Artificial intelligence in your company: four legal risks nobody is watching

1. Do you have a lawful basis to process that data?

The consent you obtained covers the purposes you disclosed. If the original purpose was “commercial management” and the data now feeds an AI model, that purpose must be covered or fresh consent is required.

2. Can the vendor train on your information?

Default terms of many tools allow entered data to be used to improve the model. In a business context that can mean international data transfer and loss of confidentiality towards clients under live non-disclosure agreements.

3. Who answers for the automated decision?

If the system denies credit, screens a CV or classifies a claim, liability towards the affected person rests with the company that deployed it. Contractual allocation of liability with the vendor is the control almost nobody negotiates.

4. Can you explain how the decision was made?

Facing a complaint, the company must be able to reconstruct what information was used and under what criteria. Without traceability, defence becomes very difficult.

The right order

Internal use policy, risk matrix by use case, contractual review with the vendor and only then deployment. Two weeks invested in that order avoids years of argument.