The use of generative AI products is here to stay.  The list below can be used to help generate a business and legal road map towards the use of generative AI.  In the end, the journey is about matching a use case with an appropriate generative AI product or products for your particular effort or business based on a number of factors.

• Get Ready for a Journey: Generative AI is evolving as quickly as the use cases. There is a lot of pressure to use the benefits as quickly as possible. Keep in mind that you are on a journey that requires a deliberate and careful approach. Large vendors such as Microsoft, Google, and Amazon are still in various stages of “demonstration mode.” There is also a growing and important ecosystem of more niche and industry-focused vendors and consultants. A responsible approach will require commitment to a journey over time.

• Create Generative AI Review Committees and Training: Like with open source and privacy initiatives, many clients are creating use case task forces or committees and generating rules around using generative AI. In the end, as with other technologies, training will be an essential element for users to understand the issues and goals of your company. 

• Use Case Feasibility/Selection of Generative AI Product: Generative AI task forces or committees can help create use case “criteria” that can be applied to a specific use case and apply it against various generative AI model(s) for (hopefully) the best outcomes. This requires an understanding of the business goals, the various benefits and risks of particular generative AI products as applied against most of the issues in this list. The concept here is similar to what you look at when using open-source software and whether it’s for internal or external use, but with the added concerns of accuracy, confidentiality, security, and other issues related to generative AI. Comparing a use case against the generative AI product capabilities will be key.  

• Output Quality/Training Data: Accuracy is a challenge for generative AI. AI can provide answers in a very convincing, “fake news” kind of way, and still be wrong. These errors, or “hallucinations,” are clearly recognized as a work-in-progress. This also further emphasizes that the quality of the training data used to train the generative AIs and related issues. More focused or trained models should help reduce errors, but they will still occur — so training the model to recognize (and not double down on) errors is another movement in the generative AI space.  In fact, there is even a new position at some companies called “Prompt Trainer,” whose job it is to spend the time to train the AI though various prompt inputs!

• Other Issues Around the Training Data: Determine whether the generative AI trains on or generates output from the Internet or similar public sources. If applicable and you have access, consider using generative AIs that mine and train on proprietary data to help avoid third-party intellectual property claims and other issues. Keep in mind that there is a difference between third-party claims relating to any output, and third-party claims relating to the generative AI itself.

• Consider Creating a Sandbox and Rules: Consider creating a sandbox (with appropriate rules/guardrails) where certain employees or others are encouraged to try out generative AIs and potential ideas. This not only promotes creativity (and it’s fun), but it empowers everybody to learn how to use these tools and the potential related to them. Importantly, this can create new products you may have not even considered before.

• Would Using Generative AI Violate the Law or Other Obligations? Determine whether use of the generative AI could violate a law or contractual obligations such as confidentiality or security, or other help further problems like fraud or even extortion. To do that, you need to understand the specific generative AI tool(s) at issue, and apply how those products work, along with, for example, the terms and conditions, if any, for each product.

• Read the Terms and Conditions Relating to Generative AI: This should go without saying but spend the time to review the terms and conditions to help understand allowable uses, risks, and commitments of generative AI vendors. Keep in mind that these are often changed or modified on a regular basis as the vendors and products evolve.

• Who Owns the Output? Read the terms and conditions associated with who owns the output created by using the generative AI. In addition, if you desire to receive copyright or patent protection on what is created, the law remains that only works or inventions created by humans can receive such protection. There is some material litigation on this front to determine the difference between AI-assisted works vs. wholly-AI generated works (or inventions), what it means to be a “transformative work” along with other similar arguments, and who can own or perfect ownership in what output.

• Ethics, Potential Discrimination, Bias, and Fraud: Some use cases can lend themselves to discriminate against individuals or groups; always keep this in mind to make sure that use of the generative AI does not perpetuate or amplify biases based on race, gender, or other protected characteristics. Ensure that the model is used in an ethical and responsible manner. In the end, there will be domestic and international regulation of generative AI, so consider creating your own internal policy and inquire about any vendor’s similar policies.

• Ongoing Maintenance and Updates: Keep this issue on the top of the list. Unlike more developed technology that has a usual product cycle, generative AIs require ongoing maintenance and updates and different applications very quickly. Have a plan in place to stay on top of maintenance, updates, and other functionalities (along with the risks) over time.

• Privacy and Security: Ensure that the systems running/hosting the generative AIs are secure and comply with data privacy laws and regulations. Ensure that the data used to train and operate the generative AIs is collected and used in compliance with data protection laws. This not only includes U.S. domestic laws, but international laws. Italy banned (but then recently lifted the ban) the use of generative AI and the European Union is considering the first, comprehensive set of regulations relating to the use of artificial intelligence. Also note that many vendors have access to data for training or other purposes, or even for a short period, to determine whether acceptable use policies are met. More vendors are creating “opt-outs” and deletion capabilities, but not necessarily for all purposes, and the terms and conditions are changing by the month.

• Confidentiality and Attorney Client Privilege: The use of generative AI may put confidentiality of data at risk depending on where and how the data is hosted among other reasons, which may mean to also consider attorney client privilege issues.

• Liability: You may be held liable for any harm caused by generative AIs’ actions, such as providing inaccurate or discriminatory or biased information or breaching data privacy laws. You could also be responsible for copyright infringement of any output, but potentially the generative AI tool itself.

• Integration and Deployment: Don’t forget that you may need to have the necessary technical expertise and infrastructure (or obtain the same from third parties) to integrate and deploy generative AIs within their existing systems. Of course, part of the freedom provided by generative AI systems is to lessen that load, but having the expertise is still needed.

• Industry-Specific Regulations: You should be aware of any industry-specific regulations and guidelines when using generative AIs in business operations. You should ensure that the use of the generative AI complies with all relevant regulations and guidelines to address legal or compliance issues.

• Due Diligence for Procurement Contracts and Subcontractors: Make due diligence inquiries of vendors of generative AI as part of the procurement/subcontractor process, including analyzing terms and conditions of generative AIs for intellectual property, confidentiality, privacy and security, and related terms. This also includes making inquiries regarding the source material on which the generative AIs were trained in the first instance, along with how it will continue to be trained in the future.

• Mergers and Acquisitions: In mergers and acquisitions or investments, add generative AIs to due diligence request lists to help determine proper use and ownership rights, along with accompanying representations, warranties, and indemnities.