The pace of change of Artificial Intelligence (“AI”) and in particular the rapid emergence of Large Language Models such as ChatGPT, Microsoft’s Bing, Google’s Bard and Anthropic’s Claude (“LLMs”) has taken most of us by surprise. Whether your business develops or deploys AI, or conversely perhaps currently intends to never engage in the use of AI, its existence and the importance of AI Management cannot be ignored. This is due to the risks and opportunities it may generate, as well as the likely disruption of existing business practices. Proper AI Management is key.

Set out below are three basic steps which businesses should consider taking from a good governance perspective. These ensure that AI is being managed in accordance with your business’s appetite for risk and opportunity. Therefore, its use does not negatively impact ethical standards and the workplace culture. For most SMEs, AI Management involves addressing the most pressing issue. This will likely be the confidentiality and privacy risks associated with the use of LLMs. Although potential discrimination claims may emerge, wider compliance requirements and good practice guidance seem inevitable. This is as the regulatory regimes governing AI become established.

Step 1: Understand the current use of AI in your business

Every business should look to understand how AI is impacting its activities already, irrespective of whether such use is authorized. An audit may be necessary to determine the key touchpoints in AI Management.

Important areas to consider:

  • Use of LLMs by employees or contractors in your day-to-day operations;
  • The extent to which any product offered by your business incorporates or will incorporate AI provided by third parties. Consider also the contractual terms and/or intellectual property rights necessary to protect your business;
  • If your business is or will be building its own AI product, focus on the contractual terms. Ensure you get the benefits of your products and protect your intellectual property rights; and
  • The regulatory regimes relevant to your business operations. If your business operates in Europe, the new AI specific legislation being proposed in the EU may be relevant. In the UK, AI specific legislation is not currently proposed (the UK Government’s recent white paper confirms that it will continue with its current sector specific approach to regulation), but many international jurisdictions continue to assess their response.

Step 2: Assess the benefits/risks of (i) current AI use and (ii) future AI use on your business

AI does and will increasingly provide benefits to many businesses, such as cost saving or efficiency opportunities. This applies, for example, in logistics, supply chain management, and demand forecasting. AI Management could even support good governance in the future. It can assist with the analysis of data and the writing of board reports. These contribute to better business decision-making. AI could even assist with the preparation of the minutes.

However, any benefits need to be balance against the potential risks:

  • Sharing sensitive information or personal data with LLMs opens businesses to confidentiality and privacy risks. Caution is needed as generally, publicly accessible models such as ChatGPT, Bing or Bard reserve very broad rights as to how they might use user data. Other providers are expected in future to allow access to LLMs via a “private tenancy” whereby users’ data remains encrypted and within an organization’s boundaries.
  • If AI is being used, will the AI provider stand behind its product and accept liability if something goes wrong?
  • It should not be taken for granted that the results generated by AI can be trusted or are free from bias.

Step 3: Take actions to mitigate risks and drive benefits

Taking into account the nature of your business and its appetite for risk, steps which could be taken to mitigate risks and drive benefits would include:

  • Restricting the use of LLMs by employees and contractors generally. This especially applies in respect of confidential and sensitive information, particularly personal data.
  • Updating employee and IT policies to reflect any permitted use of LLMs.
  • Reviewing and updating compliance policies and practices to take account of AI.
  • Reassessing contractual terms with customers and suppliers and updating as necessary.
  • Revising governance processes.
  • Introducing horizon scanning of the AI landscape as a standing item on your board meeting agenda.

AI and Mergers and Acquisitions

If your business is potentially seeking to enter into a transaction in the UK to buy, sell or merge with a business or part of a business which operates in the AI space, you should be aware that such a transaction may trigger a mandatory filing obligation with the Department of Business, Energy and Industrial Strategy. This is because AI is seen as being a “high risk” sector. Failure to do so can in some circumstances result in significant penalties including fines and potential criminal sanctions. A handful of transactions have already been blocked by the UK Government where those transactions were deemed to pose risks to national security. For any business involved in AI, AI Management is crucial. Other jurisdictions may impose similar requirements.

Conclusion

The AI landscape is evolving at an ever-increasing pace. There is much to do to understand all the potential legal implications and the impact on existing business practices. Whilst there remains uncertainty on what AI will deliver when, it is clear that businesses need to proactively respond to the likely disruptive impacts. Regular review of AI developments and assessment of their impact will be important for any business. This is crucial for seeking to mitigate the legal risks which emerge and secure the benefits AI can provide in the realm of AI Management.