisfies the reader without a click — and being attributed inside an AI answer is simply not the same as being read.
Necessary, not sufficient
Which is why, for mission-driven publishers, our own view is that these standards are necessary but not sufficient. They are well worth adopting: they are mostly free, and being legible to the emerging rights-and-provenance layer is quickly becoming table stakes. But what they protect is the boundary, not the relevance. Remaining the source that AI systems reach for, name, and point people back towards is a separate problem altogether, and it is the one we will turn to next.
Next in this series
Next in this series, we'll look at what the courts have actually settled so far, and at what they have not.