Small business blog from Farringford Legal

The pace of change of Artificial Intelligence (“AI”) and in particular the rapid emergence of Large Language Models such as ChatGPT, Microsoft’s Bing, Google’s Bard and Anthropic’s Claude (“LLMs”) has taken most of us by surprise.  Whether your business develops or deploys AI or conversely perhaps currently intends to never engage in the use of AI, its existence cannot be ignored given the risks and opportunities it may generate and the likely disruption of existing business practices. 

Set out below are three basic steps which businesses should consider taking from a good governance perspective to ensure that AI is being managed in accordance with your business’s appetite for risk and opportunity and that its use does not negatively impact on ethical standards and the workplace culture.  For most SMEs, the most pressing issue to be addressed will likely be the confidentiality and privacy risks associated with the use of LLMs although potential discrimination claims may emerge, and wider compliance requirements and good practice guidance seem inevitable as the regulatory regimes governing AI become established.

Step 1: Understand the current use of AI in your business

Every business should look to understand how AI is impacting its activities already, irrespective of whether such use is authorised. An audit may be necessary to determine the key touchpoints. 

Important areas to consider:

• Use of LLMs by employees or contractors in your day-to-day operations;
• The extent to which any product offered by your business incorporates or will incorporate AI provided by third parties and the contractual terms and/or intellectual property rights necessary to protect your business;
• If your business is or will be building its own AI product, the contractual terms to ensure you get the benefits of your products and protect your intellectual property rights; and
• The regulatory regimes relevant to your business operations. If your business operates in Europe, the new AI specific legislation being proposed in the EU may be relevant. In the UK, AI specific legislation is not currently proposed (the UK Government’s recent white paper confirms that it will continue with its current sector specific approach to regulation) but many international jurisdictions continue to assess their response.

Step 2: Assess the benefits/risks of (i) current AI use and (ii) future AI use on your business

 AI does and will increasingly provide benefits to many businesses such as cost saving or efficiency opportunities (for example, in logistics, supply chain management and demand forecasting).  AI could even support good governance in the future, assisting with the analysis of data and the writing of board reports to help facilitate better business decision-making. AI could even assist with the preparation of the minutes.

However, any benefits need to be balance against the potential risks:

• Sharing sensitive information or personal data with LLMs opens businesses to confidentiality and privacy risks.  Caution is needed as generally, publicly accessible models such as ChatGPT, Bing or Bard reserve very broad rights as to how they might use user data.  Other providers are expected in future to allow access to LLMs via a “private tenancy” whereby users’ data remains encrypted and within an organisation’s boundaries.
• If AI is being used, will the AI provider stand behind its product and accept liability if something goes wrong?
• It should not be taken for granted that the results generated by AI can be trusted or are free from bias.

Step 3: Take actions to mitigate risks and drive benefits

Taking into account the nature of your business and its appetite for risk, steps which could be taken to mitigate risks and drive benefits would include:

• Restricting the use of LLMs by employees and contractors generally or in respect of confidential and sensitive information, particularly personal data.
• Updating employee and IT policies to reflect any permitted use of LLMs.
• Reviewing and updating compliance policies and practices to take account of AI.
• Reassessing contractual terms with customers and suppliers and updating as necessary.
• Revising governance processes.
• Introducing horizon scanning of the AI landscape as a standing item on your board meeting agenda.

AI and M&A

If your business is potentially seeking to enter into a transaction in the UK to buy, sell or merge with a business or part of a business which operates in the AI space, you should be aware that such a transaction may trigger a mandatory filing obligation with the Department of Business, Energy and Industrial Strategy as AI is seen as being a “high risk” sector.  Failure to do so can in some circumstances result in significant penalties including fines and potential criminal sanctions. A handful of transactions have already been blocked by the UK Government where those transactions were deemed to pose risks to national security. Other jurisdictions may impose similar requirements.

Conclusion

The AI landscape is evolving at an ever-increasing pace and there is much to do to understand all the potential legal implications and the impact on existing business practices. Whilst there remains uncertainty on what AI will deliver when, it is clear that businesses need to proactively respond to the likely disruptive impacts. The regular review of AI developments and assessment of their impact will be important for any business seeking to mitigate the legal risks which emerge and secure the benefits AI can provide.  

Our thanks to Melanie Duhig for this article. 

Farringford Legal is a partner for growth, providing affordable, expert legal services with a client-centric, entrepreneurial approach. We are not just lawyers; we are allies in your business journey, adapting as your business evolves, deeply trustworthy, always responsive.

www.farringfordlegal.co.uk  |  info@farringfordlegal.co.uk  |  020 8941 7324  

This article is for general information only and does not constitute legal or professional advice. Please note that the law may have changed since this article was published