Summary

The Paris local division of the Unified Patent Court (UPC) heard the merits of KeeeX's infringement action over EP 2 949 070 on 6 October 2026. The defendants are Adobe, OpenAI, Truepic and the bodies behind the C2PA content-provenance standard. Infringement and validity now turn largely on one claim term. Earlier procedural rulings have already narrowed the case: six national parts of the patent are out of scope, late amendments and new accused products were refused, and the damages claim has shrunk from billions to a nine-figure interim demand. For patentees, the case is a lesson in pleading. For companies implementing industry standards, it is a live FTO problem.

The Event

According to JUVE Patent, KeeeX filed its action on 17 June 2025. The defendants are Adobe and OpenAI entities, Truepic, the Joint Development Foundation and the Coalition for Content Provenance and Authenticity (C2PA). Each defendant counterclaimed for revocation. The patent covers a method for verifying the integrity and authenticity of digital data blocks. KeeeX alleges that the defendants use the patented features in tools that check or process content. Camille Lignières presides and is judge rapporteur. She sits with legally qualified judges Carine Gillet and Peter Tochtermann and technically qualified judge Alessandro Sanchini.

The central dispute is the meaning of "digital identification fingerprint" in claim 1. JUVE reports that KeeeX distinguishes the term from a digital signature, while the defendants argue for a broader reading. Dhenne Avocats summarises the judge-rapporteur's order of 22 September 2026, issued under Rule 105.5 RoP. That order frames the question as whether the fingerprint covers only hash-type fingerprints or also digital signatures. The parties also dispute what a "digital data block" is, how the fingerprint is calculated and how linked blocks are checked. The defendants cite prior art including KANAI, OpenPGP and the PDF standard.

The same order closed the interim procedure and set a one-day hearing agenda covering claim interpretation, validity, infringement and remedies. It admitted eleven auxiliary requests. The hearing runs in French, with simultaneous interpretation into English at the defendants' expense.

JUVE also tracks the procedural history:

  • Damages: KeeeX first sought €5.6 billion for material damage and €1 billion for non-material damage. It now seeks €100 million plus €20 million in interim damages, with any final quantum left to separate proceedings. The Court of Appeal rejected Adobe's request for discretionary review of this point.
  • Late filings: In late June 2026 the division refused a further KeeeX amendment request. It also refused to extend the action to "Truepic Lens" and "Script Truepic Display" and excluded much of KeeeX's late infringement material. The division upheld these rulings on 29 July.
  • Security for costs: KeeeX was ordered to provide €200,000. In July this was raised to €300,000.
  • Parallel attack: Adobe alone has also filed a nullity action at the German Federal Patent Court (6 Ni 61/25).

Context

Bech-Bruun and Lavoix report the jurisdiction ruling. On 27 November 2025 the Paris division upheld jurisdiction over the Swiss, Spanish, UK, Irish, Norwegian and Polish parts of the patent. It relied on the CJEU's BSH v Electrolux judgment. On 13 March 2026 the Court of Appeal reversed that finding.

The Court of Appeal held that jurisdiction based on Article 7(2) of the Brussels Ia Regulation (place of the harmful event) is limited to damage within UPC territory. KeeeX's statement of claim said infringement occurred "notably in France" and that the harm was "global". It then listed the designated countries without further explanation. The court held this insufficient under Rule 13(1)(i) RoP and said later exhibits could not cure the defect. It left open whether Article 71b(3), which applies to defendants domiciled outside the EU, can support jurisdiction over non-UPC national patents.

Commentator Florian Mueller (ai fray) describes the action as the first serious patent case brought against OpenAI. He identifies a trade-off at the centre of the dispute. A broad reading of "fingerprint" makes it easier to capture C2PA's cryptographic hashes as infringing. It also makes it easier for prior art to fall within the claim. Source 7 reports that KeeeX holds a sublicence to patent families from CNRS and Aix-Marseille University through SATT Sud-Est.

Implications

For patentees, the jurisdiction ruling is a pleading rule with teeth. The UPC's frontloaded procedure punished KeeeX three times: it lost reach over non-UPC states, it could not add accused products, and it could not amend late. A claimant planning a multi-country UPC action should set out the factual basis for jurisdiction country by country in the statement of claim. That means identifying acts of infringement within UPC territory and, where Article 71b(3) is relied on, the connecting facts. It should also name every accused product it intends to pursue and file its full set of auxiliary requests at the outset.

For drafters, the case shows the cost of an undefined core term. Whether "fingerprint" includes signatures decides both infringement and novelty. When drafting security and authentication claims for EP filing, define the key functional term in the description. State expressly whether it includes or excludes neighbouring techniques such as signatures, hashes and MACs. Then write dependent claims that recite each variant separately, so that a fallback position already exists in the granted text.

For standard implementers, the risk sits with the standard, not a single product. Mueller lists Samsung, Sony, Google, Microsoft and others as C2PA supporters and potential future defendants. He also notes that an injunction against C2PA itself would not bind its members. That list is his speculation, not a pleading. Korean manufacturers that ship C2PA content credentials are therefore on the implementer side. For them, the Court of Appeal's jurisdiction limits and the strict UPC late-filing rules are helpful. The practical step is an FTO analysis of their own C2PA implementation against claim 1 under both candidate constructions, hash-only and hash-plus-signature. They should also document which technique each product uses.

The same Korean groups also assert patents in Europe. When they are the claimant, the 13 March ruling restricts them in the same way it restricted KeeeX. Their litigation teams should treat it as a pleading checklist, not only as a defence.

Outlook

UPC decisions typically follow a few months after the oral hearing, according to ai fray. Three points to watch:

  • How the panel construes "digital identification fingerprint".
  • Which of the eleven auxiliary requests, if any, survive.
  • Whether the German Federal Patent Court reaches a different view on validity in 6 Ni 61/25.

The Article 71b(3) question remains open at appellate level.

Until the decision issues, implementers should freeze a record of their current C2PA implementation details. That record supports both a non-infringement position and any design-around if the broad construction prevails. Patentees considering UPC enforcement against non-EU defendants should not count on reach into the UK, Spain, Switzerland or Poland through the UPC. They should keep national filings in those states available as a parallel route. Budget planners should also allow for interpretation costs and security for costs, both of which moved during this case.

Sources