4.5AI, data: new legal challenges
The essentials in 30 seconds
- New, shifting law: identify the challenges, do not apply frozen rules — varies by country.
- Entered data: what you pour into an online tool is potentially shared with a third party — anonymise, read the terms.
- Generated content: ownership and infringement = open questions — caution, monitoring and advice for sensitive uses.
Running mini-case — Yacine uses AI without exposing what matters
Yacine wants to generate visuals and texts with AI and pour his customer files into it. He stops: he anonymises, bans confidential data from consumer tools, reads the terms on generated content and checks the infringement risk before any significant use. He benefits from AI without exposing what must stay protected — the last step of his protection, after his brand, content, website and terms.
Final episode of cases 4.1-4.4 — Yacine adopts informed caution towards AI here.
1. New, shifting questions
AI and data exploitation raise new legal questions, still shifting and highly variable by country. The goal: identify the challenges, not apply frozen rules.
On the data side: be careful what you enter into online AI tools (potentially shared with a third party); level 3 principles (basis, minimisation, security) apply, amplified.
2. IP, liability, regulation
On the intellectual property side: ownership and protectability of AI-generated content, training on works, the infringement risk are open questions. Do not assume generated content freely belongs to you.
Add emerging AI regulation, liability, bias and discrimination, transparency. Stance: informed caution — neither fear nor carelessness — plus monitoring and advice for sensitive uses.
🔎 Concrete example — What you enter into AI (Yacine case)
Shared with a third party.
Personal, confidential or strategic data in an online tool
→ potentially shared beyond your control.
→ Yacine anonymises, reads the terms and chooses suitable solutions.Result: you identify the challenges without fear or carelessness.
Reflex: do not assume generated content is 'free' and belongs to you.
Section vocabulary
- Data entered into AI
- Information supplied to an online AI tool; potentially shared with a third party, hence a risk for confidentiality and personal data.
Simple example: The customer files Yacine gives up pouring into a consumer tool.
What it is not: anonymised, generic data with no stakes.
Reflex: before entering: sensitive or personal? If yes, stop.
- AI-generated content
- Output of an AI system whose protectability, ownership and infringement risk remain open questions, varying by country.
Simple example: The generated visual Yacine checks before significant commercial use.
What it is not: a classic human creation with settled status.
Reflex: read the tool's terms, add human input.
- AI regulation
- Emerging legal frameworks (transparency, risk-level classification, requirements for certain systems) under construction by region.
Simple example: The new requirements Yacine follows for his countries of operation.
What it is not: a frozen, universal code applicable everywhere.
Reflex: follow developments instead of learning frozen rules.
- Bias and discrimination
- The risk that an AI system treats people unfairly, engaging the company's liability.
Simple example: The automated applicant sorting Yacine has reviewed by a human.
What it is not: a simple typo with no effect on anyone.
Reflex: have any AI decision affecting people reviewed.
- Informed caution
- The recommended stance towards AI: neither fear nor carelessness, but understanding the challenges, applying known principles and monitoring.
Simple example: Yacine's internal usage charter: what we enter, what we check, when we consult.
What it is not: banning everything or allowing everything with no rules.
Reflex: write 5 lines of internal rules before widening uses.
In practice — In practice — Using AI and data with discernment
- Before entering data into an AI tool, assess the risk: personal, confidential or strategic data must not go just anywhere.
- Do not assume AI-generated content freely belongs to you or violates no rights: check the tool's terms of use.
- Apply the known principles (level 3 data protection, respect for others' rights, honesty, vigilance on bias).
- Follow regulatory developments in your countries of operation and seek advice for significant or sensitive AI uses.
Ready-to-say script — setting AI rules for the team (1 min)
'We use AI, but never pour customer or confidential data into it, and never assume what it generates is free: we read the terms, check before any significant use, and ask me when in doubt.'
Say it to the team: 3 simple prohibitions and reflexes, posted near workstations.
Copy-paste template — minimal AI charter
NEVER ENTER: _______________ (sensitive, confidential data)
ANONYMISE / GENERALISE: _______________
GENERATED CONTENT (check before significant use): _______________
TOOL TERMS READ ON: _______________
CONTACT + MONITORING: _______________Marketing visuals
Check the tool's terms and the infringement risk before any campaign: add human input instead of raw output.
Customer data
Ban customer files from consumer tools; prefer solutions with suitable guarantees, after advice.
Website texts
Re-read for accuracy, bias and rights: generated text may reproduce a work or state falsehoods.
Sensitive uses
Recruitment, credit, health, safety: do not deploy without advice and human validation — direct liability.
✓ Best practices
- Assess the risk before entering data into an AI tool.
- Read the terms of use (rights in generated content).
- Follow the regulations and seek advice for sensitive uses.
✗ Common pitfalls
- Pouring confidential or personal data into a consumer AI tool.
- Assuming generated content is 'free' and belongs to you without qualification.
- Ignoring the risk that a generation reproduces an existing work.
Key takeaways
- AI and data raise NEW, shifting legal questions, highly variable by country: identify the challenges, do not apply frozen rules.
- Data: be careful what you ENTER into AI tools (sharing with a third party); level 3 principles apply, amplified.
- Intellectual property: ownership and protectability of generated content, training on works, infringement risk = open questions.
- Additional challenges: emerging regulation, liability, bias and discrimination, transparency — informed caution, monitoring and advice.
48h challenge — apply it tomorrow
Write your minimal AI charter (template above): what you never enter, how you check generated content, who is the contact. Post it and test it on 1 real use.
- I can cite the 3 challenge areas (entered data, generated content, regulation and bias).
- I can explain informed caution in one sentence.
- I wrote and posted my minimal AI charter.
Frequently asked questions
Do texts or images generated by an AI belong to me? Can I use them freely?
An open, unsettled question: solutions vary by country and evolve. Purely generated content without sufficient human creative input may not be protectable; it may also reproduce an existing work and expose you to infringement; and the tool's terms govern rights and responsibilities. What to do: read the terms, do not expect strong protection, check the risk for significant uses, seek advice, stay informed. Do not base a strategic asset solely on content with fuzzy status.
Can I use AI tools with my company's data without risk?
Not without precautions. Entering into an online service potentially means sharing with a third party beyond your control: confidentiality, personal data, provider terms. Reflexes: do not enter sensitive data into a consumer tool without checking, anonymise or generalise, read the terms (professional offer with guarantees?), set internal rules, and for significant uses choose suitable solutions with advice. Golden rule: benefit from AI without exposing what must stay protected.
Yacine is about to pour his customer files into a free AI assistant 'to save time'. What is the right reflex?