As much as artificial intelligence (AI) remains a hot topic to companies and individuals alike, there remains limited detailed regulation in place. The European Union published its Artificial Intelligence Act on 12 July 2024, but other jurisdictions have been slow or piecemeal in its regulation of AI.

However, data privacy laws are present in most jurisdictions, and have a significant impact on the use of, and more importantly the training of AI solutions. At its most basic, generative AI works by identifying and matching patterns in data and then using them to create new, similar data. AI systems are trained by being fed data, whether obtained via user inputs or via a dataset.

So, whilst the use of AI in your jurisdiction may not be subject to an applicable AI law or regulation, there is a high likelihood that, depending on the privacy laws your organization is subject to, it will be regulated by privacy laws. These will of course vary depending on where you operate but if you are training an AI solution on data which contains personal data have you obtained the requisite consents to do so, and are you able to delete or edit that data if the original data subject so requests? Is there a risk either in the training of AI or in its day-to-day operation that you may be providing it with customer data which is protected by a contract or even which contains IP, trade secrets, or even data regulated by a government authority which does not belong to your organization.

Whether you are allowing those within your organization to use publicly available AI platforms or deploying a purchased or specially developed solution it is essential to educate staff on their use, limitations to that use, and specifically the data the platform has access to as well as the data it should not be fed. You should, just as businesses should have a privacy policy, have an AI policy in place. It should also be regularly refreshed, and its adherence monitored by your IT team and human resources department.

AI and its use is not going away, and it is going to revolutionise and add efficiencies to many industries. But those who embrace its use without considering issues of data and applicable laws and regulations do so at their peril.