In 2025, could generative AI be pushing the boundaries of the law?

AI is producing text, images, and even code at a never-before-seen scale due to its quick developments. However, this innovation raises key issues regarding privacy, intellectual property, and moral responsibility.

This year, legal experts are tackling critical issues such as AI-generated content ownership, bias in decisions, and regulatory compliance. The US, EU, and other nations are drafting laws to govern AI, while tech leaders such as Elon Musk and Sam Altman are voicing their opinions.

However, what does this signify for companies, artists, and regular users?

Navigating AI’s future requires an understanding of these legal issues.

Now we shall explore the primary Generative AI legal issues in 2025!

To avoid AI detection, use Undetectable AI. It can do it in a single click.

The Introduction of Generative AI is Contributing to the Current Fervor for AI Adoption

Different definitions exist, but according to the EU AI Act, generative AI is foundation models used in AI systems primarily intended to generate, with varying levels of autonomy, content such as complex text, images, audio, or video. (AI Act, Art. 28b (4))

Enterprise stakeholders, in particular legal and compliance professionals, may have concerns as companies investigate how to use these new resources.

When analyzing the use of generative AI, a legal executive’s job is to provide knowledgeable advice to stakeholders, such as the board, executive peers, and business leaders, regarding the risks involved in implementing generative AI in business.

Understanding the operation of generative artificial intelligence (AI) and the potential risks associated with it is therefore beneficial.

Intellectual Property

Large amounts of data can be processed by AI, which can then produce an output without much significant human involvement. The debate over how to handle any intellectual property rights that may arise in the AI’s training materials and output is still in its infancy.

We concentrate on legal issues related to copyright laws here to keep these issues understandable, but the same ideas probably apply to other types of protected intellectual property.

Reproductions of the materials used to train the AI are probably produced during the training process, and the materials may be protected by copyright depending on the laws of the relevant jurisdiction. The copyrights of the authors of these materials may be violated by these types of reproductions unless specific exceptions can be used.

Read Also >>> Generative AI in Pharma

Each jurisdiction has its own set of exceptions. For instance, there is a notion of a fair use exception in the US, but in the EU, the exceptions for text and data mining in addition to temporary or incidental copying might be pertinent.

It is therefore challenging to determine which resources could be used to train an AI system without violating any intellectual property rights, including copyrights.

The recent decision by the US Supreme Court in the Warhol case on fair use, which placed a higher priority on the commercial intent of new functions than on their artistic expression, is probably becoming difficult to evaluate the copyright risks associated with AI training materials in the US.

But it is unclear yet what the decision might in fact mean in practice; that is expected to be decided in lower courts.

AI-Generated Content that is Protected by Copyright

The author of an intellectual property asset is granted rights under current copyright law. The objective is to safeguard the author’s intellectual and personal connection to their creation and to promise that authors retain authority over how their creations are used.

Nevertheless, since an AI system rather than a human mind composes the output, the question of whether generative AI outputs can have an author emerges.

Legislators in their specific jurisdiction could be involved in assessing whether granting the user a copyright aligns with the objectives of copyright laws, in part because the user may not have chosen any free and innovative decisions that considerably impact the output.

The European Parliament, for instance, declared in a resolution released on October 20, 2020, that autonomous creations produced by AI systems are not yet eligible for copyright protection in the EU because intellectual property rights often require an individual involved in the creation process. The AI Act adheres to this interpretation.

In March 2023, the US Copyright Office declared that AI-generated creations are not protected by copyright, unless the extent to which the human had creative control over the creation’s expression and in fact formed the traditional elements of authorship, as was shown in the Zarya of the Dawn case.

Furthermore, in August 2023, the US District Court for the District of Columbia granted summary judgment in the Thaler v. Perlmutter case, upholding the US Copyright Office’s stance in Zarya of the Dawn.

In that case, the US Copyright Office rejected a copyright application for a machine-generated creation, arguing that human authorship is necessary for copyright protection.

Thus, broadly speaking, we might see legislators shifting toward a position where a human author can obtain copyright by altering an AI system’s output and producing a new (derived) creation; conversely, the further the output is produced by the AI system itself, the less probable it is that such rights might attach.

It is also necessary to think about the Warhol case’s ramifications.

Personal Information and Privacy

Considerable amounts of data, such as images, text, speech, video, code, business plans, and technical formulas, are both ingested and produced by generative AI systems. Different levels of protection are required when training, testing, uploading, analyzing, consulting, or processing such input and output data. 

The type of data determines these protection levels, with a notable difference between personal and non-personal data.

Data protection laws may be applicable nearby (such as the California Civil Code Act) or in the region (such as the General Data Protection Regulation in Europe) when the data is considered personal data (such as names or details about an individual’s life).

Under local laws or by contract, business data, including trade secrets, financial and technical information, and strategic know-how, may also be categorized as confidential information, carrying with it the possibility of both civil and criminal penalties for improper handling.

In this regard, companies using Generative AI systems have to think cautiously about how to properly classify the data that is entered into them and implement precautions so that the data is handled safely, securely, and privately.

Roles and Responsibilities for Personal Data

Assessing the roles of the parties involved (i.e., data controller, data processor/service provider, etc.) is the primary step in an EU-based personal data protection assessment when using generative AI. This aids in defining the precise steps that should be implemented and which entity is primarily responsible for compliance.

According to theory and a simplified business model, a provider of generative AI systems would serve as the data controller for the initial training and testing data layers. Furthermore, the provider would probably offer off-the-shelf, data-embedded products while acting as an independent data controller for every piece of data.

In the event that the provider just licenses the AI engine to enterprise clients without any embedded data, the provider may also serve as a data processor for input and output data on behalf of a client organization.

Depending on the relevant business model, the customer organization may function as a data controller for any extra training and testing layers for either input or output data in both situations.

Considering the necessary data protection and algorithmic impact assessments, mixed roles or even joint controllership may be feasible and ought to be evaluated on an individual basis. It should be mentioned that no court or oversight body has yet to rule on the aforementioned situations.

Confidentiality

Confidentiality violations, whether mandated by law or a contract, endanger the liberties and rights of individuals in addition to organizations. Because of this, maintaining data confidentiality throughout the AI lifecycle is key. Sensitive information in the training data may be deliberately learned and replicated by generative AI models.

This may lead to the creation of outputs that include private data, which could jeopardize confidentiality if shared or declared public. Companies have to comprehend their own confidentiality responsibilities.

A business has to assess any confidentiality obligations and other contract terms under which the information was shared, in addition to whether they have permission to use the data in a generative artificial intelligence system, if their use case calls for sensitive information that has been shared by clients, vendors, or other people.

Measures to Consider Before Adopting

Organizations have to evaluate the current legal, financial, and reputational risks associated with personal data and confidentiality as the use of generative AI grows. In addition to the legal and regulatory requirements as they become effective, organizations may choose to consider the following non-exhaustive list of factors:

• Should only authorized personnel have access to data?

What function do logical and physical access control techniques such as authentication systems serve?

• What particular rules and guidelines should be followed when using generative artificial intelligence (AI) applications, and how can they be upheld and their compliance checked?
• Would procedures and policies be modified to enable for the exercise of individual rights (such as the deletion of data)?
• Which employee education programs and awareness campaigns about the safe, legal, and moral use of this technology are suitable?
• What effects do supply chain audits and controls have on businesses that either provide or receive AI generative services?
• What organizational and technical safeguards — such as AI governance, privacy-by-design and by-default, anonymization, encryption, and secure storage — should be in place so that businesses and the private or sensitive information they consume or retrieve are shielded from loss, alteration, and unauthorized disclosure?
• Would in-house or external legal experts and technologists be involved in the design of controls to safeguard confidentiality and personal data from the beginning stages of any AI project?

Contractual Terms Considering Generative AI Legal Issues

It is necessary to meticulously analyze the terms of the contract under which a generative AI program is procured when licensing or otherwise entering into a contract related to an approach considering the legal risks associated with its use in a business setting.

Several key elements might require to be discussed and comprehended:

• Companies may request compensation from the provider of generative artificial intelligence (AI) technologies for any leading to IP infringements, data privacy violations, or confidentiality violations; providers ought to consider their own risk tolerance into account.
• Organizations might think about whether the provider can cover claims or if appropriate insurance is available, in particular when working with smaller AI service providers.
• Considering the potential necessity of generative artificial intelligence (AI) technologies for daily business operations, the potential effects of their unavailability on the company ought to be thoroughly assessed.
• A major emphasis of any contractual framework for the delivery of Generative AI services is probably going to be clauses pertaining to data privacy and confidentiality.
• Numerous jurisdictions are creating or planning to implement new AI laws and regulations, many of which may supersede any clause in a contract that conflicts with it or that have to be covered by a contract. Contractual terms ought to reflect this dynamic.

FAQs: Generative AI Legal Issues

What are the primary legal issues associated with Generative AI?

The primary legal issues associated with Generative AI revolve around intellectual property, data protection, and the legal implications of AI-generated content. As generative AI systems create new outputs, questions arise regarding who owns these outputs and whether they infringe on existing intellectual property rights.

Furthermore, the use of personal data to train these AI models raises data privacy concerns, leading to potential legal risks and the need for compliance with regulatory frameworks.

How does data protection play a role in Generative AI?

Data protection is critical in the context of Generative AI because these AI systems often require substantial amounts of data to function effectively. The use of generative AI should comply with data privacy laws, so that personal data is handled appropriately.

This includes obtaining consent from individuals whose data is used and maintaining transparency about how their data could be used. Non-compliance can lead to severe penalties under various legal frameworks.

What are the intellectual property concerns related to AI-generated content?

The intellectual property concerns surrounding AI-generated content include issues of authorship and ownership. Since AI models generate outputs based on the data they were used to train, determining who holds the rights to these outputs can be complex.

For instance, if a Generative AI creates a piece of art or music, questions arise about whether the creator of the AI system, the user of the AI programs, or the AI model itself holds copyright over the creation. This evolving landscape poses significant legal challenges.

Conclusion: Generative AI Legal Issues

In the future, legal executives can play a key role in strategic choices pertaining to any application of generative AI in the company. They could be offered duties and accountability for creating legal and ethical frameworks, managing the organization’s risk tolerance, and being certain that laws and regulations are followed.

Legal executives should primarily think about keeping a close eye on how the technology is developing in addition to how laws and regulations are evolving.

The C-suite, business divisions, internal and external experts, and consultants with the technical know-how to assist in identifying risks, opportunities, and modifications to business strategy and procedures are every significant stakeholder in a whole-of-enterprise approach.

It may also be the responsibility of the legal executive to train individuals and change their perspective on the moral and legal ramifications of applying generative artificial intelligence.