Should Your Business Be Using ChatGPT? Understanding The Legal Risks

ChatGPT has quickly become a common business tool. From drafting emails and creating marketing content to brainstorming ideas and summarising documents, businesses of all sizes are exploring how generative AI can improve productivity.

But while AI is changing the way businesses work, it doesn't change the legal obligations they operate under. Whether your business chooses to use ChatGPT regularly, only for certain tasks or not at all is ultimately a commercial decision. If AI forms part of your business, it's important to understand the legal risks that can come with it.

After all, there's a big difference between asking ChatGPT to suggest ideas for a social media campaign and relying on it to draft contracts, analyse confidential information or communicate directly with customers. Knowing where to draw that line is becoming increasingly important as AI becomes part of everyday business.

Can Businesses Legally Use ChatGPT?

In most cases, yes. There is generally no law in the UK that prevents businesses from using ChatGPT or other generative AI tools as part of their day-to-day operations.

Rather than introducing a standalone legal framework for AI, the UK has adopted a principles-based approach. That means existing laws relating to data protection, consumer protection, intellectual property, employment, confidentiality and contracts continue to apply, regardless of whether work is completed by an employee or assisted by AI.

The real question therefore isn't whether your business can use AI. It's whether you're using it in a way that continues to meet your existing legal obligations.

Who's Responsible If ChatGPT Gets It Wrong?

One of the biggest misconceptions about generative AI is that responsibility somehow shifts to the technology itself. In practice, that's generally not how the law works.

If your business relies on AI-generated content or publishes it, your business will generally remain responsible for ensuring that content is accurate, appropriate and legally compliant. While ChatGPT can generate text, summarise information and draft documents, it doesn't understand your legal obligations, commercial objectives or the specific circumstances of your business.

UK regulators have consistently taken the view that organisations remain accountable for how AI is used. Rather than treating AI as a separate legal issue, businesses are expected to apply the same standards of care and oversight that would apply to any other business process.

Privacy And Confidential Information

Sometimes the biggest legal risks associated with AI isn't what it produces - it's what people put into it.

Employees often use AI to summarise emails, review contracts, draft responses or analyse documents. While these tasks can save time, they may also involve uploading confidential or personal information without considering the legal implications.

For UK businesses, this is particularly important because data protection obligations continue to apply when AI is used. Before entering personal data into an AI tool, businesses should consider whether doing so is consistent with the UK GDPR and the Data Protection Act 2018, whether they have an appropriate lawful basis for processing that information and whether any confidentiality obligations apply.

For example, imagine an employee copies a customer's complaint into ChatGPT to help draft a response. The complaint contains the customer's contact details, purchase history and internal notes about the dispute. Although the intention is simply to work more efficiently, the business should first consider whether sharing that information is appropriate and consistent with its data protection and confidentiality obligations.

The Information Commissioner's Office (ICO) has made it clear that organisations remain responsible for protecting personal data when using AI systems. In practice, that means understanding what information employees are entering into AI tools and ensuring appropriate safeguards are in place.

As AI becomes more common in UK workplaces, many businesses are introducing AI Policies to help employees use these tools consistently and responsibly.

Can ChatGPT Create Copyright Or Intellectual Property Issues?

Using AI can also raise intellectual property (IP) issues. While it makes creating content and solving problems easier, it can also create uncertainty around both the material businesses generate and the information they choose to share.

One common misconception is that anything generated by AI is automatically free from copyright concerns. In reality, this area of law is still developing. Depending on the prompts used, AI-generated content may occasionally resemble existing works or raise questions about originality and ownership.

For example, a business might ask ChatGPT to write website copy in the style of a well-known competitor or prepare training materials based on existing content. While the output may appear original, it's still worth reviewing before publication, particularly where originality is commercially important.

Businesses should also think carefully about what they're putting into AI systems. Uploading source code, product designs, trade secrets or confidential business processes may expose valuable intellectual property unnecessarily. Before sharing this type of information, it's worth understanding how the AI platform handles user data and whether doing so is consistent with your contractual and confidentiality obligations.

Can AI Content Breach Consumer Laws?

Many businesses use AI to help prepare marketing campaigns, website copy, customer emails and product descriptions. While AI can save time, businesses remain responsible for the claims they make to customers.

In the UK, businesses must continue to comply with consumer protection legislation, including laws that prohibit misleading commercial practices and false or misleading claims. These obligations apply regardless of whether content is written by an employee, a marketing agency or generated using AI.

Imagine asking ChatGPT to write a product description for an outdoor backpack. It describes the product as "100% waterproof" when it's actually only water resistant. The description is published without review and customers rely on it when making a purchase. If that claim is inaccurate, the business - not the AI - may still be responsible.

Because AI generates content by predicting language rather than verifying facts, it can confidently produce information that is incorrect. That's why customer-facing content should always be reviewed before it's published, particularly where it contains product claims, pricing or other information customers are likely to rely on.

Can ChatGPT Replace Legal Advice?

Generative AI has made legal information more accessible than ever. It can explain legal concepts in plain English, summarise legislation and help businesses understand unfamiliar legal terminology.

However, there's an important distinction between explaining the law and providing legal advice.

Legal advice usually requires an understanding of a business's specific circumstances, commercial objectives and appetite for risk. Two businesses operating in the same industry may require very different contractual protections depending on how they operate. 

For that reason, businesses should be cautious about relying on AI-generated information when making significant legal or commercial decisions. AI shouldn't replace professional advice where the stakes are high.

Should You Let ChatGPT Draft Contracts?

Contracts are one area where AI can genuinely save time. It can help explain legal terminology, suggest clauses or prepare a first draft, making it a useful starting point for many businesses.

However, even relatively simple commercial contracts should reflect the relationship between the parties, how risk is allocated and what each side is trying to achieve. They may also need to comply with industry-specific legislation or regulatory requirements.

This is where human judgement remains essential. AI can generate text, but it doesn't understand the commercial context behind an agreement. A clause that appears legally sound may not properly protect your business or reflect what the parties actually intended.

Whether it's a customer contract, supplier agreement, employment contract or shareholders' agreement, the final document should always be reviewed to ensure it reflects your business's objectives and legal obligations.

Other Legal Risks Businesses Often Overlook

Privacy, intellectual property and consumer protection are some of the most obvious legal considerations when using AI, but they're not the only ones.

If AI is used to support recruitment or performance management, employers still need to comply with employment legislation, including the Equality Act 2010. While AI may help identify patterns or rank candidates, decisions about hiring, promotions and disciplinary action should always involve human judgement to reduce the risk of unfair or discriminatory outcomes.

Businesses should also be cautious when publishing AI-generated content about individuals or competitors. If AI produces false or misleading statements that are later published, the business-not the AI-may still be responsible for the consequences.

For businesses operating in regulated industries, such as financial services, healthcare or legal services, additional obligations may also apply. Professional standards and sector-specific regulations continue to apply regardless of whether AI forms part of a business's workflow.

Does Your Business Need An AI Policy?

As AI becomes part of everyday business, one of the biggest challenges is consistency.

Without clear guidance, employees may each develop their own approach to using AI. Some might use it simply to brainstorm ideas, while others could begin drafting customer communications, analysing contracts or uploading confidential information without fully understanding the risks.

An AI Policy helps establish clear expectations across your business by setting out how AI should be used, what information can be shared, when human review is required and who is responsible for approving AI-generated work before it's used externally.

Like any internal policy, it should be reviewed regularly as your business grows, your use of AI evolves and the legal landscape continues to develop.

Key Takeaways

Generative AI is becoming an increasingly common part of doing business. For many organisations, it offers genuine opportunities to improve efficiency, support employees and streamline everyday tasks.

However, while the technology continues to evolve, the legal principles generally remain the same. Existing laws relating to data protection, confidentiality, consumer protection, intellectual property, employment and contracts continue to apply, regardless of whether work is completed by a person or assisted by AI.

If you would like a consultation on the legal considerations of using AI in your business practices, you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.