The devil is in the T&Cs 8 min read
Artificial intelligence is transforming businesses across many industry sectors, and a broad range of free and paid AI tools are now available and widely used to enhance productivity.
To assist businesses to make informed decisions about which AI tools to use and for what purposes, we have conducted an in-depth analysis of the terms and conditions (T&Cs) applicable to a range of commonly used, off-the-shelf generative AI tools from an intellectual property perspective.
In this Insight, we set out the key themes that emerged from our analysis and recommend ways to mitigate IP risk when using generative AI tools.
Key takeaways
- While most AI providers now indemnify their users against losses arising from third party IP infringements, those indemnities are generally only made available to users of paid versions of AI tools, and are subject to several important exclusions.
- All of the T&Cs we reviewed contain strict limitations on the AI provider's liability (including, in some cases, even in relation to its IP indemnity obligations), meaning a user may have little potential recourse against a provider for losses resulting from the use of the AI tool.
- Some, but not all, of the T&Cs acknowledge that the user and not the AI provider owns the IP rights in the outputs generated by the user using the AI tool, but there is not always an assignment provision giving effect to this. Further, as a matter of current Australian law, IP rights may not subsist in such outputs in the first place.
- Users grant broad, permissive IP licences to AI providers to use both user inputs and outputs, for extensive purposes. In many cases, users are also required to provide IP warranties and indemnities in favour of AI providers regarding such use of inputs. Therefore, careful consideration will need to be given to how users can mitigate the risks of breaching confidentiality, waiving privilege and infringing third party IP rights in relation to the use of such materials.
- The T&Cs for many AI products are governed by laws in the US or Ireland, and also require disputes to be resolved in those jurisdictions, making the enforcement of rights by Australian users against AI providers potentially onerous.
Methodology
We reviewed the publicly available documents forming the T&Cs that govern the use of the following AI tools:
- ChatGPT, the generative AI chatbot developed by OpenAI, available both as a free and as a paid product;
- Gemini, the generative AI chatbot developed by Google, available both as a free and as a paid product;
- Meta AI, the free generative AI chatbot developed by Meta that is available on its platforms, such as Facebook, Instagram, and WhatsApp;
- Copilot for Microsoft 365 (Copilot), the paid generative AI chatbot developed by Microsoft that is available as a built-in feature in Microsoft 365 subscription productivity software applications and services;
- Amazon Q, the paid generative AI chatbot developed by Amazon for enterprise use that is part of the Amazon Web Services cloud computing platform; and
- Adobe Firefly, the paid text-to-image AI model developed by Adobe that is included in Adobe's products (such as Photoshop) that are part of Adobe Creative Cloud subscription access software.
Where there are both free and paid versions of an AI tool, we reviewed the T&Cs applicable to each version, and considered the differences.
Analysis
With proceedings still on foot in several jurisdictions, there is currently significant uncertainty as to the legal position on IP infringement, which may also vary between jurisdictions. Unsurprisingly, this has caused users concern that they might inadvertently infringe a third party's IP rights by using an AI tool—eg by publishing an AI output that reproduces a copyright work used in the tool's underlying training data.
To allay those concerns, most major AI providers have publicly announced that they will indemnify their customers against liability for third party IP infringement claims. Based on our review of the relevant T&Cs, however, it is clear that the devil is in the detail—there are many circumstances in which users of AI tools will not be protected if they are found to infringe a third party's IP rights.
Of the T&Cs for the AI tools that we reviewed, all of the paid tools included some form of IP indemnity. For providers that offer both free and paid versions of their AI tools, an indemnity is only offered to users of the paid version of the service. This means that, as a general proposition, users of the free versions of these tools remain exposed to the risk that their use of the AI tool may be found to infringe third party IP. Meta AI, which is only offered as a free tool, does not come with any indemnity as to AI outputs under its standard terms.
For the providers that do offer an IP indemnity for their paid tools, it is generally subject to several limitations, including the following.
- The indemnities are subject to varying exclusions that apply regarding particular uses of the AI tool, such as claims resulting from:
- the combination of the provider's product with other third party products;
- the user's applications, products or services into which the AI tool has been integrated;
- fine-tuning, customisation or other modification of the tool or output;
- input or training data provided by users;
- disabling or not implementing tools and filters offered by the provider to mitigate risk;
- non-compliance with the applicable terms of use or with applicable laws, regulations or industry standards;
- generating or using an output in a manner that the user knows or ought to know is likely to infringe third party rights; or
- using an output after receiving notice of an infringement claim by the rights holder, or after being notified by the provider to stop using the tool.
- In the case of three of the AI tools, the indemnity notably excludes claims based on trade mark or related rights.
- In the case of two of the AI tools, the indemnity will only apply if the user gives the provider notice of the relevant claim and permits the provider to control the defence of the claim, among other things.
Businesses that use AI tools should be aware of these limitations—particularly those that intend to use AI outputs in external-facing materials, where the practical risk of an aggrieved third party identifying an infringement of their IP rights is higher.
It is also important to consider how the risk of infringing third party IP rights might vary between different products and providers. For example, using an AI tool that is trained exclusively on the provider's proprietary and licensed-in data, or the user's own data, carries a lower risk of infringing third party IP rights than using an AI tool that is trained on general third party data scraped from the internet.
All of the T&Cs that we reviewed include strict limitations on the provider's general liability (eg capped at US$100 or $500), including, in some cases, even in relation to its IP indemnity obligations (eg capped at US$10,000 per third party IP infringement claim).
Several providers also cap their liability by reference to the amount paid by the user, which means that users of cheaper products have even more limited recourse against the provider than users of more expensive products.
The ownership of rights in the outputs produced by the AI tool is addressed in some but not all of the T&Cs that we reviewed. Where the topic has been addressed, it is generally acknowledged that the user (and not the AI provider) owns any IP rights in such outputs. However, this is not always accompanied by an express, present assignment of IP rights to give effect to that ownership position to the extent such IP rights are in fact owned by the AI provider.
Further, even where there is an effective assignment to users, there remains a question as to whether any IP rights subsist in such outputs in the first place. This is because, currently under Australian law, only the works of human authors qualify for copyright protection (see our Insight The AI-generated picture becomes clearer), and only the inventions of human inventors qualify or patent protection (see our Insight AI-generated inventions remain unpatentable in Australia – for now).
Each of the T&Cs that we reviewed provides that a user grants a broad licence in favour of the AI provider regarding the inputs submitted to, and outputs of, the AI tools. Most licences are expressed to be non-exclusive, worldwide and royalty-fee, and, in some cases, transferable and sub-licensable.
The permitted uses of inputs and outputs by the AI provider include to:
- provide and maintain the provider's services;
- distribute and display via the provider's services;
- promote the provider's services; and
- develop and improve the provider's machine-learning and AI technologies.
Given the scope of such permitted uses, users should be keenly aware of the risks that they may be destroying the confidentiality of, and waiving any privilege in, any inputs they submit to the AI tool, as well as relinquishing control over any use of any outputs generated by them using the AI tool by any third parties.
A consequence of the AI provider using a user's inputs is that if such inputs infringe third party IP rights, the AI provider would also be exposed to infringement liability. To address this risk, most of the T&Cs that we reviewed require a user to warrant that they are entitled to license to the AI provider all rights in the inputs they submit to the AI tool. These are also often accompanied by indemnities provided by the user in favour of the AI provider and its affiliates in the event of breach of such warranties.
In particular, if the inputs are displayed in AI outputs generated by third parties who use the same AI tool, the risk of detection of the infringement and the extent of infringement substantially increase, and therefore so does the potential exposure for the user—and the damage suffered by the AI provider, for which a user may be held liable, could potentially be very significant.
Many of the T&Cs we reviewed are governed by foreign law, and also require dispute resolution to take place in foreign jurisdictions outside Australia: generally, either the laws of Ireland or the laws of California.
In practice, this means that a user who may have a claim against an AI provider for breach of the T&Cs (such as a failure to indemnify a user for loss suffered as a result of a third party IP infringement claim) will need to seek foreign legal advice and take action in a foreign jurisdiction, which creates further hurdles for the enforcement of the user's rights.
What businesses can do
As part of businesses' overall AI governance strategy, we recommend implementing the following measures to mitigate the above IP risks in connection with the use of gen AI tools:
- Carefully review the T&Cs of AI tools that are used or proposed to be used by the business, to fully understand the implications from an IP ownership, licensing and liability perspective. Allowlist and denylist the tools, depending on the outcome of the review, the intended use of the tools, and the risk appetite of the business.
- Regularly educate staff about the IP risks associated with the use of AI tools, and implement rules and policies regarding the submission of any proprietary, confidential, privileged or otherwise sensitive information, or third party materials, as inputs, as well as the use of any outputs.
- Impose clear processes for handling third party IP infringement claims arising from the use of AI tools, including ensuring steps are taken to satisfy any conditions of obtaining IP indemnity from the relevant AI provider: eg requirements to notify the provider of a claim and/or hand over control of the claim.
- Consider whether the business' contractual arrangements with customers or other vendors need to be amended to 'back-to-back' IP infringement risk, indemnities, etc in connection with the business' use of AI tools.