Question 1

Letting a customer-facing AI chatbot quote your own policies

Accepted Answer

If your bot promises it, you bought it. "The AI said so" is not a defence, it is a confession. A company tried to argue in a real tribunal that its website chatbot was a separate legal entity responsible for its own words. The tribunal did not laugh, but it was close. Your bot is you. Everything it says is a representation your business made. An AI that confidently invents a refund policy you do not actually offer is not a quirky helper. It is a liability machine generating promises you are then on the hook to honour.

Question 2

Trusting an "AI lawyer" to generate valid legal documents unsupervised

Accepted Answer

"Robot lawyer" is a marketing phrase, not a malpractice policy. The robot does not carry the risk. You do. A regulator went after a company that marketed an "AI lawyer" claiming it could generate perfectly valid legal documents and replace human attorneys, without testing accuracy or having actual lawyers verify the output. Marketing AI legal work as attorney-equivalent without substantiation is a deceptive-practices problem. A contract that looks lawyerly and is quietly wrong is more dangerous than no contract, because it gives you confidence right up until the moment it fails you in front of someone who reads it for a living.

Question 3

Asking AI whether your already-signed settlement is still binding

Accepted Answer

You signed it. The model did not. Guess which of you the court cares about. This one is genuinely unsettled, which is exactly why it is dangerous. An AI telling someone their signed, released settlement "is not really binding" can trigger real disputes, including claims of contract interference and unauthorized practice of law against the AI's maker. A model does not know the procedural posture of your case, the exact release language, or the jurisdiction's rules. It pattern-matches confidence onto a situation where being wrong unwinds something you already agreed to.

Question 4

Citing cases from an AI without checking they exist

Accepted Answer

The model will invent a case, a citation, and a quote, and present all three with the same calm confidence it uses for the real ones. This is the founding cautionary tale of the entire genre. Lawyers filed a brief citing six entirely fabricated decisions a chatbot produced, complete with fake quotes and fake judges. Asking the chatbot "are these real?" and being told "yes" is not verification. It is the same machine lying to you twice. An AI optimizes for text that looks like a citation, not for a citation that exists. A perfectly formatted reporter number with a plausible case name is the easiest thing in the world for it to generate and the hardest thing for a busy person to doubt.

Question 5

Assuming a hallucinated citation just gets you a small fine

Accepted Answer

A fine is the cheap outcome. The expensive one is your name on a referral to the disciplinary panel. An appellate court did not just fine a lawyer for citing a nonexistent AI-generated case. It referred her to its grievance panel for a disciplinary investigation. The duty to make a reasonable inquiry before you sign a filing applies in full to AI-assisted research. There is no "the computer did it" exception. The reputational cost lands harder than the dollar figure. A published opinion describing how you cited a case that does not exist follows your name around far longer than a five-figure sanction does.

Question 6

Trusting your firm's in-house AI tool to get the citations right

Accepted Answer

A hallucination with your firm's logo on it is still a hallucination. The branding does not make the cases real. Even a major firm's own internal AI tool produced filings citing cases that did not exist. "It is our proprietary system" buys you nothing if nobody opened the cases. The signing attorney still carries the responsibility, no matter whose model generated the draft. Notably, the firm itself avoided sanction by showing it had since mandated independent verification. The tool was not the safeguard. The policy of checking every cite was.

Question 7

Passing AI-generated "research" to your own lawyer to file

Accepted Answer

Negligent and reckless land in different places. Neither is a place you want to explain how you got there. There is a real, narrow line here. In one matter a defendant passed fake citations from a chatbot to his lawyer, who filed them. The judge declined to sanction, calling the conduct negligent rather than bad faith. That is not a safe harbour. It is a near miss that depended on the specific facts. The contrast with the famous sanctions cases is the whole lesson: the difference between a fine and a pass can come down to intent, and you do not get to decide after the fact which side of that line a court will put you on.

Question 8

Using AI to brainstorm research angles, then verifying every word

Accepted Answer

AI is a fine place to start a search. It is a catastrophic place to end one. This is the version that actually works. Used as a brainstorming partner, AI is genuinely useful: it surfaces angles, drafts plain-language summaries, and helps you build a list of things to go check. The danger only appears when the suggestion becomes the citation without a human in between. The whole disaster genre exists because people skipped the verification step. Keep the step and the same tool becomes an asset instead of a liability. The skill is knowing which of its outputs need a source and which do not.

Question 9

Training or feeding AI on personal data with no legal basis

Accepted Answer

"It was on the internet" is not a legal basis. In the EU it is barely an excuse. A data protection authority handed down a major eight-figure fine over training an AI on personal data without a valid legal basis, alongside transparency failures and a missed breach notification. It was the first big generative-AI penalty under EU data law, and it will not be the last. The instinct that public means free to use does not survive contact with GDPR. Personal data carries obligations regardless of where you found it: a lawful basis, transparency about what you are doing, and a way for people to exercise their rights.

Question 10

Relying on AI output about a real, named person

Accepted Answer

When a model invents a crime and attaches a real person's name to it, that is not a glitch. Under data law it is an accuracy violation. A model once told a real man he had murdered his own children and served decades in prison, mixed in with true details like his actual hometown and family. Under EU data law this is not just defamation. It is a data-accuracy problem, and the inability to correct or erase the falsehood is itself a violation of the right to rectification. This area is still being decided, which is the point. The accuracy and rectification obligations attach to AI-generated statements about people the same way they attach to a database record, and "the model said it" does not discharge them.

Question 11

Assuming "publicly available" means free to scrape and train on

Accepted Answer

Visible and permitted are not the same word. People keep paying lawyers to learn the difference. Sweeping class actions advanced the theory that scraping billions of words and personal details to train models, without consent, implicates privacy and data rights. Some of those particular suits faltered on procedure, so treat them as theory-setters rather than wins. But the theory itself is now firmly on the table. Public visibility is about access, not permission. A photo, a post, or a profile being reachable says nothing about whether you may ingest it into a commercial model. That second question has its own rules, and they are tightening.

Question 12

Feeding AI tools only the data they actually need

Accepted Answer

The safest personal data is the personal data you never put in. Minimize first, prompt second. This is the boring habit that keeps you out of the cautionary tales. The fines and bans cluster around organizations that fed models more personal data than they had a basis for. Data minimization, the principle of only using what you genuinely need, is the cheapest compliance you will ever do. Most AI tasks do not actually require a name, an address, or a full record. They require the relevant facts. Separate the two and most of your privacy exposure disappears before you ever hit send.

Question 13

Claiming copyright on a fully AI-generated work

Accepted Answer

A machine cannot be an author. You cannot copyright a thing no human made, no matter how good the prompt was. A man spent years trying to register an AI-generated artwork naming the machine as the author. The courts said no, all the way up, because copyright requires a human author in the first instance. The Supreme Court declined to touch it, which makes it settled law: fully AI-generated work with no human authorship is not registrable. This does not resolve human-AI collaboration, where a person genuinely shapes the result. But pure machine output sitting on its own has no copyright for anyone to own, including you.

Question 14

Copyrighting an AI-assisted work where you did some of it

Accepted Answer

You can protect the parts you made. The parts the machine made come along for free, in both senses. When someone registered a graphic novel containing AI-generated images, the copyright office let the protection stand only for the human-authored text and the selection and arrangement. The AI images themselves got nothing. Providing prompts to a generator was held not to actually form the resulting images in the authorship sense. So the work is protectable in pieces. Your writing, your curation, your layout, those are yours. The raw generated assets in the middle are not, and you should not represent that they are.

Question 15

Training a commercial AI on a competitor's copyrighted material

Accepted Answer

Building a substitute for someone's product out of their own copyrighted work is not transformative. It is just competition with extra steps and a lawsuit. A court delivered the first US federal ruling rejecting a fair-use defence for AI training, where a company trained a legal-research tool on a competitor's copyrighted headnotes. The use was found non-transformative and a market substitute, which is roughly the worst combination of words you can hear in a fair-use analysis. Fair use leans on whether your use transforms the original and whether it harms the market for it. Train on a competitor's material to build a rival product and you have answered both questions against yourself.

Question 16

Using pirated material as training data

Accepted Answer

How you got the books matters as much as what you did with them. A pirate library is not a data pipeline. A court found that training on legally acquired books could be fair use, but using pirated copies was not. The company then settled for a sum reported around 1.5 billion dollars, the largest copyright settlement of its kind. The training method was not the fatal flaw. The supply chain was. This is the part teams skip when they are moving fast: the provenance of the data. A defensible technique built on an indefensible source collapses the moment someone asks where the files came from.

Question 17

Assuming AI copyright rules are the same in every country

Accepted Answer

Where the training happened can decide who wins. The law does not change at the border, it changes at the server. In a UK case, a court held that AI model weights are not a copy of the training images, and a major rights-holder largely lost after abandoning its primary training-infringement claims partly because it could not show training happened in the UK. That is a notable contrast with how the same questions are being argued in the US. So the same facts can produce different outcomes depending on where the training ran and whose law applies. Treating one jurisdiction's answer as universal is how cross-border AI projects walk into surprises.

Question 18

Letting an AI hiring tool filter on age or other protected traits

Accepted Answer

Automating discrimination does not launder it. The algorithm just does the illegal thing faster and at scale. A hiring tool automatically rejected female applicants over 55 and male applicants over 60, screening out more than two hundred people. It was caught when someone reapplied with only the birth date changed and suddenly got an interview. A regulator treated it as a straightforward age-discrimination violation, because that is exactly what it was. Putting the bias in software does not make it neutral. If a filter rejects people based on a protected characteristic, or a proxy like date of birth, it is the same illegal decision it would be if a human made it by hand.

Question 19

Assuming the AI screening vendor carries the discrimination risk

Accepted Answer

The vendor might be liable too. That is not the same as you being off the hook, and a shared lawsuit is still your lawsuit. A court allowed a disparate-impact claim to proceed against an AI screening vendor on the theory that the vendor can be directly liable as an agent of the employers using it. That is a real shift in who can be sued. But read it the right way: it expands liability, it does not relocate it away from you. This area is still being decided, with a nationwide collective certified. The safe reading for an employer is that you and your vendor can both be on the hook, so "we used a third-party tool" is not the shield people assume it is.

Question 20

Using AI to draft a job description, with a human bias-check before it screens anyone

Accepted Answer

AI writing the posting is fine. AI deciding who gets rejected, unaudited, is how you end up in the case law. This is the safe lane. Using AI to draft a posting, tighten the language, or flag wording that might deter candidates is low risk and genuinely helpful. The danger lives one step later, when the same enthusiasm gets pointed at automatically rejecting applicants without anyone checking the pattern. Keep the model on the writing side and a human on the deciding side, and you get the productivity without the disparate-impact exposure. The cautionary settlements all share one trait: nobody audited what the automation was screening out.

Sally's Law