The rapid advancement of intelligent technologies and the widespread application of artificial intelligence across various domains have raised fundamental questions in the field of cyber law. One of the most significant issues concerns the ownership of data generated by AI systems, which is crucial not only in the realm of private law but also in terms of public law and national sovereignty. The main research question of this article is to determine the legal status of AI-generated data in the Iranian legal system and to propose an appropriate framework for its ownership. The necessity and importance of this study stem from the fact that data, as the key asset of the digital economy, play a decisive role in the political and economic power of nations, and the absence of a clear legal framework may result in the violation of users’ rights, the monopolization of big tech companies, and threats to national sovereignty. The primary aim of this article is to explain the legal foundations of ownership over AI-generated data, analyze the existing gaps in Iranian law, and propose reformative solutions in light of international experiences. The research method is descriptive–analytical and comparative, relying on documentary study, examination of domestic laws, judicial opinions, and international instruments. The findings reveal that although Iranian laws, including the Civil Code, the Electronic Commerce Act, and the Computer Crimes Act, have addressed the protection of data, they remain silent on the ownership of machine-generated data. Moreover, Iranian judicial practice has no precedent in this regard, focusing only on the admissibility of electronic data as evidence. Comparative analysis shows that advanced legal systems such as the European Union, the United States, and China, despite taking steps toward data protection, have not yet provided a definitive answer to the question of AI-generated data ownership. The novelty of this article lies in proposing a hybrid approach whereby the ownership of AI-generated data should be designed in a multi-layered and conditional manner to simultaneously safeguard users’ rights, clarify companies’ responsibilities, and strengthen national data sovereignty.