Runway Enterprise Risk Assessment | AI Tool Risk

Back to AI Tools

Runway

Risk Overview

Moderate Risk

5.3

/10

Video Generation

Image Generation

Video Editing

Top Risks

Training without opt-out (non-Enterprise): irrevocable perpetual sublicensable license on all consumer content. Active YouTube scraping class action (Gardner v. Runway AI, Feb 2026) creates IP taint risk on Gen-3 outputs. Mandatory arbitration + class action waiver. Vague retention — perpetual training license survives account deletion. Free plan: no commercial rights.

Mitigations

Use Enterprise tier — contractually prohibits training on Customer Content and provides DPA. Exercise 30-day arbitration opt-out within account creation window (legal@runwayml.com). Add substantial human creative direction to outputs to maximize copyright protection. Monitor Gardner v. Runway AI for output-taint implications. No BAA available — do not use for any PHI workflows.

Get started

Is your team using

Runway

safely?

Book a Demo Free Assessment

Highest Risk Categories

The highest-scoring risk categories identified in this assessment.

Training Use

Consumer tiers (Free/Standard/Pro/Max/Unlimited): Runway holds an irrevocable, perpetual, sublicensable license on all Inputs & Outputs for model training — NO opt-out. Enterprise contracts explicitly exclude training (Section 5.2). Active class action (Gardner v. Runway AI, C.D. Cal., Feb 2026) alleging ~15M YouTube videos scraped to train Gen-3 Alpha.

/10

Legal Terms

Mandatory binding arbitration + class action waiver for all consumer tiers. 30-day opt-out window from account creation (written notice to legal@runwayml.com). Liability capped at 12-month fees paid (or $100 for free users). Runway can unilaterally amend terms. Enterprise uses NY courts but retains jury trial waiver + class action waiver.

/10

Data Retention

No specific numeric retention periods for most data. Face/voiceprint data retained max 3 years. Perpetual training license effectively survives account deletion for content already ingested. Enterprise: 30-day export window post-termination then deletion, but policy not fully specified.

/10