IP and AI – what needs to be considered when using AI in a company?

Legal issues relating to AI and intellectual property (IP for short), i.e. trademark and labelling law, copyright and design law, personal rights and trade secrets and much more, are primarily concerned with the input of data into an AI. What content may be inserted into which AI model and in what way? However, there are also important points to consider from an IP law perspective with regard to the output of an AI, i.e. the specific use of the content generated by the AI within or outside the company.

IP and the input side

Before content is entered into an AI, it should first be checked how the AI tool to be used is technically designed. A decisive factor for an (IP law) assessment is, for example, whether the AI tool is operated by the company "on premise", i.e. in particular on the servers controlled by the company without a connection to external servers of the AI provider. 

How does AI deal with entered data?

However, it is also important how the AI deals with the content that is entered into the AI by the company. It is therefore advisable to check the terms of use of the respective AI provider. Caution should be exercised if these state that the input (and often also the output) is stored, used to improve the AI-tool, uploaded to a database or shared with other users. 

If this is the case and there is no contractual agreement between the company and the AI provider that prohibits the AI provider from doing so, no IP-protected third-party content, in particular no copyright-protected works (such as texts, photographs, marketing materials, slogans) or content protected by personal rights (such as portraits of persons or data relevant to personal privacy), but also no trade secrets, be they the company's own or those of business partners, should be inserted into the AI.

IP and the output side

The output side can also be relevant under IP law, which is why companies should not publish AI-generated content without checking it. If the generated output is to be used, for example, as part of advertising campaigns, on the company's own website or on social media, the user is responsible for the use of this output. 

AI training data could contain IP-protected content

The greatest risk with AI-generated content lies primarily in the previous training of the AI, in which billions of pieces of data are fed into the AI's neural network, most of which has been downloaded from freely available content on the internet (so-called scraping). This data may contain IP-protected content, such as copyrighted works, designs, trade secrets or third-party brands and trademarks. 

Users of the AI cannot recognise which data was used to train the AI. They also do not know whether the rights holders have agreed to this training or whether they have not reserved the right to use their works for the training. The output of an AI therefore always harbours the risk of third-party rights being affected and infringed unless the rights holders have been asked for consent to use it.

The output may infringe copyrights if it recognisably contains protectable third-party works or if the protected work is significantly changed by the output without the original work's personal characteristics fading. The reproduction of a well-known style, a motif or an artist's idea, on the other hand, is generally permissible, as these cannot themselves be protected by copyright. 

Trademark, labelling, design and personal rights must also be protected

In addition, trademark and labelling rights may also be affected if the output reproduces identical or confusingly prior third-party trademarks or signs and these are used as trademarks. If the output consists of a design that does not create a different overall impression on the informed user than a pre-existing registered third-party design, this may infringe design rights if no rights have been granted. If the output recognises real persons or names, the personal rights of the persons concerned may also be infringed.

Liability for hallucinations and incorrect training data

As the language-based AI models work on the basis of statistical probabilities, they recognise correlations but not causalities, and they work with syntax but not with semantics. The output of the AI can therefore contain errors of any kind (so-called hallucinations). Such hallucinations often only become apparent with precise knowledge of the area in question, because they are presented by the AI just as "convincingly" as correct results. 

The same applies to errors that are based on a lack of quality in the AI's training data (so-called bias): If an AI had only been trained with data from England, it would only allow cars to drive on the left-hand side of the road in Germany too. Human control is therefore essential.

Protection through contractual regulations on AI

In relationships with business partners, it can make sense to regulate the use of AI in existing contracts as well as in new contracts to be negotiated. For example, it can be contractually stipulated whether the company generally authorises its contractual partner to use AI or whether the use of AI should be limited to certain services to be provided. 

Information obligations can also be introduced, according to which the contractual partner is obliged to provide information about which services were created using AI at the request of the company or alternatively in any case. With regard to the granting of rights of use to the services provided, it is also advisable for companies to ensure that they do not suffer any disadvantages through the use of AI with regard to the scope of the granting of rights and the guarantee of freedom from rights compared to services that are created without AI.

Protection through human and technical controls

The responsibility for the generated content will ultimately lie primarily with the party that uses it for business purposes. In a legal dispute, companies will not be able to defend themselves by arguing that the generation of the output lies within the sphere of the AI provider, so that the latter is responsible for infringements of IP rights. In the relationship between companies and AI providers, the terms of use will regularly provide for an exclusion of liability in favour of the AI providers for the generated content. 

Does AI infringe rights – and if so, which ones?

The difficulty in practice will therefore lie in recognising whether the output contains third-party rights at all. As long as there are (still) no reliable tools for the technical control of the output, a risk assessment will have to be made in individual cases after a human control of the output. In addition to human control, companies can currently help themselves technically, for example, with similarity searches for pre-existing third-party trademarks or searches for third-party works and persons, for example with Google reverse search. Guidelines create security for employees

In order to further minimise the risks associated with the use of AI in the company, it is also advisable to train employees at an early stage and familiarise them with the positive and negative aspects of using AI. The use of an acceptable use policy is also highly recommended, which shows employees the permissible use of AI in the company and thus leads to safety for everyone involved.