Should Your Business Have an AI Use Policy?
The rise of generative AI engines such as ChatGPT and Bard has already had a considerable impact on the way that many people and businesses generate work product, reports, e-mails, social media posts, and a wide range of other content. These tools have the potential to enhance efficiency and productivity, but also carry significant risk for businesses that must be considered and mitigated by implementing a policy governing use of generative AI tools in the workplace.
What are the Risks of Using AI in Business?
Use of generative AI in business creates several areas of risk, including issues surrounding the accuracy and quality of the content produced and issues involving data privacy and intellectual property rights.
Incomplete, Inaccurate, or Biased Output
Generative AI tools have a known risk of providing incomplete, inaccurate, or biased output. Such output can be the result of the data used to train the tool or a “hallucination,” in which the AI tool provides a confident response that is completely fabricated by the tool and not true. In the legal field, for example, there was a recent and widely publicized case in which a lawyer used ChatGPT to prepare a court filing, and the output was a hallucination that cited court cases that didn’t exist and were fabricated by the AI tool to support the legal argument.
Data Protection and Privacy Issues
Entering information into a generative AI tool has the same risks and liabilities as sharing that data with any third person. Such information is shared with the company that operates the AI tool, is typically used to further train the tool, and may also be shared with other third parties pursuant to the terms of the AI tool’s terms of use and privacy policies.
Such third party disclosure could expose confidential information and trade secrets to third parties and could also cause regulatory or other legal liability for protected consumer data in the healthcare and finance industries or privileged information in the legal industry.
Intellectual Property Issues
The legal issue of whether use of copyrighted data used to train AI tools infringes the rights of the copyright holder and thus requires a license to use remains unresolved (see our recent blog post on that topic). In addition, issues regarding who (if anyone) owns copyright to the content produced by the AI tool remain in flux, although to date the US Copyright Office and courts have made clear that content that is 100% created by a non-human actor such as an AI tool is not protected by copyright (see our recent blog post on that topic).
Thus, there is a risk that use of generative AI in your business may violate the intellectual property rights of others, and that you may not own copyright to the content generated by the AI tool.
What Should an AI Use Policy Include?
A business AI use policy should include:
Clear definitions of the the types of AI tools, types of data, and categories of people covered by the policy.
The identity of the department(s) and/or person(s) responsible for implementing, answering questions, making decisions, and enforcing the policy.
Parameters of the acceptable use of AI tools.
Procedures to ensure that the use of AI tools produces accurate, complete, and unbiased output.
Restrictions on the types of information input into AI tools to ensure that privacy, security, confidentiality, and intellectual property rights are not violated.
Guidelines regarding the disclosure of the use of AI tools to internal and external stakeholders.
Training requirements for those who use AI tools.
Methods of enforcement and consequences of violations.
Regular update intervals for the policy as the technology and law continue to evolve.
We regularly counsel clients on AI related issues, intellectual property, and data privacy laws. If you have questions about or want to create and implement an AI use policy for your business, feel free to contact us.