An overview of the legal framework for generative AI

How can we strike a balance between generative AI and compliance with the law?

In the absence of specific legislation on the use of artificial intelligence, the common-sense rules that apply to any creative work still hold true. Let’s do a quick test:

If you’re producing content for a client:

• Do you make sure that your creations do not exist elsewhere?
• Are you clear about the terms under which you transfer the rights to your creations?
• Are you aware of the risks in the event of infringement, or if your client is taken to court?
• Do you have professional indemnity insurance?
• If you use service providers: do you read their terms and conditions carefully?

If you’ve answered ‘yes’ to all these questions, then good news – you already know how to work with generative AI!

The traditional rules of intellectual property apply

To put it simply, all the constraints you bear in mind during your ‘traditional’ creative processes remain the same. Think of artificial intelligence as a service provider, and apply the same common-sense rules.

A brief summary of the key points to bear in mind:

Prior art: ensure that your creations do not already exist elsewhere.
Assignment of rights: find out about the methods for assigning the rights to your creations.
The client contract: pay close attention, particularly to the risk clauses.
Insurance: professional indemnity insurance is, of course, essential.
Service providers: be vigilant when it comes to contracts with your service providers.

A new rule has been added to these traditional intellectual property rules to adapt to new practices incorporating AI: documentation.

Documentation: an essential habit

As we know, the field of AI-driven creativity is still undergoing major upheaval. And the law will, as usual, adapt to practice. The most sound advice Claire Caquant offers is this: document all your AI creations. In practice, this involves archiving all your prompts and creative processes that utilise AI:
Keep all your prompts in a documented file; where necessary, take screenshots of your conversations with the AI to build up evidence of your creative process. These elements could protect you in the event of legal proceedings.

Let’s take a simple example: it is probably very risky, in terms of intellectual property law, to ask a generative AI to create an image of Hermione Granger, a registered character. However, you could ask the AI to create an image of a young schoolgirl with curly red hair and freckles, wearing a British school uniform with a red crest on the front, holding a wand in her hand.

The image will likely be virtually identical, but the legal risk involved is eliminated. It is up to you to prove that your prompts remained within the bounds of intellectual property law.

What is the current status of the legal framework for generative AI?

Let’s take a step back and review the three levels of legal protection in terms of intellectual property, and their applications to artificial intelligence.

There are three legal pillars to be observed in intellectual property law:

The protection of fundamental rights

This is embodied in the AI Act, adopted by the EU in July 2024. It is the world’s first regulation to guarantee the protection of individuals’ fundamental rights, in order to safeguard democracy, health and the environment. Among other things: a ban on biometric categorisation based on political, religious or philosophical opinions, sexual orientation or ethnicity; a ban on citizen rating systems; and a ban on mass surveillance to create databases for facial recognition, emotion recognition, etc.

The protection of fundamental rights

This relates to intellectual property: how do I protect my creations, how do third parties protect theirs, and how can I protect myself if my data is harvested? Legal battles are currently underway in this area of law, particularly in the United States. In summary:

• The training of language models currently operates like a black box. Training the model is not objectionable in itself, but this is the point on which the lawsuits are centred. The legal grey area is very narrow, as the training is carried out using data scraped by bots on the internet – something search engines like Google do constantly to index the web, without this activity being considered unlawful.
• However, the generation of content must comply with copyright law and is not itself protected by copyright.
• If the generated content is edited or modified, the work becomes eligible for protection because human labour has been applied to it.

The GDPR

The General Data Protection Regulation sets out the framework for data processing in Europe. In this respect, things become a little more complex, as many language models are based outside Europe. The key question to bear in mind is therefore: where does your data end up when you send a prompt to an LLM server?

• Are your actions being used to train the model? If you use the free version of ChatGPT, you are training the model with every action you take. In the paid version, you must deselect the option via a somewhat hidden opt-out. For Mistral, you need to send an email. Each service has its own system; it’s up to you to find the answer to protect yourself.
• Is the LLM server located in the European Union? This question becomes crucial when dealing with sensitive data, as the EU offers stronger safeguards for data subjects.

In summary, to be ‘GDPR-compliant’, the model must not be trained on your data and the model’s servers must be located within the European Union.