Using ChatGPT Safely: The Legal Implications

By now we have all been awash in articles about how ChatGPT can be used. The opportunities are nearly endless, from writing more articulate emails to easily exploring new subjects, building websites, and more. But, for a commercial business, what are the legal implications of using ChatGPT? In this article, I provide an overview of the legal issues any business should consider when using AI, and particularly how ChatGPT (or any other online accessible foundation model) raises these and, in some cases, new issues.

The AI Legal Landscape

The legal landscape for AI is rapidly evolving, as is with any situation where governments and societies try to catch up with fast-moving technology. Ethicists have raised concerns, and these concerns and others are being addressed by governments in everything from best practice guides to outright laws. One of the earliest examples was the “right to explanation” in the GDPR, where consumers affected by an AI have a right to request a description of how the AI works. More recent developments include the US Government’s AI Bill of Rights and the European Union’s AI Act.

Additional concerns for Generative AIs

The above laws are primarily focused on ensuring that AI systems protect user privacy and treat users in a fair and transparent manner. Generative AIs raise new issues. Unlike other types of AIs – Generative AIs “create” new content. I use quotes because whether this content is truly new or simply a probabilistic amalgamation of existing content is a topic of hot debate. Either way, questions now exist as to who owns new intellectual property created by an AI, whether an AI image can be copyrighted, etc.

Business concerns for ChatGPT (and like services)

Now that these services are available in API form, and countless apps are popping up using these APIs, what should your business pay attention to?

Privacy: If you are using an online API – make sure that the data that you are passing to this API does not include anything your customer would consider private. For example, if you have a chatbot on your website that is really a wrapper for a ChatGPT API – your customer is conversing with ChatGPT without knowing about it. That can lead to privacy issues down the road.

Intellectual Property: ChatGPT can write code. If your engineers use it to write code, and that code ends up in your product, it is possible that your company does not own the code for your product. This is also true for image-based generative AIs. To limit business risk, you should be aware of the legal opinions on these issues in whatever geographical regions your business (or partners) operate in. In today’s globalized world, laws in any part of the world are a factor for any multinational – regardless of where the company is headquartered.

Bias Issues: Like all large AI models, the vast data used for training implies that models can include many forms of hidden biases that are very difficult to detect. If these biases find their way into your services, they will cause business risk.

Regulation: Some heavily regulated industries (such as finance and healthcare) already have strict rules for what AIs can be used. The AI Act classifies AI-powered products into different risk levels and specifies review and testing requirements for each. Depending on what product or service you are using ChatGPT for, different levels of scrutiny may apply. For example – the European Union is currently engaged in a debate about whether ChatGPT violates the AI Act, with each country’s regulators taking a different position.

Right to Explanation: Some laws require that businesses provide the right to explanation – meaning that a user can expect a human-understandable explanation of how an AI made a decision affecting them. While research on explainability is advancing rapidly, explanations for these large language models are still a challenge.

What if I build my own Large Language Model?

Note that some of these issues will continue to occur if you decide to build your own large language model. The privacy issues will not occur since you are not sharing with an external API and the Intellectual Property issues should also not occur. The other issues, however, will remain.

Takeaways

This is an evolving space. The models are changing rapidly, and the laws around them are also changing rapidly. Interpretations of even existing laws are open to debate, and until court cases occur and judges are forced to make decisive interpretations, the debate will likely remain. Awareness of these issues, and how they may affect your company’s products and services, is a good first step.