This is the first post in a series of posts by our team regarding the use and application of “artificial intelligence” or similar tools and related legal issues.
Our first post relates to reviewing OpenAI’s current Terms of Use which apply to the products and services of OpenAI (including Chat Generative Pre-trained Transformer, or “ChatGPT.”) Before we go too far, however, please remember that the entire world of artificial intelligence and machine learning is evolving, as are the use cases, and there are many challenges to consider before deployment. Having said that, a view of OpenAI’s “Terms of Use” does highlight some current and future legal issues that will need to be addressed.
For our own curiosity, we asked ChatGPT ”what issues do OpenAI’s terms of use have for corporations using the platform?“ It responded “It is important to note that the terms and conditions of OpenAI are subject to change and they are always updated, so corporations should keep a track of that and seek legal advice when necessary.” This seemed like sage advice and the following are some few key terms to consider as of today.
A quick primer: Chat GPT is one of the latest trending chatbots from OpenAI trained on using immense amounts of text data to generate human-like responses. With Microsoft Corp’s $10 billion investment in OpenAI and a new, paid subscription model ChatGPT Plus, many corporations are being inundated with potential use cases to create efficiencies and drive innovation. As is the case with any cutting-edge technology, legal departments are exploring the legal implications around implementing a product like ChatGPT or other generative tools.
Here is a brief analysis of issues to consider in the current terms for OpenAI (and ChatGPT):
- IP Ownership and Responsibility for Output
Ownership of data and other intellectual property is a paramount issue for most businesses, both to protect an organization’s virtual assets and to understand legal risk related to such ownership. IP ownership and use is covered in Section 3 of the Terms of Use. We may dive into deeper detail on this topic for a future article; However, for the purposes of this article, we note that the provisions seem favorable to the user on first glance. But after a deeper analysis, they lack some important clarity and actually transfer risk back to the user. For instance, each account holder owns all of the input they “provide to the Services” (defined as “Input,”) and OpenAI assigns to the account holder all “its” right, title and interest in ”output generated and returned by the Services based on the Input (“Output”)”. The word “its” is a notable caveat because it means that if OpenAI does not actually have the rights, there are no rights to assign. If OpenAI has any rights, those are assigned to the user; however, this assignment of ownership rights in the Output is followed by another important caveat, namely that the account holder, as owner of the Output, becomes “responsible for [the Output], including for insuring that it does not violate applicable law”, which is a significant shifting of responsibility given the myriad of potential legal issues surrounding whether the output created by generative AI may be the result of automated infringement of IP.
- Use of Content to Improve Services
Another provision worth noting is the use of “Content” (defined as the combination of Input and Output) to improve ChatGPT’s services. The terms state that:
“one of the main benefits of machine learning models is that they can be improved over time. To help OpenAI provide and maintain the Services, you agree and instruct that we may use Content to develop and improve the Services. You can read more here about how Content may be used to improve model performance. We understand that in some cases you may not want your Content used to improve Services. You can opt out of having Content used for improvement by contacting support@openai.com with your organization ID. Please note that in some cases this may limit the ability of our Services to better address your specific use case.”
The link about how content can be used claims to remove all personally identifiable information from the model improvement data as well as capping the number of API requests used for improvement per customer (i.e., 200 every six months). However, the ChatGPT General FAQs specifically note “we are not able to delete specific prompts…Please don’t share any sensitive information in your conversations.”
- Confidentiality, Security, and Privacy
Confidentiality of information is a major consideration for most organizations and a critical consideration for organizations, which are regulated by professional obligations to protect client or patient information. This is a major area where the ChatGPT terms are lacking. The terms provide only for one-way confidentiality protection, which would cover OpenAI’s confidential information, but there is no confidentiality provision which would protect a user’s information. Additionally, the FAQs state: “As part of our commitment to safe and responsible AI, we review conversations to improve our systems and to ensure the content complies with our policies and safety requirements,” with another clear statement that “Your conversations may be reviewed by our AI reviewers to improve our systems.”
This is hardly comforting language to anyone tasked with ensuring that organizational information will be protected and confidential if processed through the ChatGPT platform. In a similar fashion, all data security and privacy obligations are one-way, with the burden of compliance and security shifted to the user.
- Restrictions and Usage Policy
Depending on your businesses’ intended use case, it is important to note the restrictions laid out in the Section 2 Usage Requirements: “You may not (i) use the Services in a way that infringes, misappropriates or violates any person’s rights (emphasis added); (ii) reverse assemble, reverse compile, decompile, translate or otherwise attempt to discover the source code or underlying components of models, algorithms, and systems of the Services (except to the extent such restrictions are contrary to applicable law); (iii) use the Services to develop foundation models or other large scale models that compete with OpenAI (emphasis added); (iv) use any method to extract data from the Services, including web scraping, web harvesting, or web data extraction methods, other than as permitted through the API; (v) represent that output from the Services was human-generated when it is not; or (vii) buy, sell, or transfer API keys without our prior consent. You will comply with any rate limits and other requirements in our documentation. You may use Services only in geographies currently supported by OpenAI.”
We note that a few of the restrictions, which we italicized, are very broad and potentially problematic for a business organization. First, as we discussed above in the IP section, it is far from a legally settled issue whether the use of generative AI involves infringement of IP rights. In addition, a restriction that the Services cannot be used “to develop … models that compete with OpenAI” is difficult to quantify given the extensive breadth of the potential for what OpenAI “products and services” could be used for.
The Usage Policy also states that “the following set of use cases carry a greater risk of potential harm: criminal justice, law enforcement, legal, government and civil services, healthcare, therapy, wellness, coaching, finance, news.” OpenAI requires that for these use-cases, you must:
a. Thoroughly test ChatGPT models for accuracy in your use case and be transparent with your users about limitations
b. Ensure your team has domain expertise and understands/follows relevant laws
- Mandatory Arbitration and Class Action Waiver
As of the publication of this article, the registration process to create an account states that “By clicking ‘Continue’, you agree to our terms and confirm you’re 18 years or older” followed by three prompts regarding more information on (a) ChatGPT being a free research preview, (b) how ChatGPT collects data, and (c) how ChatGPT encourages feedback. However, in Section 8 of the Terms, there is a mandatory arbitration and class action waiver provision. Generally these provisions are not of great concern to business organizations, but any limitation or restriction of legal remedies is worth noting.
- Absent Provisions
An outstanding question exists as to whether the paid version of ChatGPT will impact any changes to the terms. The terms contemplate a paid version, which may be launched by the time of this blog, but currently the actual offerings are free of charge. Most customer protections that a business user would typically seek are notably missing from the current Terms of Use. For example, the current terms provide that the Services provided “as is” with no warranties. Furthermore, terms limit OpenAI’s liability, but not the account holders’, and specify that OpenAI’s damages “shall not exceed “the greater of the amount you paid for the service that gave rise to the claim during the 12 months before the liability arose or one hundred dollars ($100).” Maybe a paid version does not change anything, considering it is all a work in progress and largely unsettled.
While all terms are subject to change as ChatGPT evolves, it is important for business stakeholders and legal departments to understand the risks associated with current and future terms.
