Artificial intelligence: requirements and documents

What is happening

Sales have plugged a chatbot into the CRM, marketing produce banners in an image generator, and the legal team runs contracts through a language model. Nobody decided any of this centrally, and now management wants to know what data leaves the building with each prompt and who is answerable for it.

The company commissions an AI solution from a contractor or embeds a third-party model in its own product. The contract reads like an ordinary software development agreement: it says nothing about who owns the fine-tuned model and the outputs, who is liable for a wrong answer given to a customer, or what happens to the data when the work ends.

The third trigger is a question from outside. A customer claims losses caused by a chatbot error, the data protection regulator (Roskomnadzor) asks about transfers abroad, or a counterparty asserts rights in a generated logo. The priority then is to gather the facts quickly and see which documents the company can rely on.

What the law says

• The new federal law on supporting the development of artificial intelligence technologies is coming into force in stages. Its main obligations are aimed at developers and operators of large models; in our assessment it imposes no bans and no mandatory content labelling on companies that simply use AI tools.
• Where customer or employee data reaches a model or an external service, Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" applies: you need a lawful basis for processing, and sending data to a foreign service is a cross-border transfer that requires prior notification to Roskomnadzor.
• Rights in texts, images and code created with AI are assessed under Part Four of the Civil Code. The courts look at the human creative contribution: the more visible and better documented it is, the easier it is to protect the output as a copyright work.
• Under Article 152.1 of the Civil Code, a person's image may as a rule be used only with their consent. A digital avatar or a video built on a real person's likeness is no exception, and in advertising this is one of the main risks.
• Towards the customer, liability for an AI service's error lies with whoever provides the service to that customer, which usually means you rather than the model developer. The only way to pass the risk on to the developer is by contract: warranties, liability caps and indemnities for losses under the Civil Code.
• Information entered into someone else's model may lose its protection as a trade secret if the company took no steps to protect it. That is why an AI use policy is not a box-ticking exercise: it is part of your confidentiality regime.

What we do

• We take an inventory: which AI services are in use, by whom, on what terms of service, and what data goes into them.
• We establish whether the new AI law's obligations apply to your company and map the requirements against the dates on which each takes effect.
• We draft and review contracts for AI development, implementation and licensing: ownership of the model, datasets and outputs, liability for errors, and what happens to data after the work ends.
• We bring personal data processing into line: lawful bases and consents, notifications to Roskomnadzor, conditions for cross-border transfer.
• We write an AI use policy for staff: what may be uploaded, to which services, and who signs off on new tools.
• We prepare terms of use and disclosures for customers of your AI product: what the system does, where its limits lie, and how a decision can be challenged.
• We handle claims and disputes with contractors, customers and rights holders.

What we will need from you

• A list of the AI services and models used in the company or built into your product, with links to their terms of service.
• A description of the processes: which data goes into the services and from where, who has access, and where the outputs are stored.
• Contracts with developers, integrators and data suppliers and, if you sell an AI solution, your customer contracts.
• Your current personal data and trade secret documents: privacy policy, consent forms, the Roskomnadzor notification and the list of confidential information.
• If a dispute has already started: the claim or request, the correspondence and an account of the incident.