Adoption of GenAI is soaring, but so are the IP risks. Companies that fail to act face potential data leaks, copyright claims, and ownership uncertainty. How should you protect proprietary information in the AI era?
Shutterstock.com/Summit Art Creations
The rise of generative AI (genAI) has raised serious questions about the extent to which Intellectual Property (IP), including copyrighted material, may legally be repurposed for AI training and development.
IP protects businesses’ inventions and ideas, providing them with an incentive to invest time, effort and resources into their works. Organisations’ intrinsic value is tied to their IP, including original creations, written strategies and company data.
GenAI is rapidly becoming ubiquitous, increasing the urgency for companies to take steps to protect their own IP and avoid liability for third-party infringement. Failure to act could see companies losing control of sensitive, proprietary information, facing lawsuits alleging breach of copyright or being unable to monetise AI-generated outputs due to uncertain ownership.
There are numerous high-profile court cases being waged between rights holders who argue AI developers are using their IP to train models without consent, and AI companies who argue their processing is lawful.
Lexology PRO considers the risks AI poses to IP and how these can be mitigated, from proper labelling and rights reservation to thoroughly reviewing third-party AI policies.
What risks does AI pose to companies’ IP?
“As AI providers rely on source data to train their models, it is common for terms of use to allow the provider to use data inputted after the query is completed. For businesses, this can compromise confidentiality and market advantage and proprietary information and intellectual property rights,” says Helen Dobson, Legal Director of Commercial and Technology at Boyes Turner.
Data scraping for AI training
When using AI, an important consideration is whether there is a risk of infringing third-party IP rights, particularly if the AI has been trained using data scraped from the internet, which may include protected IP.
Numerous high-profile IP infringement cases are currently passing through the courts. Disney and Universal are suing Midjourney for breach of copyright over the use of their characters, while Reddit is suing Perplexity, arguing that the company illegally scraped platform users’ content without permission.
So far, most cases have focused on AI system providers; however, the risk of IP infringement extends further down the AI supply chain, potentially exposing companies using third-party systems to liability.
Companies also need to be aware of how their own IP may be being scraped for AI training purposes, possibly without their knowledge or consent.
User prompts
AI systems, particularly free-to-use large language models, commonly repurpose user-inputted data and prompts for refinement. This presents a major risk to companies’ IP, particularly if employees are inputting commercial or proprietary data into insecure AI models.
Vodafone banned the use of third-party AI chatbots among its employees in 2023, after sensitive internal source code was leaked due to an engineer entering it into ChatGPT.
Content output
It is often complicated to determine ownership of AI-generated works, or even whether such works are eligible for protection under IP laws. This is significant, because the IP rights holder is entitled to permit or exclude others from using that right and has the legal standing to sue if that right is infringed.
If companies are investing time and resources into producing AI-generated works, they want to be able to ensure they can reap the full financial benefits. However, in the absence of clear legislation or contractual provisions, there may be multiple candidates for ownership of an AI-generated work, including the end user, the system developer, or a combination of these.
In some jurisdictions, including the US, AI-generated works are wholly ineligible for IP protections. The US Copyright Office issued guidance stating that when AI determines the expressive elements of an output, and therefore it’s not the product of human authorship, “that material is not protected by copyright.”
How to mitigate the risks?
Governments are still grappling with how to support AI innovation while safeguarding the interests of rights holders. In the meantime, it’s imperative for businesses to implement internal governance measures and establish clear policies on AI and IP.
Labelling and rights reservation
The first step in protecting company IP is to ensure all business materials are copyrighted and rights reserved. To reduce the risk of these rights being infringed upon, companies should set limits on data use and ensure permitted and prohibited use cases are clearly defined in AI-related contracts.
Companies should also seek to establish contractual audit rights; the ability to actively verify compliance should help to quickly spot and rectify any instances of misuse.
Review contract terms carefully
To protect their own IP, companies should review their contracts with third-party AI providers to establish how any data inputted into an AI model will be stored and used after the point of input.
It’s also vital to consider whether third-party AI contracts shield end users from liability for third-party infringement claims. Many AI providers seek to exclude or limit their liability arising from the provision of their services to end-users.
"It would be wise to include terms that regulate the use of training data and the development of foundation models by AI service providers using input. Under regulations in other jurisdictions, such as the EU AI Act, AI service providers must ensure the legitimacy, quality, accuracy, and diversity of the data used for training their AI models, so it would be sensible for users of AI technologies to insist on terms that address these requirements, as well as to seek assurances that training data and foundation models have been obtained from lawful sources," says Oliver Yaros, Partner and IP Lead, London Office, at Mayer Brown.
Contracts should also address questions of ownership in relation to AI-generated material. However, the legal landscape in some jurisdictions could limit the ability to assign IP protection to AI-generated works, no matter what the contract states.
Verify rights over inputs
When training or interrogating an AI model, companies must ensure the necessary rights have been obtained to use the input material for the intended purpose. As the use of genAI continues to escalate, increased regulatory scrutiny of organisations that create or use AI models trained using material protected by IP rights is expected.
Companies will need to consider the legislative landscape in the different jurisdictions in which they operate.
“From a legal standpoint, the UK is currently one of the most restrictive jurisdictions for AI developers to train their models using unlicensed content, as unlike the EU, there is no text and data mining exemption available for commercial purposes, and unlike the US, there is no broad, open-ended ‘fair use’ doctrine, so it may be looked at by content creators as a favourable jurisdiction to bring claims,” says Anna Rawlings, Associate Director in Osborne Clarke's IP team.
Staff training
Employees should be required to participate in tailored, job-specific training to make them aware of what AI tools and use cases are permitted, and the risks of non-compliance. It’s vital that staff understand the importance of not inputting company data or IP into an ungated AI system.
Companies should also be aware of the rising risk of shadow IT – employees using AI tools without the knowledge or approval of the company’s internal governance structure, meaning, data or IP may be being exposed surreptitiously.