The litigation risks of deploying AI and how to minimise them

1. What is Generative AI?

Artificial intelligence (“AI”), in one form or another, has been around for decades. It is the advent of generative AI – such as that used by ChatGPT – which has propelled AI into the public consciousness. Several similar large language model (“LLM”) systems are now available and appear to draft intelligently, can form images and videos from text and automate increasingly complex processes. It is hoped that significant efficiency and productivity gains may accrue to those who weave the latest generative AI tools into their businesses.

As AI becomes more pervasive, it is increasingly important for businesses to consider what litigation risks may arise from its use.

2. Regulation of AI – A patchwork of approaches

The use of AI by businesses – or to be more accurate, the outcome of its use – is already regulated in the UK to a degree. For example, if AI is used to process personal data, UK GDPR will apply. The current UK government, taking a pro-innovation line, adopted a principles-based sectoral approach to regulation, relying upon existing regulation and supplementary guidance. You can read more about this approach in our article “The Shifting Sands of AI Regulation”, which outlined the five overarching principles to guide that regulatory framework.

The UK’s 5 AI principles

Safety, security and robustness

Transparency and explainability

Fairness

Accountability and governance

Contestability and redress

To help businesses understand how existing regulations might apply to AI-use cases, regulators from various sectors were asked by the UK Government to publish an update outlining their strategic approach to AI by 30 April 2024. The Information Commissioner’s Office (ICO) published guidance from a data protection perspective and the Competition and Markets Authority published its strategic approach focussing on competition risks and risks to consumers. Most recently, the Financial Conduct Authority, the Prudential Regulation Authority and the Bank of England have issued their respective guidance, which you can read about in our article of 3 May 2024.

While this sectoral approach allows for flexibility and adaptability as generative AI continues to evolve, it is not without drawbacks. There may be inconsistency of approach between regulators, with consequent complexity and confusion. Not to mention the differing approaches internationally. For example, the EU’s AI Act, in contrast to the UK’s current approach, takes a holistic approach to the regulation of AI, regulating the technology itself, and introducing a framework applying a tiered, risk-based approach.

What’s more, with July’s general election, the regulation of AI in the UK is in a state of flux. If the opposition Labour Party forms the next government, there may be a shift in approach towards legislating for AI. All of these uncertainties give rise to litigation risk.

3. So what should businesses be thinking about?

With the inconsistency and ambiguity which will probably remain for some time, we set out – at a very high level – some potential areas of litigation risk for businesses to be aware of.

3.1 Intellectual property ownership and infringement

Generative AI raises a host of complex intellectual property (IP) issues under existing legislation, which provide fertile ground for disputes. Firstly, there may be questions around ownership of the AI’s output – does it belong to the supplier of the AI system or to your organisation? Secondly, generative AI is trained on data. If the AI’s training data is protected by IP rights, then the training itself, and the use of the output of AI, may give rise to liability.¹ Thirdly, generative AI may also learn from, and reuse, data inputted as prompts. So, if employees are inputting confidential information or information protected by IP rights, that may also give rise to litigation risk.

Where liability for IP infringement ultimately lies – for example, as between the provider of AI software and the user – is still quite uncertain and will depend significantly on the facts of each case.

3.2 Data protection

If personal data is processed in the training or use of an AI model, including when employees input prompts, in breach of privacy legislation (for example, without a lawful basis or in ways that individuals would not reasonably expect and/or that they have not been made aware of) then there is a risk of enforcement action by regulators as well as of compensation claims from data subjects. The ICO has taken action against Clearview AI Inc² in respect of facial recognition technology, and issued a preliminary enforcement notice against Snap over an alleged potential failure properly to assess the privacy risks posed by its generative AI chatbot.³

3.3 Automated decision making

It is contrary to UK GDPR, subject to exceptions, for an organisation to allow AI to make decisions, without any human involvement, that have a legal or similarly significant effect on individuals. The ICO gives, as examples, automatic refusal of an online credit application or e-recruiting practices.⁴ Given advances in generative AI, it is important to consider whether this is something which might be occurring in businesses across a broad variety of sectors.

3.4 Bias

There are well-documented issues with bias occurring in the output of some generative AI models. This can occur due to pre-existing bias in the data upon which the AI is trained. A recent UNESCO report has identified instances of generative AI making links between gendered names and careers, generating negative responses to prompts related to LGBTQ+ individuals and women, and assigning stereotyped professions to different genders and ethnic groups.⁵ It is possible that any bias exhibited by AI systems used by businesses may result in discrimination claims under the Equality Act 2010. This could also give rise to employment disputes.

3.5 Errors

Another well-documented issue for generative AI models is the existence of hallucinations – or, less-euphemistically – the generation of wholly fictitious output. Alongside obvious liability which can arise from errors (for example, contractual liability), there may also be liability in professional negligence, misrepresentation or defamation. Very small errors may go unnoticed by human reviewers but may have a large impact. Interesting questions of contract law may also arise where a business’s chatbot makes an erroneous promise to a customer – for example, to sell a product or service vastly below market price. Conversely, one can also foresee in the future examples of non-use of AI potentially giving rise to a professional negligence claim, for example, if something goes wrong and AI has not been used in circumstances where its use has become standard practice.

3.6 AI-washing

There are numerous businesses claiming to be using AI when advertising their services. If they are not using AI, or not using it to the extent they imply, then they could be a risk of ‘AI-washing’. In March 2024, the Securities and Exchange Commission (SEC) in the USA released information about two settled enforcement actions for AI-washing against investment advisors.⁶ In England and Wales, such liability could potentially fall under misrepresentation, consumer protection laws or securities regulations.

4. Where does that leave us?

The potential benefits to businesses of introducing generative AI software are enormous. However, as is often the case with new technologies, the risk situation is still very uncertain and continues to develop. So, there are steps which businesses can take to mitigate the litigation risk around AI-use. For example:

Undertake an AI-mapping exercise to understand precisely where and how AI is being used in your organisation, to be followed by risk-assessments encompassing the risks highlighted above to determine whether the use of AI is appropriate in your business.
Carry out due diligence on AI systems provided by suppliers: interrogate AI-providers on what data their model has been trained. For example, is it high quality? Is there any risk of copyright infringement? What validation is used for accuracy and bias?
Put in place clear contracts with suppliers of AI systems setting out, for example, whether the provider can access and use your data to train their model, who is going to own the IP in any output, and where liability should lie for particular issues. Consider whether it is appropriate to seek an IP infringement indemnity from the provider.
Keep a record of decisions made around the use of AI and the risk assessments. An audit trail will be very helpful in the event of a dispute arising.
Publish clear guidelines on the use of AI by staff to guard against the input of confidential or proprietary information or personal data into AI. Ensure that there is human oversight of the output, to check for errors and bias. Consider also the appropriate limits on the purposes for which AI can be used, particularly in light of risks such as hallucinations, IP infringement and breach of data protection laws.

Please get in touch with our team should you require any advice on mitigating risk or potential disputes arising from the use of AI.

Footnotes

Note the proceedings brought in the UK’s High Court by Getty Images against Stability AI Ltd which, in broad terms, alleges infringement of intellectual property rights 1) by the scraping of millions of images from Getty Images, without consent, and using those images to train AI which is made available to users in the UK, and 2) because the output of the AI, in the form of synthetic images, reproduces a substantial part of works protected by copyright and/or bears trade marks. ↩︎
Information Commissioner seeks permission to appeal Clearview AI Inc ruling | ICO. ↩︎
UK Information Commissioner issues preliminary enforcement notice against Snap | ICO ↩︎
Rights related to automated decision making including profiling | ICO ↩︎
UNESCO, IRCAI (2024). “Challenging systematic prejudices: an investigation into Gender Bi in Large Language Models“ ↩︎
SEC.gov | SEC Charges Two Investment Advisers with Making False and Misleading Statements About Their Use of Artificial Intelligence ↩︎

Key contacts and authors

Huw Jenkin

Partner, Dispute Resolution

David Bufton

Senior Knowledge Lawyer, Dispute Resolution

Joseph Moore

Partner, Dispute Resolution

Helen Reddish

Knowledge Counsel, Technology & Commercial Transactions