GenAI systems often process vast amounts of data during their training and operation, and additional legal obligations can apply to the use of personal data in and by GenAI systems. For example, EU and UK law set specific requirements in relation to automated decision-making about individuals which produce legal or similar significant effects, on top of standard data protection obligations.

The question of whether GenAI systems infringe intellectual property rights is complex and varies from jurisdiction to jurisdiction. It is crucial to clarify the ownership rights to the content generated by GenAI and to ensure that no protected works are used without permission.

Companies must ensure that the use of GenAI does not violate confidentiality agreements, especially if data from third parties is used.

The regulatory requirements for GenAI vary around the world. Non-compliance can lead to significant penalties, so companies must ensure that they comply with all relevant regulations.

GenAI systems can provide inaccurate results that are presented as correct. The "black box" nature of these systems makes it difficult to understand the decision-making processes, which makes it harder to comply with transparency requirements.

Companies need to be aware of the legal liability that may arise from inaccurate or biased GenAI results. This includes the risk of discrimination, e.g. on the basis of gender.

The high energy consumption of GenAI systems can have an impact on companies' ESG obligations. Discrimination in the results can also have social consequences.

It must be ensured that all data protection requirements are met in order to enable compliant use of the GenAI systems. This includes clarifying the roles of data controllers and data processors and ensuring that data processing is transparent and traceable.

Companies should have a clear picture of the data sets used for GenAI training and ensure that they are used lawfully. This can be secured through contractual assurances and indemnities.

The limits of the use of input and output data should be clearly defined in order to maintain confidentiality and protect business secrets.

The EU AI Act places specific requirements on the providers and users of AI systems. Companies must ensure that they comply with these requirements, especially when procuring GenAI systems or using them in their supply chain. This includes the implementation of risk management systems, verification of input data and compliance with transparency and security requirements. The company must be assured of adequate support from the provider.

In many industries, there are additional regulations that must be taken into account when procuring GenAI systems. Companies should ensure that their contracts require the provider to support compliance with these regulations.

Companies should carefully consider the liability risks associated with the use of GenAI and ensure that these risks are covered by appropriate contractual provisions such as indemnities and limitations of liability.

Cybersecurity aspects should be taken into account when negotiating with the provider. Companies should therefore ensure that the provider has appropriate security measures in place and that these are included in the contract.

GenAI systems can be costly to operate, particularly due to high energy consumption and expensive hardware requirements. Companies should agree transparent pricing mechanisms that meet their needs and ensure that long-term price stability is guaranteed.

To avoid long-term dependency on a particular provider, companies should carefully review the terms of the contract and ensure that they receive support in exiting the contract if necessary.

Companies should review their ESG policies and ensure that these are included in the contract for a GenAI system. This includes consideration of the development of ESG policies during the contract period.