Implementing AI at work — your legal obligations

Data protection day has always been about raising awareness of privacy rights and compliance obligations. However, the arrival of AI has introduced a level of complexity that most organisations are still grappling with — from hyper-realistic phishing to deepfake fraud and data collection at an unprecedented scale. Regulations are struggling to keep pace and the risks are evolving faster than traditional compliance frameworks can handle.

That’s why our data protection team held a webinar to provide attendees with a clear understanding of the current regulatory landscape, insights into specific AI risks (and how to address them), compliance strategies that work in practice and how to align cybersecurity with data protection.

This really is a must-watch for any organisation using AI — particularly generative AI and large language models (LLMs). You can view a replay of the webinar to get our in-depth guidance and we’ve pulled out some key takeaways below.

Implementing AI: the risks for businesses & sensible safeguards

Excitement around the efficiencies that AI can offer often means that the data protection consequences of implementing such technologies are overlooked. There are also the issues of confidentiality and intellectual property (IP) protection to consider. 

Those who purchase AI systems for a business often fail to consult their legal and risk compliance teams before doing so. This can result in you signing up to legal agreements that give away your ‘crown jewels’ without realising. It may also increase your risk of breaching legal obligations under the UK GDPR, potentially exposing your business to significant fines.

If you wouldn’t invite your competitors into your business and allow them to access your confidential data, you shouldn’t implement an AI system without the appropriate safeguards in place. The two are equivalent and must be seen as such. 

Legal problems will arise when you provide access to an AI system that can crawl your data with no restrictions on use. Some sensible and practical safeguards therefore include preventing access to important and confidential information and checking the terms through which the AI is being supplied to find out who else will be able to access the material that’s shared with the AI system.

Ultimately, as AI systems become more advanced and handle increasing volumes of personal data, the risk of breaches will rise. New questions will also need to be navigated around fairness, transparency and explainability — so building in legal compliance from the outset (and re-evaluating your position regularly) is critical.

AI & your legal obligations

The GDPR principles highlight that if the information you share with an AI system includes personal data, you must fulfil your legal obligations.

These include ensuring that you have:

• a lawful basis on which to allow the AI system to process that personal data
• updated your privacy policies to list ‘processing using AI’ as a potential use
• listed the relevant third parties who may access the personal data further to your use of AI
• put in place appropriate security for that personal data
• designed the use of the AI system in such a way as to minimise the risks of losing that personal data and access
• implemented appropriate policies and training to ensure that staff know what they can and can’t do with the AI system.

Data protection impact assessment (DPIA)

Ideally, your business will have carried out a data protection impact assessment (DPIA) before implementing AI software that’ll process personal data for which you’re responsible.

Breaches of the UK GDPR may result in you being fined — alongside the associated reputational damage — not the AI software owner, since you’re responsible for that personal data.

To carry out an effective DPIA, you’ll need an up-to-date record of processing activity that the business carries out on personal data using the AI system. This is referred to by data protection geeks (like ourselves) as a ROPA. 

Talk to us

If you need guidance or help with carrying out a DPIA or ROPA — or if you’d simply like to chat about whether your business is at risk and how to practice effective data protection — give us a call on 0333 004 4488, send us an email at hello@brabners.com or message us.