Counterfeits Are a Governance Problem, Not a Legal One

The question came from the newest non-executive, 40 minutes into an agenda item about something else.

"How many listings copied our products last quarter?"

Silence. The commercial director looked at the general counsel. The general counsel said legal had handled 2 matters in the period. The newest non-executive said that wasn't what she'd asked, which it wasn't.

Nobody in the room could answer. Not because the number was bad. Because there wasn't a number, and there had never been one, and the item had reached the board as a legal update rather than a risk report because that's the shape it had always arrived in.

That meeting was the moment the thing stopped being a legal nuisance and became a control gap. The two are governed differently.

Why this sits in the risk register and not in legal

A legal matter has a start, a counterparty and an end. Brand copying on marketplaces has none of those. It's a continuous rate, like fraud or shrinkage, and it behaves like one: a steady background level, occasional spikes, and a cost that nobody books because it never appears as a line item.

The four harms a board should recognise, because they land in different committees.

Revenue leakage. Sales diverted to a copy, at a price point you don't serve, usually to a customer who would have bought from you. Invisible in your own numbers by construction.

Product safety and regulatory exposure. A fake carrying your mark that burns out, breaks, or fails a standard produces a complaint, a return, and sometimes a regulator, all pointed at you. In the EU the General Product Safety Regulation, Regulation (EU) 2023/988, has applied since 13 December 2024 and brings online marketplaces squarely into the safety regime, which changes who the authorities talk to and how quickly.

Brand and entity damage. Reviews of a counterfeit attach to your name in the places buyers and machines read. This is the harm that persists after the listing is gone, and it's the one with no legal remedy at all.

Channel integrity. Authorised distributors watching unauthorised sellers undercut them on the same marketplace stop investing in the relationship. That conversation reaches the board late and framed as a distributor complaint.

Only the first of those is commercial. The other three are risk, and 2 of them are compliance. Which is why the item belongs in the register with an owner, a measure and a tolerance, rather than in a legal update with a case count.

The scale, so the tolerance isn't set by instinct

The OECD and the EU Intellectual Property Office put global trade in counterfeits at 467 billion dollars in 2021, equal to 2.3% of global imports, in Mapping Global Trade in Fakes 2025, published in May 2025. For the EU specifically the figure was 99 billion dollars of imports, 4.7%.

Two things worth saying about that number in a board paper.

It's a customs figure. It counts goods that crossed a border and got inspected. It doesn't count a listing that sells 400 units from a warehouse inside your own market, and it doesn't count digital-only harm like reviews or search displacement at all. Treat it as a floor on physical trade, not an estimate of your exposure.

And it predates the change that makes this a 2026 agenda item rather than a 2019 one. Buyers now ask AI assistants where to buy things, and an assistant returns one recommendation rather than 10 blue links. A copy that would previously have had to win a search result can now win the whole answer, because it inherits your photographs, your product name and your credibility, and beats you on the one attribute a machine can compare cleanly. When the AI shopping assistant recommends the fake is the mechanism in full.

The seven questions

If you're sitting on a board, an audit committee or a risk committee, these are the questions that produce useful discomfort. I'd expect a well-run organisation to answer the first four from a report and to struggle with the last three.

1. How many listings copying our products were identified last quarter, and how were they found? The second half is the real question. "Customers told us" is not a control. A control has a schedule.

2. How many notices did we file, how many removals did we get, and how many of those came back? Four numbers. Filed, removed, contested, relisted. Anything less and you can't tell a working control from a busy one. The relisting problem explains why the fourth number is the one that matters.

3. Who signs the notices? A takedown notice is a sworn statement. In the US it carries a penalty of perjury under 17 U.S.C. 512(c)(3) and exposes the signer to liability for knowing misrepresentation under 512(f). The board should know that a named person reviews and files each one, and should be uneasy if the answer involves software doing it automatically. Human in the loop, done properly is the control design.

4. Do we have a written, public list of our official stores and authorised sellers? This sounds like a marketing question. It's a control. It's the artefact that lets a platform, a customer and an AI assistant tell your shop from a copy, and its absence is why most match reports are 80% noise.

5. What do AI assistants currently say when asked where to buy our products? Ask for the transcript, not a summary. If an unauthorised seller is named, that's a finding, and it's the sort that never surfaces in any existing report. How copycat listings leak into AI answers covers how to read what comes back.

6. Which of our product images can we prove we own? Commissioned shoots with copyright assigned, yes. Agency work under a licence, perhaps not. Supplier catalogue images, no. This determines which half of the catalogue is defensible, and it's usually never been audited.

7. What is our tolerance, and what happens when we exceed it? A risk with no stated tolerance isn't being managed. "Fewer than 10 live copies of our top 20 products at any time" is a crude tolerance and infinitely better than none.

What good looks like, without building a department

The failure mode in large organisations isn't underinvestment. It's that the work is shaped as a project, gets a budget, produces a 60-page assessment, and then has no owner on the Monday after the report lands.

What works is smaller and duller. One named owner, usually in brand or commercial rather than legal. A monthly report with the four numbers. A scheduled search rather than an inbox. A published list of official sellers, kept current. An escalation path to the platform's repeat infringer process once a seller has a documented history, because a pattern gets a different answer than a complaint.

Legal stays involved where it belongs: the contested notices, the registrations, the occasional seller worth suing. Legal should not be the detection layer. It's the most expensive possible place to put one.

On the detection layer, the realistic options are a service, a tool, or an analyst with a spreadsheet. Brand Protection Tools, which Verity AI runs, is the tool version: scheduled search, scoring, evidence capture, notice preparation, and status tracking through Filed, Removed, Counter-notice received and Came back, with the confirming and filing left with the brand owner. Plans run from 99 to 499 dollars a month with an Enterprise tier above that, which for most organisations is well inside the threshold where it needs a business case rather than a procurement cycle. It searches Etsy and Alibaba.com today, with other platforms listed as next or planned rather than live, and that distinction is one to press any vendor on.

For an organisation at the smaller end, or a brand team running this without a budget line, brand protection on a small brand's budget is the same control set stripped to what one person can sustain.

The honest version of the board conversation

The newest non-executive asked a second question, which was better than the first.

"If the answer is zero, is that because it isn't happening, or because we aren't looking?"

That's the question. A quarterly report showing 3 copies found and 3 removed is a good report. A quarterly report with no number is not a reassuring absence of risk, it's an absence of a control, and those read identically from the boardroom until something goes wrong in public.

Start with a count. One product, one scheduled search, one honest number next quarter. The register entry can be drafted after you know what you're writing down.