Enterprise AI: The Key Legal Questions

The masthead of my original hometown The Seattle Times has joined with Newsday to sue OpenAI and Microsoft over scraping paywall news content to train their AI models. The latest in a series of similar suits already ongoing.

And Journalism is far from the only subject on which AI builders and major tech vendors are facing legal and legislative pressures. OpenAI just recently expanded its senior policy team to address all of the headwinds.

But I think there is a bigger enterprise question emerging:

How much latent legal liability is being embedded into AI investments today?

Large organisations are building AI capability on top of foundation models they did not train, using datasets they did not collect, under legal interpretations they did not establish.

Then they add proprietary data, RAG, fine-tuning, agents and operational workflows. Over time, that capability becomes part of the organisation’s own intellectual property and competitive advantage.

But what happens if part of the legal foundation underneath it is later found to be unlawful?

The real enterprise risk may go well beyond whether the vendor pays a copyright settlement.

Could a company become exposed because of data it supplied for fine-tuning or retrieval?

Could customised models, datasets or derivative assets have to be withdrawn, rebuilt or destroyed?

Would vendor indemnity still apply where the enterprise introduced disputed material itself?

Who pays to retrain accumulated AI capability on a legally cleaner foundation?

What happens to business processes that depend on a model that can no longer be used in the same way?

And will licensing, settlement and compliance costs simply flow through into higher enterprise AI pricing?

The legal outcome is far from settled. Some courts have already accepted that certain AI training can qualify as fair use. Other disputes have turned heavily on whether the underlying material was lawfully acquired.

That distinction matters because Enteprise AI may ultimately inherit not only the capability of the models it uses, but some of the consequences of how that capabilty was created.

So AI governance needs to extend beyond security, privacy, accuracy and explainability.

Enterprises should also be asking:

• What legal assumptions is this AI capability built upon?

• What rights exist over the data used to train, fine-tune and augment it?

• How portable is our capability if those assumptions later change?

The future cost of AI may not just be compute, tokens and licences.

It may also include the cost of legal provenance.

And enterprises that ignore that risk today may discover that some of today’s AI innovation becomes tomorrow’s remediation program.