I
n the world of cutting-edge technology, few buzzwords have ignited as much excitement and captured the collective imagination quite like generative AI, the current reigning star in the ever-evolving realm of innovation.
Generative AI is a branch of artificial intelligence that, through machine learning from existing data, can create new content such as text, images, music, code and more, when prompted. Technologies such as Open AI’s ChatGPT and Google’s Bard have, in what seems like the blink of an eye, burst onto the scene and become incredibly popular and accessible for businesses and individuals who want to leverage the benefits of generative AI in their work. Whether it be for content creation, design, streamlining operations, analysing user behaviour or countless other applications, there has been a massive drive to incorporate and utilise generative AI to help transform businesses in South Africa, making it an invaluable tool in today’s rapidly advancing digital landscape.
…generative AI also poses significant legal risks and challenges for businesses that use or develop these technologies.
That being said, generative AI also poses significant legal risks and challenges for businesses that use or develop these technologies. In this blog post, I will traverse some of the key legal implications of using generative AI in South Africa and provide some recommendations for businesses to mitigate these risks.
Regulatory Compliance
As it stands, South Africa has not yet formalised any policy documents or entered any bills to parliament for the regulation of AI. This means that there is currently no specific legal framework or guidance for businesses that use or develop generative AI in South Africa. This does not, however, mean that generative AI is unregulated or exempt from existing laws and regulations that apply to data protection, intellectual property, competition, consumer protection and other relevant areas of the law.
One of the main legal issues that businesses need to consider when using generative AI is data protection. The Protection of Personal Information Act of 2013 (“POPIA”) regulates the processing of personal information in South Africa and imposes various obligations and restrictions on data controllers (AI Developers) and processors (AI users). Personal information is broadly defined as any information that can identify a person or a group of persons, such as name, address, email, phone number, biometric data, health data and more.
When using generative AI, businesses need to ensure that they comply with POPIA when they collect, use, store, share and transfer personal information in their prompts or outputs. For example, they would need to:
- Obtain consent from data subjects before processing their personal information for generative AI purposes;
- Inform data subjects about the purpose and nature of the processing and their rights to access, correct or delete their personal information;
- Implement appropriate security measures to protect personal information from unauthorised access, loss or disclosure;
- Limit the retention of personal information to the minimum period necessary for the processing;
- Ensure that cross-border transfers of personal information are done in accordance with POPIA’s requirements and safeguards.
Another legal issue that businesses need to consider when using generative AI is intellectual property. The Copyright Act of 1978 protects the original works of authors from being copied or reproduced without their permission. When using generative AI, businesses need to ensure that they do not infringe the copyright of others by:
Data Bias and Discrimination
Another legal implication of using generative AI is data bias and discrimination. Data bias refers to the situation where the data used to train or input generative AI is not representative, accurate or fair. Data bias can result in generative AI producing outputs that are skewed, inaccurate or unfair. Discrimination refers to the situation where generative AI treats people differently or unfairly based on their characteristics, such as race, gender, age, disability or religion.
When using generative AI, businesses need to be aware of the potential for data bias and discrimination and take steps to prevent or mitigate them. For example, businesses should:
- Use diverse, balanced and verified data sources to train or input generative AI;
- Test and audit their generative AI models and outputs for any signs of bias or discrimination;
- Implement feedback and correction mechanisms to address any issues of bias or discrimination;
- Ensure that their generative AI outputs are transparent, explainable and accountable;
- Respect the human dignity, autonomy and rights of the people affected by their generative AI outputs.
Liability
A final legal implication of using generative AI, that ties together what has been discussed above, is liability. Liability refers to the legal responsibility for the consequences or damages caused by one’s actions or omissions. When using generative AI, businesses could face potential liability claims from various sources, such as:
- Clients: businesses could be liable for breach of contract, negligence or misrepresentation if they fail to deliver the expected quality, accuracy or performance of services/products that make use of generative AI as part of their output to clients;
- Users: businesses could be liable for defamation, privacy invasion or discrimination if they generate or publish discriminatory, harmful, false or offensive content using generative AI that affects the reputation, dignity or rights of users;
- Third parties: businesses could be liable for infringement, unfair competition or interference if they generate or use content using generative AI that violates the intellectual property, trade secrets or contractual rights of third parties;
- Regulators: businesses could be liable for fines, penalties or sanctions if they violate any applicable laws or regulations when using generative AI.
It is also crucial to note that employers are, ultimately, responsible and vicariously liable for the actions of their employees if the action is committed during the course and scope of conducting the employer’s business. As such, employee breaches of POPIA or copyright infringement for example, would leave an employer liable. It is, thus, vital for businesses to institute strict policies, procedures and training on generative AI use in the workplace, in order to mitigate risk and limit liability.
Conclusion
Generative AI is a powerful and innovative technology that can offer many benefits and opportunities for businesses in South Africa. However, it also poses significant legal risks and challenges that need to be carefully considered and managed. Businesses that use or develop generative AI in South Africa should adopt a responsible and proactive approach to ensure that they comply with the applicable laws and regulations, prevent data bias and discrimination, avoid liability claims and uphold ethical and social values.
Author | Richard Thompson
