[IT Litigation] Legal checkpoints that companies must review when utilizing generative AI APIs

Recently, with the rapid advancement of generative AI, companies are developing various services by utilizing generative AI APIs. However, caution is needed as various legal risks may arise in accordance with laws such as the 「Personal Information Protection Act」 and the 「Copyright Act」 during the process of applying generative AI APIs to corporate practices. In order for companies to safely utilize generative AI APIs, they need to review these legal issues in advance and develop response strategies.

What is a Generative AI API?

API (Application Programming Interface) refers to the method by which two software programs communicate interactively through requests and responses. Generally, a 'generative AI API' means a service that provides the ability to call and use the functions of AI externally through a software interaction protocol. Companies can easily utilize generative AI APIs to develop, provide, and improve services, such as text generation, image generation, and code writing.

However, there are key points where legal issues may arise when using generative AI APIs. If companies introduce APIs without understanding these, they may bear the risk of unexpected legal disputes or legal violations. 

Major Legal Issues That May Arise When Using Generative AI APIs

1. Copyright Issues Arising from Data Collection and Use

Generative AI APIs collect and utilize large amounts of data in the learning and output generation process, which may lead to copyright issues such as infringement of the original author's right of reproduction. Particularly, copyright infringement may be an issue if the data learned by AI or the output generated by it are similar to or identical to existing copyrighted works. 

2. Issue of Ownership of Copyright of Generative AI Outputs

Text, images, code, and other outputs generated using generative AI APIs may be protected within the scope of existing copyright laws. However, there is much legal controversy regarding who the copyright belongs to for content generated by AI.

 ① Identifying Whether Copyright is Recognized for AI Outputs 

Currently, many countries do not legally recognize copyright for the results generated by AI. Therefore, it is important for companies to clearly identify the ownership and copyright status of content produced through generative AI APIs.

 ② Review of API Provider Contracts

It is necessary to carefully review the terms and conditions of the generative AI API provider to clearly determine whether the ownership and intellectual property rights of the results generated by AI belong to the API provider or the user.

3. Issues of Personal Information Processing and Protection of Confidential Information

If personal information is included in the AI learning data, there is a risk of violating the Personal Information Protection Act. Therefore, when companies introduce generative AI APIs, they must beforehand review whether the AI model is not infringing on the personal information of information subjects in the process of learning or using data containing personal information.

Furthermore, when companies utilize generative AI APIs, there is a risk that personal information or confidential information of users may be leaked externally. Especially if the environment is not an on-premise environment where the company itself holds and operates the API, there is a high possibility that personal information or confidential information collected by AI may be exposed directly or indirectly to other users.

Even if an on-premise environment is built, the risk of information leakage cannot be completely eliminated if internal security policies are inadequate. Especially when generative AI APIs are operated based on a cloud or external server, there is a possibility that user input data may be stored or inadvertently shared, so companies must thoroughly establish security measures to prevent sensitive information from being leaked externally.

Generative AI APIs provide great opportunities for corporate service innovation, but they may also pose legal risks. Particularly, the 「Copyright Act」, 「Personal Information Protection Act」, and intellectual property rights issues are core legal issues that companies must consider when introducing AI APIs.

It is important for companies to cooperate with legal professionals experienced in AI affairs to check legal risks in advance, clarify data protection and ownership issues, and safely utilize generative AI APIs. 

Law firm Veat has extensive experience in AI and IT fields and provides general legal advice on legal issues related to AI, IT, and new technologies, as well as comprehensive advice on matters such as personal information protection and intellectual property rights. 

Furthermore, we continuously monitor trends in amendments to AI-related laws and establish optimized response strategies to prevent legal risks that companies may face.

In particular, Law firm Veat's IT and personal information protection specialized attorneys are active as PIPL (Personal Information Protection Law) reviewers and members of the Y University AI Convergence University Curriculum Innovation Committee, demonstrating a deep understanding of AI and providing legal advice and legal support.

If your company is planning to introduce generative AI APIs or other AI software, please feel free to consult with Law firm Veat to check legal risks and establish safe operating methods.

Thank you.

Law firm Veat