By Bhavya Sriram, Partner, JSA Advocates & Solicitors
GenAI and the legal positions surrounding them are rapidly evolving. With increased usage of Gen AI tools, there is an increased risk of unintentional IP infringement, as users are unaware as to whether protected data was used for generating output. While Gen AI providers offer indemnities the extent of coverage offered varies.
Indemnity offerings and exclusions
The larger, well-established providers offered wider indemnity coverage. One prominent AI developer offers indemnity with respect to both training data utilised in making its tool and also the generated output from its product. Another has committed to defend claims and cover liabilities in third-party claims for infringements relating to use of its output. Users should note that the indemnity terms have limitations. One set of terms excludes indemnity where a user intentionally creates or uses generated output to infringe others’ rights, and another restricts the provider’s commitment to only enterprise users and requires them to have used integrated safeguards and content filters.
Other Gen AI providers have placed limitations on indemnity ranging from plain vanilla monetary caps to more creative conditions.
Once such provider states that users will not receive indemnification if they create or use generated output that they knew or should have known was likely infringing. The phrase ‘should have known’ is problematic here. How is it possible for a user to have known? Are users expected to conduct an IP diligence exercise on every output generated? The language here leads to a knowledge test which becomes subjective.
Another provider specifies that they will only defend paying customers that have used the tool unmodified and not combined with anything else. One may argue that the entire point of using Gen AI tools is to be able to use output provided in combination with something else, such as the organisation’s own custom code or marketing materials. With exclusions like this, Gen AI users may reconsider use of certain products.
Who gains?
The pressure to onboard users and the lure of having the first-mover advantage make it worth providing appropriate indemnities to lull potential customers into a feeling of comfort that use of AI products is free from risk.
While beneficial to users, most indemnity clauses give something pivotal to Gen AI providers – control of defence – they allow for providers to step into user’s shoes and control defence or settlement proceedings. This may be the best outcome for users, but not always.
Take a scenario where a user has ceded control over defence of a claim where in addition to damages, the claimant seeks an injunction from use of work product. If awarded, this would result in business disruption for the user. Indemnity provided typically extends only to claims made against the user and do not cover all losses incurred. Therefore, while being indemnified against court-awarded damages, what about the lost time, effort and money associated with building a new product?
While the provision of indemnity might be out of business self-interest, it is a fact that larger AI providers are ready to hold their users harmless against claims, albeit with exclusions. Users may be wary of smaller AI providers with broader exclusions and monetary caps, increasing risk of exposure for a user.
Takeaways for GenAI Users
This being new ground for legal systems, governments are working to understand legal ramifications, and introduce appropriate regulatory measures in a fast-evolving space. The GOI recently announced its intention to introduce a separate regulation on AI, stressing concerns of transparency and content monitoring. On March 13, the EU Parliament voted the Artificial Intelligence Act into law, bringing in requirements of transparency, compliance with EU copyright law and disclosure of training content. The latter is a significant move towards safeguarding protected data and gives users more than the contractual protection of indemnities.
For now, without regulatory protections, users need to rely on the strength of indemnities provided. Although Gen AI lawsuits are presently directed at providers, with more users monetising Gen AI outputs, users may soon become targets too.
While the indemnity offerings of providers are helpful, these neither comprehensive nor shields from future liability. Users should evaluate risks and benefits by careful consideration of:
(a) what the tools are going to be used for in their business;
(b) the scope of indemnities being offered and exclusions;
(c) the effectiveness of guardrails baked into tools to mitigate potential infringement.
It is also worth mentioning that companies looking to leverage the use of generative AI for business efficiency should confirm that their intellectual property insurance has appropriate cover for AI generated outputs and check for any policy exclusions.