Feb. 10, 2023
This is the first post in a series of posts by our team regarding the use and application of “artificial intelligence” or similar tools and related legal issues.
A quick primer: Chat GPT is one of the latest trending chatbots from OpenAI trained on using immense amounts of text data to generate human-like responses. With Microsoft Corp’s $10 billion investment in OpenAI and a new, paid subscription model ChatGPT Plus, many corporations are being inundated with potential use cases to create efficiencies and drive innovation. As is the case with any cutting-edge technology, legal departments are exploring the legal implications around implementing a product like ChatGPT or other generative tools.
Here is a brief analysis of issues to consider in the current terms for OpenAI (and ChatGPT):
Another provision worth noting is the use of “Content” (defined as the combination of Input and Output) to improve ChatGPT’s services. The terms state that:
“one of the main benefits of machine learning models is that they can be improved over time. To help OpenAI provide and maintain the Services, you agree and instruct that we may use Content to develop and improve the Services. You can read more here about how Content may be used to improve model performance. We understand that in some cases you may not want your Content used to improve Services. You can opt out of having Content used for improvement by contacting email@example.com with your organization ID. Please note that in some cases this may limit the ability of our Services to better address your specific use case.”
The link about how content can be used claims to remove all personally identifiable information from the model improvement data as well as capping the number of API requests used for improvement per customer (i.e., 200 every six months). However, the ChatGPT General FAQs specifically note “we are not able to delete specific prompts…Please don’t share any sensitive information in your conversations.”
Confidentiality of information is a major consideration for most organizations and a critical consideration for organizations, which are regulated by professional obligations to protect client or patient information. This is a major area where the ChatGPT terms are lacking. The terms provide only for one-way confidentiality protection, which would cover OpenAI’s confidential information, but there is no confidentiality provision which would protect a user’s information. Additionally, the FAQs state: “As part of our commitment to safe and responsible AI, we review conversations to improve our systems and to ensure the content complies with our policies and safety requirements,” with another clear statement that “Your conversations may be reviewed by our AI reviewers to improve our systems.”
This is hardly comforting language to anyone tasked with ensuring that organizational information will be protected and confidential if processed through the ChatGPT platform. In a similar fashion, all data security and privacy obligations are one-way, with the burden of compliance and security shifted to the user.
Depending on your businesses’ intended use case, it is important to note the restrictions laid out in the Section 2 Usage Requirements: “You may not (i) use the Services in a way that infringes, misappropriates or violates any person’s rights (emphasis added); (ii) reverse assemble, reverse compile, decompile, translate or otherwise attempt to discover the source code or underlying components of models, algorithms, and systems of the Services (except to the extent such restrictions are contrary to applicable law); (iii) use the Services to develop foundation models or other large scale models that compete with OpenAI (emphasis added); (iv) use any method to extract data from the Services, including web scraping, web harvesting, or web data extraction methods, other than as permitted through the API; (v) represent that output from the Services was human-generated when it is not; or (vii) buy, sell, or transfer API keys without our prior consent. You will comply with any rate limits and other requirements in our documentation. You may use Services only in geographies currently supported by OpenAI.”
We note that a few of the restrictions, which we italicized, are very broad and potentially problematic for a business organization. First, as we discussed above in the IP section, it is far from a legally settled issue whether the use of generative AI involves infringement of IP rights. In addition, a restriction that the Services cannot be used “to develop … models that compete with OpenAI” is difficult to quantify given the extensive breadth of the potential for what OpenAI “products and services” could be used for.
The Usage Policy also states that “the following set of use cases carry a greater risk of potential harm: criminal justice, law enforcement, legal, government and civil services, healthcare, therapy, wellness, coaching, finance, news.” OpenAI requires that for these use-cases, you must:
a. Thoroughly test ChatGPT models for accuracy in your use case and be transparent with your users about limitations
b. Ensure your team has domain expertise and understands/follows relevant laws
As of the publication of this article, the registration process to create an account states that “By clicking ‘Continue’, you agree to our terms and confirm you’re 18 years or older” followed by three prompts regarding more information on (a) ChatGPT being a free research preview, (b) how ChatGPT collects data, and (c) how ChatGPT encourages feedback. However, in Section 8 of the Terms, there is a mandatory arbitration and class action waiver provision. Generally these provisions are not of great concern to business organizations, but any limitation or restriction of legal remedies is worth noting.
While all terms are subject to change as ChatGPT evolves, it is important for business stakeholders and legal departments to understand the risks associated with current and future terms. Nelson Mullins has an experienced technology team to help businesses understand and implement technology. If you are interested in learning more about our practice, please reach out to one of the authors.
These materials have been prepared for informational purposes only and are not legal advice. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. Internet subscribers and online readers should not act upon this information without seeking professional counsel.