Businesses will require increasing layers of protection to guard against employees “going rogue” in their use of artificial intelligence, according to a leading lawyer.
National law firm Clarke Willmott says so-called “shadow AI” – the use by staff of AI tools without an employer’s approval – and a lack of training can cause major headaches for organisations which are inadequately prepared.
Declan Goodwin, a commercial partner at Clarke Willmott who specialises in commercial contracts, intellectual property and data protection, says increasing use of agentic AI systems, in particular, could create a raft of new commercial and employment-related issues for businesses.
“There’s no doubt that adopting AI can have significant benefits; however, the use of ‘shadow AI’ without formal internal oversight or approval, is already widespread and steadily increasing,” says Declan Goodwin.
“When combined with inadequate training, which is common when new technologies are first being adopted in the workplace, there is real potential for data breaches to occur within businesses if personal data is shared. Breaches of confidentiality obligations could also occur if protected information is shared with AI models. Where this includes details of potentially patentable IP, such disclosure could harm the ability to patent such IP.”
“The unauthorised sharing of content is a recipe for the leakage of IP and confidential information. This can not only cause internal issues, but external issues and contractual breaches.”
Declan Goodwin says that businesses also need to be aware of the different models of AI and the different challenges they pose.
“Even if businesses are getting to grips with generative AI, which creates original content by learning patterns from existing data, agentic AI is different because it involves going beyond content generation to actively setting goals, planning and executing multi-step tasks with minimal human oversight.
“The growing use of agentic AI is posing new problems and requires further governance and monitoring. Contracts between suppliers and customers will need to clearly define how and when generative AI and agentic AI can be used for the performance of a contract.
“Employees will need clear guidance, policies and training to help them understand how they are permitted to use agentic AI, reflecting legal, contractual and sector-based requirements.”
Frederick Lambert, a solicitor in Clarke Willmott’s employment team, agrees that businesses need to step up their governance of AI usage.
He said: “The Department for Science, Innovation and Technology recently published the results of a survey confirming that one in three adults have used AI in their workplace in the last month, yet, the same report found that 84% of people in work have not undertaken any AI-related training in the past 12 months. Therein lies a growing legal risk that employers must be alive to as this technology develops.
“One of the greatest risks associated with the use of AI is its inaccuracies and “hallucinations”. Increasingly, particularly in the professional services industry, employees are relying on AI-generated outputs that appear to be accurate but are anything but. This has resulted in a growing number of highly publicised incidents where professional advisers have been caught out by taking AI outputs at face value, without independent human oversight. Of course, uncontrolled dissemination by employees of confidential or sensitive information on unsecure AI models carries its own legal risks.
“For people managers, AI cannot currently make the nuanced decisions that a human line manager can. Overreliance on AI when making people management decisions, such as hiring, promotion, or dismissal, can give rise to potential legal issues. When AI tools are relied on, there is a risk of unfair or rigid decision-making, and associated claims such as unfair dismissal or discrimination.
“For this reason, employers should be proactive in managing use of AI in the workplace. Employers should be looking to update their relevant workplace policies, ensure their employees have access to training and resources to use AI effectively and be conducting updated risk assessments and data protection impact assessments, where appropriate.”
The UK Government has introduced the Cyber Security and Resilience (Network and Information Systems) Bill in an attempt to strengthen legislative cyber security requirements.
The most significant overhaul of the UK’s cybersecurity regulatory framework since the Network and Information Systems Regulations in 2018, the Bill is currently going through Parliament. It aims to update these regulations and deliver new powers enabling government to respond to new and emerging cyber threats.
Speak to our experts
For more information, please send an enquiry or contact a member of Clarke Willmott’s specialist commercial and employment teams.
