Key takeaways
AI does not change who is responsible
AI cannot bear legal responsibility.
Confidentiality risks come first
Data loss can occur without a cyber-attack.
Governance is critical
Policies, training and oversight reduce AI risk.
October is Cyber Security Awareness Month and in the next article in our series, we look at cyber security issues around AI, noting that all the excitement surrounding AI can sometimes obscure a simple legal reality, that the responsibility remains with the humans and organisations deploying it.
As all organisations embrace AI, existing duties of care and confidentiality and cybersecurity requirements continue to apply, placing accountability firmly on those who use, implement and govern the technology.
Artificial Intelligence is transforming the way organisations operate. Employees can now draft reports, analyse data, summarise documents and generate content in seconds. Yet as AI adoption accelerates, so too do concerns around confidentiality, cybersecurity and accountability. For many businesses, the cyber risk no longer comes solely from malicious external actors. It can arise from an employee uploading sensitive information into a public AI platform, an inadequately governed AI tool processing personal data, or a system generating outputs that expose confidential information.
Against that backdrop, a key question is emerging: who is responsible when AI contributes to a cyber incident?
AI is the tool, not the Defendant
The recently published legal statement on liability for AI harms by the UK Jurisdiction Taskforce (UKJT) confirms that English law is generally capable of addressing AI-related disputes through existing principles of contract, negligence and professional liability. AI itself has no legal personality and cannot be liable for harm in its own right. Responsibility remains with the humans and organisations deploying it. The more significant point is that AI is not creating an entirely new liability framework. Instead, it is changing how existing duties may be assessed. As AI becomes increasingly embedded in day-to-day business operations, organisations may find themselves judged against evolving standards of reasonable conduct. What amounts to appropriate governance, oversight and cybersecurity controls today may look very different in a few years' time.
The UKJT also flags an interesting tension: it notes that, as AI becomes more widely adopted, the courts may in future consider whether the failure to use available AI tools forms part of the assessment of reasonable skill and care when assessing whether a party has been negligent. The position will remain highly fact sensitive. If AI becomes standard practice within a particular business or profession, the benchmark for reasonable skill and care may evolve accordingly. AI may therefore influence not only how duties are discharged, but also the standard against which those duties are judged. Note, the legal statement from UKJT is not binding authority and does not create new law. However, it may provide guidance on how existing English law is likely to apply to AI-related disputes in future.
Confidential information
One of the most immediate risks associated with generative AI is the handling of confidential information. Employees under pressure to work more efficiently may upload contracts, client documents, commercially sensitive information or personal data into AI platforms without fully understanding how that information will be processed or retained. The legal and commercial consequences may arise even where no cyber-attack or personal data breach has occurred. The concern is not always a traditional data breach. In many cases, the risk arises because an organisation loses control over where information is stored, how it is used and whether it may contribute to future outputs.
For professional services firms, that distinction is particularly important. The issue may arise long before a cybercriminal accesses any data. The disclosure itself can have consequences where organisations owe duties of confidentiality to clients, counterparties or employees. A single incident may result in contractual disputes, regulatory scrutiny, allegations of negligence and reputational damage.
Regulators and data breaches
Alongside concerns regarding confidentiality, regulators are increasingly scrutinising the datasets used to train AI models. Questions continue to arise around the lawful use of personal data, transparency regarding data sources and whether proprietary or confidential information has been incorporated into training datasets without appropriate authorisation.
Traditionally, cybersecurity has focused on protecting information from unauthorised access. AI governance introduces a broader question: was the information collected, processed and reused lawfully in the first place?
As a result, organisations need to understand not only how AI systems operate, but also the source of the data on which those systems rely. Governance of data inputs is becoming just as important as security of data outputs.
Critical risk: employees
Human behaviour remains one of the most significant cybersecurity risks, and AI has not changed that reality. Employment disputes are already emerging where employees have used unauthorised AI tools, uploaded confidential information to external platforms or relied on AI-generated outputs that later proved problematic.
For employers, the challenge is balancing innovation with control. Employees now have access to tools capable of analysing large volumes of information within seconds. While that creates efficiencies, it also increases the risk of confidential data being shared inappropriately or without proper consideration of the consequences.
AI governance is cyber governance
The organisations best placed to manage AI-related risks are those treating AI governance as part of their wider cybersecurity framework rather than as a standalone compliance exercise.
Practical measures may include:
implementing clear policies governing the use of AI tools
restricting use of, and/or the input of confidential and privileged information into public AI platforms
carrying out de diligence on AI providers and their data handling practices
providing regular employee training on the risks associated with AI, including the potential for malicious prompt injections, bias and hallucinations
monitoring organisational use of AI tools
reviewing contractual protections with technology providers.
In many respects, these are familiar cybersecurity measures. The difference is that they must now be applied within an AI-enabled environment.
Conclusion
The narrative around AI often focuses on efficiency, innovation and opportunity. Those benefits are real, but they should not distract organisations from the legal and cybersecurity risks that accompany adoption.
The significance of the legal statement on liability for AI harms is not that it creates entirely new duties. Rather, it reinforces that existing duties of care, confidentiality and accountability continue to apply even where decisions are assisted by increasingly sophisticated technologies.
The excitement surrounding AI can sometimes obscure a simple legal reality: responsibility remains human.
The question is no longer whether AI creates new risks. It is whether organisations have implemented the governance, controls and oversight necessary to manage them before regulators, claimants or cyber criminals expose the gaps. As AI continues to develop, the organisations best placed to benefit from it will be those that view AI governance not as a technology issue alone, but as a core element of risk management, cybersecurity and legal compliance, rather than an afterthought.
Find out more about our Commercial Disputes expertise or contact us today to discuss how we can support you.
