How your use of AI should feature in your legal documents

If you’re using AI (which I think most people reading this will be), then you’ve got an obligation to tell your clients how it’s being used.

We should be getting a mutual non-disclosure agreement (MNDA) in place early on in the new business process. Some agencies only include confidentiality provisions in a master services agreement (MSA) or contract and I think they’re missing out (and I’ve written about why agencies should push for an NDA here). So I’m going to assume that you have an NDA in place with each of your clients.

An NDA prevents you (a MNDA prevents each party and I’m going to assume that’s what we have here) from disclosing your client’s confidential information to third parties.

Uploading confidential documentation (e.g. a creative brief) to an AI platform (e.g. ChatGPT) can be a disclosure of confidential information to a third party and you’ll be in breach of your NDA (and, likely, your contract).

Generally, when we’re negotiating contracts, we’ll seek to cap liability (usually to the value of the contract), so if we’re sued for damages, the client isn’t going to get more than they paid us in the first place. It’s quite common, however, for breaches of confidentiality to be carved out of that and, therefore, uncapped: not disclosing confidential information should be something that’s wholly within our control.

So, if we upload confidential information to a public* AI, we’re probably in breach of contract and liable for unlimited amounts of money.

(Some clients are reacting to this by seeking to include provisions in their contracts that prohibit the use of AI completely, so uploading the client’s confidential information to an AI platform is not only a breach of confidentiality, it’s also a breach of a contract clause.)

Intellectual property is also a legal minefield. In the UK (and many other jurisdictions), machine generated works often don’t qualify for copyright protection. Your contract probably promises that the client will own the campaigns you’ve produced for them (ideally only after they’ve paid you), but if you generated that content using AI, are you absolutely confident that you own it (and are therefore able to pass ownership onto the client)?

So, now we’ve established that someone has copyright ownership of a campaign and, knowing that the only way AI functions is to ingest campaigns owned by someone else and steal bits, how confident are you that your AI generated creative isn’t infringing on someone else’s copyright? Of course most companies don’t have the resources to pursue you for this, but if you accidentally steal something from Disney or Nintendo then you’ll know about it…and your contract probably gives some kind of assurances to the client that you aren’t going to be infringing other people’s copyrights (possibly with an indemnity), so this will probably end up being your problem rather than your client’s.

What should you do about this?

• You should specify, in your NDAs and/or contracts, what you will and will not use AI for (e.g. you won’t upload client confidential information but you will use it generally in the provision of services)
• You should maintain AI policies (and ensure compliance from your team) that make sure people aren’t using AI in ways that your contract prohibits (e.g. “if you’re trying out the latest LLM, don’t upload confidential information to it”)
• You should keep a record of the content creation process and where AI featured (e.g. “we used [generative AI tool] to produce an initial concept that [the client] saw, then we gave the concept to a designer to produce the final creative”). This is good practice anyway, even if you’re not using AI, because there are often provisions around subcontracting in your legal documentation and, if nothing else, you want a paper trail that details what the client saw and what they approved in case of disputes around things like amends
• On that subject, Article 50 of the EU’s AI Act requires us to disclose the use of AI, so if the deliverables are going to be used in Europe, we need to be transparent about this. For the better part of a decade, my agencies’ contracts have included provisions under “client’s obligations” for compliance with the law (e.g. it’s not our fault if you don’t have a cookie pop-up, it’s yours); if the client is to disclose use of AI (as is the legal requirement), then they need to know all the uses of AI in their supply chain, so we need to be honest with them if that’s what we’re doing
• You should listen to Sharon Playford speaking about this on Lucy Mann’s excellent Small Spark Theory podcast. I’ve paraphrased a couple of Sharon’s points, since she’s the person who introduced me to this new set of worries, but she, unlike me, is actually a lawyer.

How I use AI

I’ve spent a lot of time considering whether to share how I use AI publicly, quite simply because it’s a polarising topic. But, here it is (🫰 we listen and we don’t judge 🫰):

• I use Google Workspace, which means most of my calls are recorded by Gemini. This is because a) some of my clients ask me for the notes, b) there’s then a papertrail of what we spoke about, and c) I sometimes find it helpful to upload transcripts to NotebookLM and ask questions like “how much time did we spend discussing [issue/person] without making a decision?” and playing that back. If we meet in person then I’ll be using a pen and notebook; if we’re speaking on a call then I’ll be making notes in Google Keep (because Gemini is often ✨ wrong ✨ and invents actions/forgets actions/paraphrases things incorrectly). Some calls inevitably cannot be recorded because of confidentiality and, in general, if you said “you can’t use an AI notetaker, I’d be perfectly fine with that
• There are other standard AI enabled features in Workspace, like predictive text and spam filters, that I don’t turn off
• Most Google searches I conduct are using AI Mode nowadays
• Not a single piece of content I have ever produced for this site/newsletter or deliverable I have produced for a client has ever touched AI in any way, for the following reasons: a) I have an enormous list of content ideas based on the discussions I have with clients/my own experience, so I don’t need AI to give me more; b) I find editing stressful and I need to understand how things work, so I’ll often recreate documents from scratch because I prefer to start from a blank page (if I start an article for the newsletter and feel like it gets too messy, I’ll often start it again in a new Doc and paste bits in; or I’ll rebuild spreadsheets myself so I can more easily comprehend the formulas); c) my DISC profile says I’m low aesthetic…I’ve always hated stock imagery and I don’t feel the need to add pictures to anything I do, so I never need to generate new ones. This is partially why my branding is basically just the colour red: thank you for putting up with this from me
• On that subject, I try to make use of the services offered by humans I like. This website was built by the fabulous Rich Knight, for example
• Some of my clients use AI for things and I am supportive of that, so in their case I will use the things (e.g. if they are using some sort of AI tool in their CRM then I will be using it also in their CRM). This line is deliberately ambiguous because it doesn’t affect you unless you want it to

I am privileged(?) to not have (or want to have) employees, so I don’t need to think too much about efficiencies and, since I work in an advisory capacity, most of my work happens face-to-face (or on calls etc.) so I don’t need to think about getting to outputs faster. When I do need to get to outputs quickly, they tend to be things that come up pretty often, so I usually build tools in Google Sheets (e.g. new business audit frameworks, or resourcing models that spit out what everyone’s utilisation targets should be).

As you’d probably expect, many of my clients are using AI more extensively than I am, so I get to talk about what typical agency AI usage looks like, plus what it’s capable of, for which I am very grateful!