A business can introduce artificial intelligence through a new chatbot, a software upgrade or an employee’s existing account. Each route raises questions about the information being shared, the decisions being made and who takes responsibility when an output is wrong.
Legal risk management starts with identifying those uses. An approved product name alone says little about whether staff may enter customer records, publish generated material or rely on a recommendation affecting an employee.
The US National Institute of Standards and Technology’s AI Risk Management Framework provides a voluntary approach to assessing risks across an AI system’s design, use and evaluation. It is a management framework, not a certificate of legal compliance. NIST says the framework is being revised.
For a company, the starting point is a defined business task and a record of how the proposed tool will perform it. Legal, information technology, security and operational teams need enough information to assess the same activity.
Identify the data before approving the tool
Generative AI produces material such as text, images or code in response to an input. That input can contain information the business has obligations to protect, including personal data, confidential contracts or commercially sensitive plans.
Before staff submit such material, the company needs to establish what the provider receives, where it is processed, how long it is retained and whether it can be used for model training. Answers depend on the product, account settings and contractual terms. Public and enterprise versions of a service may have different arrangements.
It would be inaccurate to assume that every AI provider trains its models on customer inputs, or that deleting an entry from a visible chat history necessarily deletes every retained copy. The relevant policy and contract need to answer those questions.
The UK Information Commissioner’s Office’s guidance on AI and data protection covers accountability, transparency, fairness, accuracy and security. The regulator warns that this guidance is under review following the Data (Use and Access) Act. Companies operating in the UK should check the current guidance and applicable rules when assessing a deployment.
Data protection is one part of the review. A document can be commercially confidential even if it contains no personal information. Permission to access a customer file inside the company also does not automatically establish permission to disclose it to another service.
Check what a human will verify
A fluent answer can still contain an invented fact or an incorrect reference. NIST’s Generative AI Profile identifies confidently stated false content, privacy risks, harmful bias and over-reliance among the problems organizations need to consider.
Review should match the consequences of an error. Drafting an internal meeting agenda and recommending which job applicants progress are different activities. A single rule saying that a person must check the result does not explain what that person is checking or whether they have authority to stop the process.
A company can document the source material to be checked, the person responsible for approval and the circumstances requiring escalation. For a customer-facing document, that could include confirming names, figures, contractual statements and source references before release.
Consider a hypothetical customer-service assistant that drafts responses about refunds. Its operator might require a human to compare each proposed commitment with the customer’s purchase record and the approved refund policy. That is a defined review task, whereas clicking an approval button without checking either record offers little assurance.
Separate copyright protection from permission to use material
Copyright questions arise on both sides of an AI workflow. A business needs to consider its permission to upload source material and the rights associated with the resulting output.
In its January 2025 report on copyrightability, the US Copyright Office said AI-generated outputs can receive protection where a human has determined sufficient expressive elements. Prompts alone do not establish that human authorship, while using AI as an aid does not automatically disqualify a larger human-created work.
That position concerns US copyrightability. It is not a universal ruling that every AI-assisted work is unprotected, or permission to reuse another party’s protected material. Contractual permissions, copyright protection and possible infringement are separate questions.
Businesses commissioning marketing copy, software or design work can keep records of source material, licenses and human contributions. Those records help the people reviewing a particular use assess what has actually been created and what permissions are available.
Read the vendor agreement as an operating document
A contract review needs to cover how a service will work after purchase. Questions include who can access submitted information, whether subcontractors process it, how incidents are reported, what happens when a feature changes and how the customer can retrieve or delete its data.
Software updates deserve attention because a change to an existing service can introduce a different workflow. The relevant question is what the new feature does under the customer’s account and agreement, not whether the supplier’s name is already familiar.
Teams should also examine the scope of any liability limits or indemnity, a contractual promise concerning specified losses or claims. Its usefulness depends on the wording, exclusions, conditions and applicable law. A broad marketing assurance is not a substitute for those terms.
Give the policy an owner and a review process
A written policy can identify approved tasks and tools, prohibited inputs, required checks and a route for reporting problems. It also needs an owner who can update those instructions when a provider changes its service or the company’s use expands.
Whether the work is managed internally or with legal risk and transformation advisors, the business can specify the outputs it needs: an inventory of uses, documented data flows, vendor-review findings, approval responsibilities and staff instructions. These deliverables are easier to assess than a general promise to make the organization AI-ready.
Our earlier coverage of AI incidents and board oversight examined how organizations escalate problems. An escalation process also needs a response: who can suspend a tool, preserve relevant records and decide whether a customer or regulator must be notified.
Specific legal obligations depend on the jurisdiction, sector, information involved and use of the system. A governance checklist helps organize that assessment; decisions involving particular rights, claims or contractual obligations require advice appropriate to the circumstances.
