Introduction

Hi again, so I'm Natasha.

I'm a partner at This Here Law Firm.

I'm in the tech transaction team, which in English means I work on commercial contracts, IP, data type transactions.

I am going to talk to you about law, but I'll keep it brief.

Legislative Landscape: UK and EU

What we'll cover in the next 10 or so minutes is I'll give you a quick update on the legislative landscape in the UK and the EU.

And then we'll talk about these key legal risks that we talked about.

And then we're going to try and figure out how you can take steps to mitigate against those risks in your business.

Updates in UK Legislation

So kicking off with what is happening with the law, if we talk about the UK, the answer is not so much.

So the UK's approach, you say yes, but yeah.

So the UK has decided not to introduce any new AI specific legislation, which

Maybe sounds great.

We don't have to worry about the law, but actually no.

So the UK government, what it's going to do is issue guidance to our existing regulators.

So the ICO, the FCA, the other three letter acronym organisations out there.

And it's going to put the obligation on them to come up with sector specific guidelines.

Why that makes it a little trickier in the UK is now you have to keep on top of what all of these different regulators are putting out there.

They've got a deadline of, I think it's the end of next month, actually, to issue their initial guidance so we can see what they come out with.

The ICO is kind of ahead of the game.

They've already been doing things from their AI data privacy perspective.

So if you go on their website, you can see what they're saying already.

So let's watch this space, see what those guys come out with.

EU's New Legislation: The EU AI Act

The EU has taken, I think you probably all know, taken a very different approach.

They have got a new piece of legislation, the EUAI Act.

That's probably going to come into force relatively soon.

So it's just been approved by all the member states, EU member states, as of last month.

It has to jump through a few more hurdles before it's approved.

And then we'll see what that has to say.

Really quick overview on what's going on on that perspective, two very different approaches and I guess only time will tell whether the UK's approach which is supposed to be very flexible and the thinking there is that this technology as we all know is developing at a rapid pace and the thinking is if you come up with some legislation today is it going to be out of date tomorrow.

On the flip side, the EU's gone for that legislation approach, and their thinking is actually we can set some really clear requirements, obligations on anyone who's building these AI products, et cetera, so you know what it is you need to be thinking about them doing.

But time will tell who picked the best approach, who wins that little race.

Key Legal Risks in AI

IP Infringement and Data Use

uh okay so on to onto the legal risks and and things that we need to think about um i'm going to keep this relatively high level there's so much we could talk about i'm going to focus on ip because that's what i do so copyright infringement is the big question mark at the minute and and really what we're talking about here is

the use of vast amounts of data to train these AI models.

1A lot of that data may be protected by copyright and other IP rights.

And the question that a lot of courts in the US are looking at, and there's some cases going on in the UK as well, is does that training, that activity, amount to copyright infringement of all that material?

The answer may be different in different territories, just to keep things really interesting.

What's happening in the UK at the minute, so the original or old legislation which was not created with AI in mind, but the general position is if you copy or use somebody's copyright protected work without their permission, that's copyright infringement.

There are some exemptions and exceptions in the UK law.

um the text and data mining exemption is one that you may or may not have heard of but it means that that kind of training activity wouldn't infringe copyright but only if you're doing that in a non-commercial use case which is not so helpful to a lot of people in the room the government was looking at expanding that exemption which would have been really helpful but they backed away from it because the creatives did not appreciate that which was pretty understandable

The next thing they looked at, the UK government was going to come up with this voluntary code of conduct, so that was supposed to protect the copyright owners, so all the authors of these creative works, versus the AI developers, so to make life a little bit easier for them to work together, so maybe to enter into license agreements more easily, etc.

That has fallen away as well.

Take three is they're looking at some other solution.

I don't know what it is yet, but let's watch the space.

But I think the lesson here is that the government is clearly keen to make this work.

So we're keeping an eye on what happens then.

We're also keeping an eye on the case developments in the UK.

And the big one right here is Getty Images' broad claim against Stability AI from an IP infringement perspective on all the images that Getty owns.

So we'll see what they say about that.

Ownership and Rights of AI Outputs

What does it mean for people who are using these tools right now?

What do you do?

Do you avoid it altogether because of the scary IP infringement risk, maybe?

But actually, what we are telling people to do right now is look at the terms and conditions of those third party AI providers, those tools, because they will have a position there.

And a lot of them are now, a lot of the bigger ones anyway, more prominent ones are saying,

we the ai company we will indemnify you the user against any third-party infringement claims that somebody might bring against you which is wonderful if you're a user you now don't have to worry about that infringement risk wonderful if you're using one of those tools that offer that indemnity but you need to check the terms because they're not all doing that so that's that's a point on the ip infringement risk we've also got a big question mark again focusing on ip and copyrights around the output so

you're using this tool within your business say you're creating some wonderful marketing content so there's some text being generated there's some images etc you're really proud of this final piece of output that you kind of created using whatever it is you used um you might go off thinking brilliant i can now stick this on my website i can i don't know send off loads of emails do whatever i want with it but the question is actually can you so do you own that output

There's a big old question mark over that as well in the UK at the minute.

So at least we have figured out in the UK, generally speaking, or we're just quietly aligned, that there is a potential for IP ownership to sit over these outputs.

1So position might be different in the US, but in the UK we're saying computer generated works may attract copyright protection.

Great.

But the question then is who owns that copyright protection?

Who owns the IP in those outputs?

And that's the question we don't know the answer to.

So it could be the AI developer, actually.

Maybe they own that output of yours, in which case, what rights do you have to do with it?

What can you do without the developer saying, didn't say you could do that.

On the flip side, maybe you own the output, which is wonderful.

But actually, maybe the vendor has rights to use that output as well.

That's wonderful.

Maybe the original author who

created that work that then trained the model has some rights because actually this image looks a lot like their original artwork that was used to train the model.

So we don't know what the answer is.

So what are we doing right now?

We're looking at the terms.

So the vendor T's and C's again, the AI model developers will say something or they should say something in their terms about who owns the IP rights.

If you own it as the user, it should say something about whether the vendor themselves have a right to use it or not.

So something to look out for.

Okay, so that's talking about IP.

What else are we going to talk about?

Privacy, Confidentiality, and Cybersecurity

Just rushing through all of this, but privacy.

So your little chat GPT already dealt with privacy.

Privacy issues.

You need to think about that.

So loads of issues here.

But we can talk about the sort of the infringement of people's personal data rights.

So

thinking again about the data going into the training of the models.

What is that?

Do people have privacy rights over it?

Is there a bunch of personal data going in there?

What does it mean for you as the user in terms of the output?

So we have to query all of that.

There's also a question around

Confidentiality, and it also ties into the privacy point as well, but you as the user of the tool, what data are you putting into the tool?

What materials are you putting in there?

Are you using your own confidential information?

And if so, is that something you want to do?

Are you using one of your customers?

Are you using your customer's confidential information?

Is that something you want to do?

Is that something you're allowed to do?

And also, again, look at the terms because some of these AI tools will say that the vendor has a right to use that information that you're feeding into their tool.

probably to train their product, their models.

But again, if you're using your customer's confidential information to create this output and to train these AI models, is that really something you've got any kind of permission to do?

So you need to think about all of these things.

We can also touch on

I mentioned hallucinations.

Keep an eye on what you're doing with this output.

If you're a lawyer going to court, do not put this case, which happened.

I don't know how.

Don't put this completely made-up case law in front of the judge, because you're going to get in trouble.

So think about what this output is.

Put some human interaction into the human oversight.

Maybe use it as your starting point for some research or something.

But have a think about that.

Also think about cybersecurity issues.

Lots of questions coming our way from companies who want to use AI models for code generation.

And so there's loads of issues there.

There's the potential IP infringement risk.

But there's also, is this code secure?

Is it vulnerable to viruses and all sorts of other security issues?

So yes, another thing to think about.

Mitigation Strategies and Tips

Other issues, which I find fascinating, probably don't have time to touch on here, but all the bias issues, the ethical issues, the human rights issues around using these tools, also really worth considering.

So those are all the problems.

The end.

What can you do?

Some people are really risk averse and don't really want to go there until they know what they're doing or what the law says.

You might be missing out if you take that approach.

There are things you can do from a practical perspective to reduce the risk.

So I've said several times here, look at the vendor T's and C's.

That's a great place to start right now when we don't know what the law is on these points.

Look at not only the stuff that we talked about around IP ownership and infringement indemnities, but look at the liability clause.

Look at what kind of warranties and other provisions they've got in there.

What kind of protection do you have?

And sort of vet the vendor themselves as well.

You can ask them some questions about what policies they have internally to make sure they're mitigating these risks and what data are they training their models on.

If they're just using public data out there, there's some risk there.

If they're using proprietary data that they own and they know there's no risk there, then wonderful.

That reduces the risk for you as the user as well.

On the flip side, check your own terms and conditions with your own customers.

So all the stuff that we talked about, the vendor may try and limit their liability and may try and protect themselves.

Turn it on its head, you need to protect yourself against your customers, so limit your liability.

Maybe include some disclaimers here and there.

It totally depends on what you're doing with this AI, whether it's the tool, whether it's the output or whatever.

make it clear to people that maybe you generated this content using AI and they should not rely on it at all or that kind of thing.

It really depends on the content.

Don't rely on anything I say.

I'm not going to be liable for any of this.

So there's that stuff to think about.

What else can you do?

So internal policy is a big one, and it's one that we're really encouraging companies to put in place.

A lot of companies come to us saying, oh, we're not really using AI tools in our business at the minute.

your staff probably are you just don't know about it so really good idea to have some kind of policy in place and you might you know you could go to town and have something really detailed or you could just have some high level points maybe you've decided as a business you're really okay with these third-party tools so you say these are on our approved list go nuts do what you want you may go the other side and say we don't want you using ai at all in these specific circumstances

you may have escalation processes or you know this is the generated content now it has to be reviewed by this person or that team whatever there's lots of different things that could go into a policy but it's just a really good idea to have one and and what sits hand in hand with that is the internal staff training as well just to make sure everyone knows what this policy is talking about what you're talking about they understand all the legal jargon all the rest of it but

and then and then can't not say stay aware of the law keep abreast of what's happening um and and as i said it's not just ai law it's literally all of the regulators in the uk are going to be doing their own thing now so see what they're all up to come to your local friendly lawyer and ask them or just check our website we'll send out little updates from time to time um that's it that was a pretty quick whiz through there's a lot we could go into the happy to answer any questions or i'll be around for pizza for sure

Questions and Answers

Yes.

So my question is around the copyright arena.

So you talked about the training data set.

And you covered both what data's in there and the copyrights of data that's produced.

What about when you're using, so the example, the second demo, we were giving it some data to ground the LLM and we were producing some output.

Okay, fair enough.

In that demo, it was like a learning exercise is kind of internal, but if you're doing something like creating marketing content or something that's gonna be published,

Is that what you said earlier about the training data?

Does that still apply exactly or is it different?

So you mean using information from websites to come up with an output?

Yeah, so if I give you a bit more of an example.

So if you created a GPT that was based on... So it's like a coach that was based on somebody's blog.

So it's like Paul Graham's blog is a popular one.

Or it could be like, you know, take any expert in a field.

They have blog posts that...

you know, captures their knowledge, you use that as the knowledge and you do, you know, retrieval augmented generation, basically.

And then you publish that.

Yeah.

And, you know, users may publish it, they may just use it to learn, but they may kind of then take that content and publish it or do other things where, like, how should we think about that?

Yeah.

And again, it comes down to is there copyright in the initial material that's going into the training data and the training materials and then

The position based on old law that was not created with AI in mind, that could be copyright infringement.

Yes, because you're using somebody's copyrighted work without their permission.

It doesn't fall into the TDM exception of it's just in turn like non-commercial purposes potentially anyway.

So there is a risk.

And in the UK, that's pretty much like, unless it says it's like...

whatever open domain or whatever, it's copyrighted by the person by default?

Is that kind of... Not necessarily.

There's certain criteria you need to meet for something to be copyright protected, but it's not the highest bar.

It doesn't need to be something crazy innovative or anything.

But yeah, as I say, there's the case going through at the minute, going through the courts, the Getty Stability AI case, and we'll see what they say because they might come up with some definitive answers on this point.

But in Getty's case, all of Getty's images are strictly copyrighted, and they're pretty strict on that stuff, which is different from somebody's blog that's out there on the internet that Google has indexed.

Maybe not.

I know.

There's often a misconception of, oh, if it's out there and I can just find it on Google, it's fine.

But that's not necessarily the case.

Yeah.

All right.

Thank you.

Thank you.