It didn’t take long for generative AI technology to end up in court.

Does this recent rush of litigation indicate that every organisation which builds or deploys generative AI technology is at risk of a lawsuit? The short answer is no. Outside the US, things have been calmer. The only notable cases in Europe are Getty Images' claim against Stability AI, filed in London, and a claim in Hamburg brought by a photographer against a German non-profit organisation that builds widely used AI training datasets. But the technology is moving quickly, and a business model which is low-risk in one country may be high-risk in another. This complexity is compounded by the speed at which the law around AI is evolving as regulators and the courts scramble to keep up.

Amid all the noise, there are themes which emerge and predictions which can be made.

Generative AI litigation so far

Almost all claims to date have been filed in the United States, with the courts in the Northern District of California and Southern District of New York taking the lion’s share. They have been targeted at developers of generative AI models (rather than their users) and have all included an allegation that a developer has infringed the plaintiff’s copyright through the alleged use of copyright works to train an AI model. Some claims have gone further and alleged that the trained AI models themselves are an infringement of copyright in the underlying training data and that outputs from the models also constitute infringement. In some cases, these broader allegations have been the subject of motions to dismiss by the plaintiff, resulting in narrower amended claims and a general trend for plaintiffs in more recent claims to focus on allegations relating to the direct use of copyright works in training. A fundamental issue in these US copyright claims is whether the use of copyright works to train a generative AI model falls within the doctrine of “fair use” under US copyright law.‍

Does the same apply in the EU and UK?

Things have not been quite so frenetic outside the US. The only proceedings to reach European shores so far is a claim filed in London by stock image provider, Getty Images against Stability AI. The claim alleges that Stability has infringed Getty’s copyright and database right when training its image generator, Stable Diffusion. It also alleges that certain outputs from Stable Diffusion infringe Getty’s copyright, database rights and trade marks and that Stable Diffusion itself is an “infringing copy” of its training data.

The position in the UK and EU differs somewhat from the US due to the absence of a general “fair use” exception to copyright. Instead, EU and UK law provide limited exceptions to copyright for activities referred to as “text and data mining”. While it’s usually accepted that these exceptions can extend to the use of copyright works in AI training, they only apply in certain circumstances.

The UK’s text and data mining exception is narrower than the EU’s, permitting a person with lawful access to a work to computational analysis of anything recorded in a copyright, but only where that analysis is for the sole purpose of research for a non-commercial purpose. A UK Government consultation in 2022 resulted in a proposal to introduce a broad commercial text and data mining exception, although this was dropped in early 2023 following substantial pressure from the creative industries.

Who’s at risk of litigation?

One reading of the current litigation landscape would be that litigation risk is all about copyright and is primarily an issue for the largest generative AI developers. While it’s factually correct to say that the big developers have been the primary target for copyright claims so far, this misreads the broader risk profile of AI litigation:

- While the claims to date have been against AI developers, allegations that AI models themselves can infringe copyright could, if correct, be levelled against deployers of generative AI systems.

- Even users who simply prompt generative AI models might be at risk if courts determine that the model's outputs can infringe copyrights. In such cases, the might be viewed as causing or contributing to the copyright violation by making the prompt.

- While training a generative AI model used to be a highly capital intensive activity, costs are coming down. This allows a broader pool of organisations to develop models which are bespoke to their industry sector and use cases, while also exposing these organisations to potential litigation risk for their development activities.

- AI is an inherently probabilistic technology. Offering, deploying or using it in a context where getting things wrong matters will expose an organisation to litigation risk and will increasingly become an area of focus, e.g. under the EU’s proposed AI Liability Directive.

Mitigating litigation risk

Organisations which focus on the following areas are likely to lower their litigation risk:

- AI education and governance: AI governance frameworks and employee education programs can be used as an effective tool to steer an organisation away from potential litigation risks.

- Data governance: A strong data governance framework will help an organisation identify and mitigate risks which may arise from using data to develop AI systems, or as part of their deployment. ‍

- Digital supply chain management: Litigation risks arising from supplier use of AI technology can be mitigated through polices and contractual terms, such as warranties and indemnities. Similarly, exposure to litigation risks when supplying AI technology and outputs can be managed through acceptable use policies and other contractual terms.

Looking ahead

Both the EU and China have already introduced substantial regulation of AI systems, with other jurisdictions not too far behind. Apple recently agreed to follow the Biden administration's voluntary AI guidelines (Bloomberg 2024¹, White House 2023²) and Colorado’s Act Concerning Consumer Protections in Interactions with Artificial Intelligence Systems is set to take effect in 2026.

Regulation goes hand in hand with enforcement, and in jurisdictions such as the US, enforcement actions are often pursued through litigation. Aside from copyright and other rights relating to data, we can therefore also expect growth in regulatory litigation.

Existing regulation already has quite a lot to say about AI systems, especially when it comes to their use of personal data. European data protection authorities are watching developments carefully and have launched investigations into certain AI providers. Private actions for data protection principles are also not unheard of, and at least one privacy advocacy group has already filed a regulatory complaint against a large generative AI provider, claiming their rights have been breached.

‍

‍Toby Bond is a partner in the Intellectual Property Group of Bird & Bird.