Crafting AI Policies as the Technology Evolves

In-house legal teams have been scrambling to figure out how to govern ChatGPT, or generative AI, since it burst upon the scene last year, according to Bloomberg Law. ChatGPT’s full legal implications were far-reaching but somewhat unclear, and with public-facing platforms, it was easily accessible to employees.

Since its rollout, some companies have banned internal use of the technology. Others have no policies in place at all. Many others are allowing their employees to use generative AI, but they have established safeguards such as tracking its use and requiring approvals.

For companies creating new policies or updating policies as the technology evolves, generative AI has legal pitfalls, including security, data privacy, and employment and copyright law concerns.

Foremost among concerns is a security or data privacy breach. If sensitive information — such as customer data or confidential business information — is put into a generative AI platform that isn’t secure, the information could be offered somewhere else or be incorporated into training, which would effectively make it public.

Inaccuracy is another concern. As generative AI models have a tendency to hallucinate or produce incorrect answers, companies must be careful not to use them without checks and balances. Humans are needed to check that the information is accurate, unbiased, and doesn’t infringe on copyrights.

If generative AI has been trained on biased data, it can discriminate against candidates or employees based on race or sex, violating civil rights law. To craft AI governance programs, organizations are leveraging a combination of frameworks and existing rulebooks for privacy and anti-discrimination laws. Companies are also looking closely at whether their current privacy and terms-of-use policies allow them to use generative AI with their customer or client data.