Beware How You Use AI - Once Your Data is Out, You Can't Put it Back

There is a lot of pressure to adopt AI tools - be it from boards, shareholders, customers, clients, members, the C-Suite, managers - or even pressure we presume upon ourselves. AI is constantly in the media spotlight, and it can be easy to assume if we're not on it, or ideally ahead of it, we'll be left behind. Never before have we seen a new technology make the leap from novelty to commodity in such a short time span. In less time than it has taken a student to begin and end high school, AI, in the sense that we now discuss it, went from practically nonexistent to being shoehorned into every online platform you use. It looms across all the giants, Google, Microsoft, Meta, Slack, etc., through CRMs like Salesforce and Hubspot, and is woven into design and development tools like Adobe, Figma, GitHub. Even DIY tools like Canva and SquareSpace and and so many others have adopted some sort of AI. AI no longer feels like something to prepare for; it feels like something you have to be dealing with right now.

That urgency will undoubtedly be the thing that gets many organizations in trouble over the next few months and years. Under stress we are wired to make more reactionary, and more binary choices. In this era of AI adoption, a single wrong choice may unintentionally share all of your organization’s data - research, archives, commercial content, user data, PII, PHI, etc.- and once it has been shared, it may be impossible to get back. As goes the classic line from Juno, "This is one doodle that can't be undid home skillet."

Many have already covered the cybersecurity risks of AI - today's conversation is more about intentional (if reactive) and legal implementation of AI platforms without understanding the nuance or risks in their terms of service. It may be easier than you think to unintentionally give an AI company, sometimes ones you don't even think you're working with, access and permission to use your data in a broad variety of ways.

An AI Cautionary Tale

A client we work with creates a large volume of research data. Access to this data is a major driver of revenue for their organization. The organization is several decades old and, over time, has accumulated hundreds of thousands of valuable pieces of content. So much so that it can be quite burdensome for their customers, who are paying for access to this data, to sift through it all to do the work they need to do, and feel like they've done an adequate job parsing the information well enough to draw conclusions. Of course, speeding this research work is a great application of an AI platform (often in conjunction with a RAG application, more on that in this podcast Association Tech Insider - RAG in the Real World).

The person responsible for the decision to implement AI to catalog the data was under immense pressure, as you can imagine. They had customers clamoring for this feature, as well as pressure from their bosses, their board, and other stakeholders across the organization. Not a day went by that they didn't hear a complaint or comment about how nice it would be to have this capability built into their websites and platforms. As you can imagine, this became one of their top priorities, and was something they wanted to get implemented ASAP.

They evaluated and tested a handful of tools, all of which promised to make it easy to crawl and catalog all of their content on behalf of their members. Believing all these companies to be mature and responsible platforms (which, perhaps in such a novel field, should not be an assumption we make), they planned to implement a particular AI on an accelerated timeline, reducing their normal procurement and review process from months to weeks.

The accelerated timeline worked, and after a small demo, they were prepared to sign a contract with the new platform. Our team was a part of this process, and being aware of some of the concerns around data use, suggested a legal review of the terms before signing. There were three elements we, collectively, were concerned about:

1. Third Party AI Platforms - While this platform provided a specific front end interface, it was powered by third party models, and it was not clear what data was shared with those partners and how it was able to be used.

2. Broad Data Usage Terms - One section of their terms of use afford the AI platform use of the data to provide the services agreed to, other sections of the agreement provide much more sweeping and broader terms.

3. Terms May Change - The terms and AI features were subject to change at any time at the sole discretion of the AI platform.

Futureproofing Your Intellectual Property

During the ensuing conversation with their team, their legal counsel, and our team, we mapped out some of the most severe risks. The most important one came up around permission and copyright of their IP.

The AI platform's terms said they would not train directly on this customer’s data. However, their terms also included the following:

• You acknowledge some elements of the AI platform's features are provided through third party AI service providers. You acknowledge that your AI Input and AI Output, including Customer Data, will be shared with and processed by our AI service providers, in order to enable your use of the AI platform, content moderation, and other business purposes consistent with this Agreement.

• You grant the AI platform a perpetual, irrevocable, worldwide, royalty-free, sublicensable, non-exclusive license to create, process, reproduce, store, display, modify, translate, create derivative works from, make available and otherwise use Aggregated Data in connection with developing, providing, maintaining, supporting, or improving the application or any of the AI platform’s current and future products and services, or for any other lawful purpose.

A repeated touchstone of our conversation was the New York Times v Open AI lawsuit currently underway. It is almost certain that one of the third party models being used by the platform is Open AI's ChatGPT, and as such, we had the valid concern that the following could happen:

• This client could use this AI platform, and thereby provide all of its information to Open AI through this AI partner

• The aforementioned cases' judgement is in favor of the New York Times, and sets a precedent that AI companies must compensate copyright holders for use/training on their data

• This client, having willingly (if unwittingly) shared their information with Open AI, would then not have grounds to receive compensation for Open AI training/using their data

• By virtue of this fact, Open AI would then be able to share this content, the thing that enables this organization to exist, publicly and thereby remove their ability to support and generate future research

  • Their situation is very similar to that faced by journalism outlets, which is: if AI steals all the journalism, and reduces the revenue to produce that journalism, they will, in short order, eliminate the journalists doing the work for them to steal, and then where will we be?

  • While "researching" this, I noticed each of the search engines/LLMs had very different responses to this topic, so I included a little companion piece here if you're interested in seeing how they respond to this accusation.

It is exceedingly likely that thousands of organizations have already implemented or authorized AI utilities or tools that will access information they won't be able to get back. Don't be one of them. While it can feel overwhelming or inevitable, know that a little bit of caution and a brief pause to be intentional and mindful of how your organization leverages AI can make an outsized impact on your future.

As with so many things that might feel urgent now, when you look back, you'll have rather done it right, than have done it in a rush.

###

• https://www.upguard.com/blog/third-party-risk-ai-models-trained-on-user-data/

• https://votiro.com/blog/the-hidden-risks-in-ai-training-data-and-how-to-eliminate-them/

• https://thedecisionlab.com/insights/health/stress-redesigns-decision-making/

• https://hls.harvard.edu/today/does-chatgpt-violate-new-york-times-copyrights/

• https://arxiv.org/abs/2307.16382/

• https://frostbrowntodd.com/managing-data-security-and-privacy-risks-in-enterprise-ai/

• https://www.whitefordlaw.com/news-events/client-alert-avoiding-legal-pitfalls-and-risks-in-workplace-use-of-artificial-intelligence/

• https://www.traverselegal.com/blog/ai-data-ownership-legal-risks/