MENU
Artificial intelligence (AI) is increasingly being used in everyday business operations, creating opportunities to improve efficiency while raising important legal questions. From employees using AI tools and the risk of inaccurate outputs to the protection of confidential information, businesses must understand the risks and take appropriate precautions. This article examines three key areas: responsible AI use in the workplace, liability for AI-related errors, and the protection of confidential and personal information.
1. Your Employees Are Using ChatGPT: Does Your Business Need an AI Policy?
Employees may already be using ChatGPT and other AI tools to draft emails, summarise documents, conduct research or assist with routine tasks. Although these tools can improve productivity, their use without clear guidance may expose a business to risks involving confidentiality, data protection, intellectual property and the accuracy of its work.
The Future of Professionals Report 2026 by Thomson Reuters highlights the growing gap between AI adoption and effective organisational oversight.¹ This makes it important for businesses to establish clear rules governing how AI may be used in practice.
Why Does Your Business Need an AI Policy?
An AI policy provides employees with practical guidance on permitted uses, restricted activities and the checks required before AI-generated material is relied upon or shared externally. Depending on the business, it may address:
A policy should be proportionate to the nature and size of the business, the information it handles and the risks associated with its activities. It should also be supported by employee training and reviewed as the technology and applicable legal requirements evolve.
Responsible AI use requires more than selecting the right tools. It requires clear internal rules, appropriate oversight and a shared understanding of the risks.²
2. Who Is Liable When AI Gets It Wrong? A Legal Guide for Businesses
Even where a business has an AI policy in place, errors can still occur. AI-generated content may contain inaccurate information, produce misleading recommendations or contribute to decisions that cause financial or other harm. When this happens, an important question arises: who bears legal responsibility?
Liability for AI-Generated Errors
Liability will depend on the circumstances of each case, including how the AI tool was used, the nature of the harm, the parties involved and the applicable contractual and legal obligations.³ A business may face claims where it relies on an AI-generated output without appropriate verification, particularly if that output is incorporated into professional advice, commercial communications or decisions affecting clients or third parties.
The involvement of an AI system does not, by itself, remove the responsibility of the business or professional using it. Human review, appropriate safeguards and clear allocation of responsibilities remain important in managing the risk of errors.
The EU Legal Framework
The European Union has introduced a regulatory framework addressing the development and use of AI. Regulation (EU) 2024/1689, commonly known as the EU Artificial Intelligence Act, establishes obligations for relevant actors based on the type of AI system and the risks associated with its use.⁴ The obligations applicable to a business will depend on its role, which may include that of a provider, deployer or other operator, as well as the system concerned and the relevant implementation dates.
Separate legal rules may also be relevant where AI-related harm falls within the scope of product liability law. Directive (EU) 2024/2853 revises the EU product liability framework to address developments in products and technology, including software.⁵ Its application will depend on the circumstances and the relevant implementation and transitional provisions.
Data protection obligations may arise where the use of AI involves personal data. Under Article 82 of the General Data Protection Regulation (GDPR), individuals who suffer material or non-material damage as a result of an infringement of the Regulation may be entitled to compensation, subject to the applicable legal requirements.⁶
These frameworks do not create a single, automatic rule determining liability for every AI-related error. The legal position must be assessed by reference to the facts, the applicable legislation and the obligations of each party.
Contractual Liability and Recovery of Losses
Businesses should also consider how AI-related risks are addressed in their contracts with clients, suppliers and technology providers. Relevant terms may include representations about the service, permitted use, confidentiality, data security, intellectual property, liability limitations, indemnities and procedures for reporting incidents.
Clear contractual provisions can help establish each party’s responsibilities and provide a basis for addressing losses if something goes wrong. However, contractual protections should be reviewed carefully to ensure that they are appropriate, enforceable and consistent with applicable law.
Preventing and Managing Disputes
The most effective approach combines prevention with preparation. Businesses should assess the risks associated with the AI tools they use, ensure that consequential outputs are appropriately reviewed, maintain relevant records and establish procedures for responding to errors or complaints.
Where a dispute arises, the relevant evidence may include the AI-generated output, the information supplied to the system, the checks performed and the decisions made in reliance on the result. Keeping appropriate records can help a business understand what happened and assess its legal position.
3. Confidential Information and ChatGPT: What Businesses Should Know Before Uploading
In addition to the risk of inaccurate outputs, businesses must consider what happens to the information they provide to AI tools. Employees may upload contracts, internal correspondence, client documents, financial information or personal data without fully considering the consequences.
The central question is not simply whether an AI tool can process the information, but whether the business is entitled to disclose it in that way and whether adequate safeguards are in place.
What Are the Main Risks?
Confidentiality and trade secrets. Uploading sensitive business information to an AI platform may create risks depending on the tool’s terms, settings, data-handling practices and security arrangements. Businesses should not assume that information remains confidential merely because it is entered into a private conversation or account.
Personal data and GDPR compliance. Where uploaded material contains personal data, the business must consider whether the processing complies with the GDPR, including the requirements concerning a lawful basis, transparency, data minimisation, security and the responsibilities of controllers and processors, where applicable.
Legal professional privilege. Particular care is required when using AI tools to process communications with lawyers, legal advice or documents prepared in connection with anticipated or ongoing litigation. Depending on the circumstances and applicable law, disclosure to or processing through a third-party service may raise questions about confidentiality and the preservation of privilege. Recent legal commentary has highlighted these concerns in the context of publicly accessible AI tools.⁷
Cybersecurity and information governance. Businesses should also consider access controls, retention arrangements, the handling of uploaded files and whether employees are using tools approved by the organisation. Without clear procedures, sensitive information may be shared in ways that the business cannot adequately monitor.
How Can Businesses Protect Confidential Information?
Businesses should adopt a risk-based approach to the use of AI tools. Practical measures include:
The appropriate safeguards will depend on the nature of the information, the purpose of the processing and the specific AI service being used. A blanket prohibition may not always be necessary, but uncontrolled use can expose a business to avoidable legal and commercial risks.
Conclusion
AI can offer significant benefits to businesses, but its use should be supported by appropriate legal and organisational safeguards. Clear internal policies, effective human oversight, carefully drafted contracts and robust controls over confidential information can help reduce the risk of errors, disputes and regulatory exposure.
The objective is not simply to regulate the use of AI, but to ensure that businesses can benefit from the technology while maintaining accountability, protecting sensitive information and meeting their legal obligations.
________________________________________
[1] Thomson Reuters, Future of Professionals Report 2026, available at: https://www.thomsonreuters.com/en/institute/future-of-professionals-2026/report.
[2] UNESCO, Global AI Ethics and Governance Observatory, available at: https://www.unesco.org/ethics-ai/en.
[3] Sprintlaw UK, Who Is Legally Responsible When AI Makes a Mistake?, available at: https://sprintlaw.co.uk/articles/who-is-legally-responsible-when-ai-makes-a-mistake/.
[4] Regulation (EU) 2024/1689 (Artificial Intelligence Act), available at: https://eur-lex.europa.eu/eli/reg/2024/1689/oj.
[5] Directive (EU) 2024/2853 on liability for defective products, available at: https://eur-lex.europa.eu/eli/dir/2024/2853/oj.
[6] Regulation (EU) 2016/679 (General Data Protection Regulation), Article 82, available at: https://eur-lex.europa.eu/eli/reg/2016/679/oj.
[7] Andrew Judkins, “Court guidance that use of open-source AI waives confidentiality and legal professional privilege”, Norton Rose Fulbright, 9 April 2026, available at: https://www.nortonrosefulbright.com/en/inside-disputes/blog/202604-court-guidance-that-use-of-open-source-ai-waives-confidentiality-and-legal-professional
