By Kiley Tan
Artificial Intelligence, neither intelligent nor magic, is all about machine learning, neural networks, chain of thought, decision trees, random forests, regression, correlation, matrices and data sets. It’s mathematics! And it’s developing rapidly – there is data in abundance. Here are some mind-blowing or mind-breaking (depending on how much you love numbers) facts for you: 149 zettabytes of data were created, captured, copied and consumed in 2024. By the end of 2025, this will have risen to 181 zettabytes. A zettabyte is a massive unit of digital storage capacity, equivalent to one sextillion bytes, or, in more visual terms, the same as storing 250 billion DVDs.
AI is not necessarily ‘new’. You may have already encountered it in your everyday life with, for example, weather forecasting, lane and drive assistance, automated driving, online translation, recommendation systems (e.g., Netflix) and content summaries.
So, basically, it’s everywhere, getting more sophisticated and cannot be ignored. For businesses, what does this signify, what are the legal considerations and how should they be addressed?
AI and Data Privacy Compliance
We’ve already established AI’s capacity to handle data, but the onus remains on business owners to hold and process that data ethically and legally. Here are some important areas to consider:
- Regulatory Compliance: Ensure AI systems comply with UK GDPR and other relevant data protection laws.
- Data Processing: Implement policies on how personal data is processed. Who is the processor? Where is the data stored?
- Risk of Data Breaches: Employ robust cybersecurity measures to mitigate data leaks.
- Automated decision making: Any automated decision making that concerns people and creates a ‘legal effect’, like completely automated systems for time keeping and absence monitoring, are prohibited under UK GDPR. (There are exceptions to this including electronic contracts.)
Businesses breaching data protection legislation face significant penalties, including fines and reputational damage, so it is worth bringing in legal support to ensure your personal data is handled fairly, lawfully, and transparently.
IP and AI Generated Content
AI has an increasing role in both technical and artistic creativity and creation. UK legislation is attempting to provide the right incentives to promote this innovation whilst protecting human inventions and creative works. This can become very complicated! If you’re generating content with AI, or using AI-creations in your business, you should be able to answer the following questions:
- Does any of the content you generate rely on text and data mining belonging to someone else without their permission? Be aware, this is not permitted in the UK for commercial purposes, under s. 29A Copyright, Design and Patents Act 1988.
- Are you being ‘mined’? Is your work or output being mined without your knowledge? Increasingly, we see the use of confidentiality agreements (or NDAs) in preventing text and data mining.
- Do you know who owns the AI model a business commissions? Is it the business or the developer?
- What about the content these AI models generate? In IP law, protection only applies to works created by a person.
- Are you aware of third-party data & IP? Are any AI models you use unlawfully incorporating copyrighted or proprietary data without permission?
- Do any AI-generated inventions in your business meet the legal requirements for patent protection?
If you want some more information, these implications are discussed in more depth in previous blogs I wrote with my colleague Sophie Freeman: Artificial Intelligence and Text & Data Mining and IP Rights and the AI Minefield. A lawyer with IP experience can help you navigate this complicated area, both in terms of protecting you against infringement and infringing, and in terms of maximising the potential value of any AI-assisted creation.
AI Risk Considerations
Any business looking to exploit the potential of AI needs to be mindful of the risks.
- Liability: Accountability for AI must be established. What is the chain of liability for the AI model?
- Bias & Discrimination: It’s important to regularly audit AI models to prevent unfair treatment based on race, gender, or other protected characteristics. Other unprotected characteristics need to be rooted out.
- GDPR non-compliance: AI-driven decisions in contracts (e.g., lending, insurance) must comply with GDPR for consumer protection.
To mitigate the risks, implement AI internal-use policies, conduct regular compliance audits, and have clear human oversight mechanisms.
Contracting (for AI development)
Clarity in contracting is vital. Ensure that the contract sets out what you can expect – there should be clear deliverables. Establish who owns the model. Is it a development with a bespoke model or are you using a background AI solution (such as OpenAI)? Is the model licensed?
You need to think about maintenance as well. AI models can be expensive to maintain due to the use of computing power and new data. And find out about improvements. New data changes the model, and development may be needed to improve the model over time.
Other considerations
AI is developing so quickly, it is not always easy to anticipate all the ramifications of implementing AI automation.
One consideration to bear in mind is the potential devaluation of your business – AI automation may reduce the perceived value of your services or works. Similarly, there is a risk to commoditisation. Should AI make a service widely available at a lower cost, businesses may struggle to justify premium pricing.
Some customers may be sceptical of AI-driven services, fearing bias, errors, or impersonal interactions. Transparency in AI use is a must therefore and we advocate clearly communicating AI’s role to help build trust.
Also, despite the fear, AI does not replace humans, so always keep human in the loop. Position AI as an enhancement rather than a replacement, ensuring customers see the value in human oversight and expertise.
If you would like any help exploring AI opportunities and putting in place measures to mitigate the legal risks, please get in touch on info@thelegaldirector.co.uk or 020 3056 8538.
