Artificial Intelligence

Potential Pitfalls

Companies developing artificial intelligence offerings face a number of legal challenges.  They may license enterprise software, offer AI software as a service, or integrate AI technology with a robot or other hardware or firmware. 

Legal Risk

First and foremost, companies offering AI want to manage legal risks. They don’t want to sell a product or service that would put their entire business at risk due to liability from an accident or other mishap. Juries in the U.S. have historically awarded very large amounts against companies they perceive have failed to protect consumers and the public. Companies may pay out large sums in numerous cases to settle claims against them. Verdicts and settlements in some industries have driven manufacturers into bankruptcy. Executives in AI businesses developing AI seek to manage their legal risk to prevent company-ending liabilities.

Artificial Intelligence Risk

In the AI field, besides accidents or the product or service failing to work as intended, executives are concerned about AI-specific legal risks. Customers are going to address two key concerns: explainability and bias. Customers will want to know how a particular AI system works and generates the results that it does before trusting it. Moreover, customers want to make sure the results generated by an AI product or service are not biased in some way. In either case, the lack of explainability or bias can cause legal risks for both the AI company and its customers. AI companies must also manage the legal risks associated with privacy and security. Breaches could lead to significant liabilities.

AI Contracts

Second, companies offering AI products and services need contracts – both with customers and their own vendors and service providers. Customer agreements are necessary to strike the deals needed to bring in revenue for the company. Startup executives know they should turn on the AI service or ship an AI-powered product without a written contract. So, for startups, the need to write a form of agreement is standing in the way between the company and recognizing revenue. Moreover, executives realize they can’t write agreements themselves or simply copy something from the Internet. Even if they wanted to use something from the Internet, many AI-powered products and services are so new and specialized that the Internet doesn’t have any “standard” form agreements they could use.

More established companies may have existing form agreements, but they need legal help to negotiate the deals each month, quarter, and year to meet their revenue targets. Executives come to expect that when they propose form agreements to sophisticated customers, lawyers for their customers are going to propose modifications to the language of the agreement to protect the customers’ interests. Executives also know that they shouldn’t simply accept what a lawyer for a customer proposes back. They need experienced counsel to help negotiate those modifications to make sure their interests are protected as well.

AI Compliance

Third, companies offering AI solutions may have to comply with laws specific to AI and related technologies.  Consider a few examples:

• The European Union’s data protection law, the General Data Protection Regulation (GDPR), requires companies to explain the results of automated data processing when personal data of the individual is used for that processing. GDPR also requires companies to have a human review such results of that automated data processing, for instance to catch mistakes made by the automated system.

• States have various laws governing when and under what conditions companies can test and deploy automated and platooning vehicles on public roadways.

• State and local laws govern the use of drones, to protect the privacy of property owners and prevent accidents involving other air traffic.

• California recently enacted a “bot disclosure law,” which makes it unlawful for a person to communicate online with the intent to mislead another person about a software bot’s artificial identity for the purpose of knowingly deceiving a person about the content of the communication.

If a company violates legal requirements, governments or individuals harmed by the violation may take legal action against the company, resulting in fines or verdicts against the company.  In the case of companies violating GDPR, the penalties can be as high as 4% of worldwide gross revenue of the company or €20 million, whichever is greater – a potentially huge number for multinational conglomerates.

AI Investigations

Fourth, AI companies must conduct investigations of accidents, data breaches, and other adverse events involving AI products and services. Companies experiencing these events may be liable for the event. Too, they have claims against other companies for contributing to the harm that may be lost if they don’t take prompt and effective legal action. Failing to preserve evidence from the event in the proper way may mean the company is unable to defend itself in a lawsuit or governmental action, or it may be unable to pursue its claims against others.

Control in AI

Finally, companies may lose effective control of AI systems, which may result in widespread harm. While concerns about Terminator movie-style scenarios about robot apocalypses are overblown in today’s world, AI systems may still cause accidents. Failures and breakdowns are a significant risk. AI systems may also be vulnerable to hacking attacks or personal data leakage. In the absence of robust governance mechanisms, AI companies may face liability resulting in fines, verdicts, or settlements.

Not only are companies developing and offering AI solutions at risk, but companies buying AI solutions are also vulnerable to legal issues. Companies procuring AI systems should mitigate their legal risk through the contracting process and anticipate what might happen if the acquired system fails to work as advertised or causes damage to themselves or others. The purchaser of a system may face legal liability when putting an AI system into operation. For instance, it may have its own compliance requirements to meet. If an accident, data breach, or other bad outcome occurs, it will need to conduct its own investigation. Finally, purchasers of AI systems will need effective governance of AI, just like manufacturers and sellers do.

AI companies that manage legal risks effectively focus on six high-impact areas.  First, they carefully manage the design of their products and services.  While any AI product or service should have features that customers want, and it should solve a compelling business problem, effective companies take careful steps during the design phase to ensure their products and services are safe, effective, and secure.  Their design process includes, from the very beginning, team members and analysis of safety, privacy, and security.

Risk Analysis

During the design phase, effective companies undertake a thorough analysis of the various kinds of risks they may face.  The take into account the universe of possible threats they may face, the likelihood of these threats coming to pass, and the magnitude of the harm that could result from these threats.  With an assessment of risk in mind, effective companies consider various controls that can stop or mitigate these threats in light of their capabilities and costs.  They prioritize the various threats they face and manage risk by implementing those controls that reasonably mitigate the most serious prioritized risks.

Legal Considerations

Second, effective AI companies consider from the beginning the laws that apply to them and legal compliance requirements they must meet.  Too many companies start developing, or even worse, start selling a product or service only to find out it is illegal, or doesn’t meet legal requirements.  At that point, they either have to redesign the product or service or stop selling it.  Effective companies find out what the law requires first, at the beginning of the design phase, and start their development with an eye towards complying with applicable laws.

Governance Control

Third, effective AI companies implement governance control on the types of AI products and services they are willing to offer or purchase and how they should implement them.  AI companies consider not only law, but also ethical and social implications of the products and services they sell or buy.  Focusing on or excluding some of them may be important to the company’s strategic vision.  Governance controls not only mitigate legal risk but also prevent the loss of reputation caused by products or services that harm purchasers or the public.

Effective companies implement controls governing AI using policies, procedures, and subordinate documentation.  Policies set the high level goals of controlling AI and managing risks.  Procedure documents give managers and workers step-by-step instructions to meet these goals.  Companies may also have guidance documents to provide additional details on meeting policy requirements.  In addition, they may have technical standards documents to specify the technologies they use to meet their goals.  Finally, companies should have training materials to explain to the workforce how to meet policy goals.

Intellectual Property Design

Fourth, AI companies should consider intellectual property issues at the very beginning of the design process.  As with compliance, companies will not want to invest in developing a product or service only to find out that another company has patents or other intellectual property rights that cover the product.  Proceeding with developing and marketing the product or service could trigger a lawsuit.  Similarly, effective AI companies design products and services with a view towards maximizing the scope of their own intellectual property rights.  By designing in a certain way, they may qualify for protections that they otherwise might not have, thereby giving them an advantage over competitors.  Intellectual property includes patents, trademarks, copyrights, and trade secrets.  Each kind of IP helps the company protect its business, gain a competitive advantage, and meet its business goals.

Contractual Agreements

Fifth, once a seller is ready to offer the product or service is ready to sell (or a buyer is ready to make a purchasing decision), the company uses appropriate agreement to minimize legal risk.  Sellers include liability-limiting terms in their contracts, and want to make sure they can collect their fees, while purchasers want assurances the product or service will work as advertised and they are protected from defects in the product or service, especially those creating liability.  Effective AI companies write agreements and prepare for negotiations with sample clauses to meet these goals.  Sellers must have standard form agreements if they want to make any sales, and sophisticated buyers frequently have their own form agreements as well.

Incident Response

Finally, effective AI companies have accident, security breach, and other incident response procedures to respond when bad things happen. By creating a plan of action in anticipation of these events, these companies put themselves in the best possible position to act when an event like that occurs. Without a plan, companies end up figuring out what to do on the fly, in a disorganized and confused haze at times of maximum stress. Creating an investigation and response plan allows the company to protect its legal rights, communicate effectively with internal and external stakeholders, and protect its reputation with customers and the public.

Companies can anticipate they will face challenges from accidents, data breaches, and other problems. Proactive legal strategies can help effective AI companies take the steps today to win legal cases arising from these accidents involving products they haven’t even finished developing. They can defend the decisions they made during the design process from claimants second-guessing them. They can also set the stage to take action against anyone violating their rights. The time to prepare is now.

Book an Exploratory Call with Stephen Wu