ChatGPT, the topic of the moment, and generative artificial intelligence (AI) systems more broadly, are AI systems that can create new content, including new computer code, designs, images and written works. They do so through artificial neural networks trained to process questions and generate outputs by recognizing patterns in massive datasets. Generative AI systems are unique because they generate entirely new content from existing data, unlike traditional AI systems that merely categorize or recognize such data.

In this three-part series, we explore areas of law that are critical to the use of generative AI and its impact in business. In Part 1, we looked at copyright law; specifically, the concepts of ownership issues related to generative AI inputs and outputs. In Part 2, we reviewed issues related to privacy law and proposed legislation to regulate AI in Canada. In this Part 3, we address some of the commercial litigation risks we foresee in business applications of ChatGPT and other generative AI solutions as they are more widely implemented. This is a less talked about area with fewer developments, given the extensive focus on privacy and copyright. Further, given the very recent release of ChatGPT, no Canadian courts have yet released any decisions on generative AI. 

Our question is: What civil and commercial litigation risks may result from businesses’ or professionals’ use of generative AI for work purposes? While developers of generative AI systems will undoubtedly face unique challenges and risks from a product liability perspective, as the product liability regime is focused on assigning fault to humans rather than systems and machines, our focus is on some of the risks associated with using these products. Businesses should be aware, as they begin using generative AI technologies, of two main categories of risks: (1) litigation-based in contracts relating to the licensing of AI systems and (2) tort-based litigation for negligent use of the AI systems in areas where negligence law traditionally applies, such as the provision of legal advice and investment advice.

1. Contractual disputes

AI systems are typically acquired through traditional software licensing agreements.¹ AI-specific issues arise, however, with determining who owns the work product and the data gathered by the AI system, since AI learns and adapts as it interacts with users, typically requiring a substantial investment of the user’s time to teach the AI to function in a particular setting. The result may be the licensee improving the overall AI system to the benefit of the licensor.²

We foresee issues with determining whether the licensor or licensee has a right to the proprietary data inputted into the AI system, which may give rise to contractual disputes.

The concern about inputs into the generative AI systems extends further. Businesses or individuals who have received confidential information from clients could be open to exposure in contract (and in tort) if it were to use its client’s confidential information as an input into a generative AI program. Here risks stem, in part, from the fact that AI tools are owned by third-party organizations that may leverage data inputs for their own purposes, or make such data available to other persons with access to their AI system. In a recent report, one data security service company detected that 8.2% of employees at client companies were using ChatGPT in the workplace, and 3.2% of employees have put confidential company data into ChatGPT.³ Risks of leaking confidential information, client data, source code, or regulated information will continue to increase as more employees use ChatGPT and other generative AI services to improve their productivity. This raises the issue of vicarious liability and its application for generative AI use and the importance of employee training.

2. Tort-based disputes

The nature of current applications of generative AI in many business and professional services settings is such that it is more likely to be negligently relied upon by a service provider using it, giving rise to claims in tort against the service provider. Accordingly, generative AI is more likely to fall within a class of AI which assists in decision-making and, resultantly, indirect harm.⁴

This is distinguishable from AI that is more likely to result in direct or physical harm to the broader public, such as AI-powered delivery drones or autonomous vehicles. As an example, a doctor may rely on a diagnostic AI tool when treating a patient. If they do so and inaccurately diagnose a patient with resulting damages, the question will then be who is at fault. This is a novel issue that is likely to create exposure to litigation, but very little precedent exists.⁵

Negligence is based upon whether the requisite standard of care (the level of care and caution expected of a service provider) has been exercised. However, it is difficult to establish exactly what is the standard of care expected from the user, since the user may not be able to oversee how the decisions are being made by the AI system – typically these algorithms are seen as black boxes.⁶ Solutions are still being developed to overcome this hurdle, such as the creation of systems capable of ex-post explanation.⁷ Training around the use of generative AI may become an important aspect of its use in the workplace.

The litigation risk here is mostly tied to the uncertainty around the standard of care when relying upon generative AI. This is a question that has yet to be answered by Canadian courts. In the interim, it is necessary to fully review any outputs from generative AI systems on which an individual plans to rely. Ultimately, the individual using the technology will likely be responsible for any harm caused by it.

Conclusion

Given the limited understanding of exactly how contractual, tort-based and other disputes will play out as generative AI becomes more prevalent, best practices are not to avoid its use, but to use it with care. Some safeguards include limiting the input of confidential or personal information and carefully reviewing, editing and assessing any generative AI output. Anything generated by a generative AI system should be only a starting point for what is delivered to the end user.

For more information on how to leverage the power of generative AI while navigating liability issues, please reach out to Chloe Snider, Camila Maldi, or Noah Walters.

Special thanks to Ashleigh Graden for her assistance with this article.

1. Thomas P. O’Leary and Taylor Armfield, “Adapting to the Digital Transformation,” 58:2 Alta L R 249 at 256, online: <https://www.canlii.org/en/commentary/doc/2020CanLIIDocs3296>.↩
2. Ibid.↩
3. Cameron Coles, “3.1% of workers have pasted confidential company data into ChatGPT” Cyberhaven Blog, online: https://www.cyberhaven.com/blog/4-2-of-workers-have-pasted-company-data-into-chatgpt/↩
4. Andrew D. Selbst, “Negligence and AI’s Human Users”, 100 Boston University L R 1315 at 1319., online: <https://www.bu.edu/bulawreview/files/2020/09/SELBST.pdf>↩
5. Selbst, supra note 3.↩
6. Ibid at 1339.↩
7. Andrew D. Selbst & Solon Barocas, “The Intuitive Appeal of Explainable Machines” (2018) 87 Fordham L. R 1085 at 1089-99, online: <https://ir.lawnet.fordham.edu/cgi/viewcontent.cgi?article=5569&context=flr>↩