Embracing AI in Business: Benefits, Legal Risks & Mitigation Strategies

• Intellectual Property: AI can raise questions about intellectual property rights, particularly with AI-generated content or inventions. Companies must navigate the complexities of ownership and copyright in the context of AI. AI systems often require large amounts of data that they are trained upon to be able to analyse and deliver comprehensive outputs. The quality of the data used is important to ensure that the resulting outputs are high quality.  Where the data used to train the AI is sourced from third-party materials, there may potentially be copyright issues in relation to the copying or use of those protected materials. Issues may arise from the machine learning process itself, from users uploading copyright materials into the system, which generates works based on that material, or from the output resembling copyrighted works.  If the appropriate licences are not in place from the owner of the copyrighted works, the use of the outputs generated by the AI system may result in copyright infringement.
• Data Privacy and Security: AI systems often require large amounts of data, raising concerns about data privacy and security. Where the data being used by the AI system involves personal data, GDPR requirements will need to be considered. Unauthorised access or misuse of personal data by the AI system can lead to legal repercussions and damage a business’s reputation.
• Accuracy: AI systems can generate inaccurate outputs, particularly generative AI models. Models trained on inaccurate or incomplete data are more likely to produce inaccuracies (also known as hallucinations). Therefore, it is important to consider the quality of the data sources used to train AI models. An AI system that ends up providing poor-quality outputs may end up being costly for a business and lead to a potential dispute with the supplier.
• Liability Issues: Determining liability when AI systems malfunction can be complex. The “black box” nature of AI, where decision-making processes are not always transparent, can make it difficult to pinpoint responsibility when something does go wrong. Without a tightly drafted contract, an AI supplier may seek to avoid liability when something goes wrong, leaving your organisation without a satisfactory remedy.
• Regulatory Compliance: If your business operates in a regulated sector, it is important to ensure that any AI product or service used complies with applicable regulatory requirements.
• Bias and Discrimination: AI algorithms can inadvertently perpetuate biases present in training data, leading to discriminatory outcomes. This can result in legal challenges and harm to a business’s brand image.

• Carry out pre-contractual due diligence: Before procuring or investing in an AI solution, organisations should undertake appropriate due diligence to ensure that the proposed solution is suitable not only for their business requirements but also that it complies with applicable UK laws and regulatory standards. At present, whilst there is no specific legislation that regulates use of AI in the UK, our framework of existing laws – such as data protection law and intellectual property law – remain very relevant to its use. Pre-contractual due diligence should therefore look not only at the AI tool’s functionality but also at legal, regulatory and reputational risks.
  With that in mind, potential suppliers should be asked to provide information regarding the AI system’s functionality, to assess whether its performance and limitations make it suitable for the organisation’s business needs. The solution’s security measures, governance arrangements and compliance controls are equally important, however, as these will help identify any legal, regulatory and compliance risks associated with the AI solution.
  
• Comprehensive AI contracts: Once an AI supplier has been selected, organisations should ensure that an appropriate contract is in place, to allocate responsibility, as well as risk. If there is a bespoke development element in the supply of the AI solution, then this should be detailed in the contract, with appropriate milestones and acceptance testing provisions included. Similarly, the contract should clearly delineate responsibilities for the deployment stage of the project and include assurances regarding not only performance of the solution but also legal and regulatory compliance. Thought should be given in particular to data protection and information security, as well as ensuring that the organisation is able to use the AI outputs for its business, without risking infringing third party IPR. Appropriate indemnities should be included to reinforce critical commitments made by the supplier and to allocate risk where the customer would otherwise be exposed.
• Implement Responsible AI Practices: Undertake regular audits of AI systems to ensure they operate fairly and transparently. Monitor for biases and make necessary adjustments.
• Ensure Data Privacy and Security:  AI systems should be designed to minimise the use of personal data and comply with data protection requirements.  The AI system should implement robust data protection measures to safeguard sensitive information, including encryption and access controls. AI systems should be designed to assist the user in complying with data subject requests such as requests for information or data deletion.  It is often sensible to undertake a data protection privacy assessment when considering the use of an AI system that will process personal data to help evaluate and assess the risks and mitigations. Once the AI system is in place, undertaking regular data security assessments can also be helpful to identify and mitigate any issues.
• Develop a Comprehensive AI Policy: A well-defined AI policy outlines ethical principles and guidelines for AI use within the organisation. It should address data privacy, intellectual property, bias mitigation, and transparency.
• Establish Clear Accountability: Define clear roles and responsibilities for AI development and deployment to identify who is accountable within your organisation in case of AI-related issues.
• Engage in Continuous Learning and Improvement: Continuously monitor and update AI systems to adapt to new challenges and improve performance. Stay informed about regulatory changes and industry best practices.

How can we help?

For more information about AI and its use in business don’t hesitate to get in touch with a member of our expert Commercial Team in Derby, Leicester or Nottingham. Please contact the team on 0800 024 1976 or via our online form.