CFC’s Michael Brunero on the Legal Landscape Surrounding AI, IP, PII and More

Risk & Insurance recently had the opportunity to sit down with Michael Brunero, head of tech, media & IP at specialty insurer CFC. The conversation touched on the still-emerging ramifications companies may face for training artificial intelligence on existing intellectual property or mishandling users’ personal identifying information and other data, and what role insurance can play in managing those risks.

What follows is a transcript of that conversation, edited for length and clarity.

Risk & Insurance: At what stage are we in the conversation surrounding AI’s use of copyrighted materials for training?

Michael Brunero: The current landscape of AI’s use of copyrighted materials for training is complicated, as modern technology is being regulated by established intellectual property laws that weren’t designed with AI in mind. This clash between the subjective nature of creativity and the objective nature of the law leads to uncertainty.

As a result, businesses are approaching the issue with caution. Some, like Getty Images, have taken legal action to protect their IP, while others, like Shutterstock, are proactively establishing agreements. The lack of transparency around what data is being used to train AI models is also a cause for concern.

We are still in the early stages of understanding how this will play out. However, when valuable information that people have invested significant time and effort into creating is involved, it’s unlikely to be a smooth process. Businesses using any form of AI should proceed with caution.

R&I: There’s quite a bit of AI-related litigation currently underway. What are the potential ramifications of the various possible legal outcomes, and how might the law’s stance affect policy over the long term for people using AI?

MB: The ramifications of AI-related litigation will likely vary across different territorial jurisdictions, as the global approach to AI ownership and output attribution is not harmonious. From a global business perspective, we’ve already observed different territories taking distinct approaches to whether the output of AI can be attributed to the AI itself.

In the U.S., particularly considering the copyright protection laws in California, there will likely be a strong push for IP [intellectual property] right ownership to be granted to the original owners. While people may prefer licensing agreements and settlements over court battles, from a moral standpoint, there is an argument that content creators should be entitled to compensation when their work is used without permission.

Ideas of fair use and the ability to use parts of content will be brought into question. From an insurance perspective, we tend to be concerned about worst-case scenarios, but these are issues we’ve dealt with before, albeit on a different scale. The discovery element is more challenging, but it’s a question of the scale of the problem increasing rather than being an entirely new problem.

IP litigation will likely increase, and eventually, we may gain more clarity on what constitutes fair usage. However, the landscape of AI-related litigation and its impact on policy will continue to evolve over time.

R&I: We’ve also heard a lot about cases involving the mishandling or leaking of personal identifying data lately. What are some key considerations for tech companies when it comes to handling personal data?

MB: There is plenty of legislation governing the use of people’s personal information. The key for tech companies is to have a clear privacy policy that informs users about what data is being collected and how it is being used.

This is especially critical for B2C tech companies, as they often harness large amounts of personal data, which carries an enhanced risk. Ensuring transparency about data practices is essential, and we have seen increased scrutiny on big tech businesses in this regard.

Making sure that users understand what data is being collected and how it is being utilized is the most basic level of compliance. However, in the world of big tech, these practices are not always the most clear, and that is leading to additional scrutiny on these types of businesses.

R&I: Is there a black swan scenario that keeps you up at night — a disaster that could overwhelm the insurance industry’s ability to respond?

MB: Interestingly, the thing that keeps me up at night more than anything is the fact that one of the largest reasons we decline a claim in my tech portfolio is due to patent infringement, which requires a stand-alone IP policy. What truly concerns me is that we have a solution for these clients, but they’re not always taking advantage of it.

These patent infringement claims can cripple businesses. I’m more worried about our ability to help these businesses move to the next phase by providing the necessary protection. People often talk about the systemic risk of AI, but AI has such a broad range of applications — some are just basic decision-tree technology.

There’s an old adage that says “What keeps a broker up at night is what they haven’t done, and what keeps an underwriter up at night is what they have done.” This has been going on forever, but I genuinely feel like if we’re going to move forward, these businesses need insurance. What worries me is that we’re providing solutions and companies are not taking advantage of them.

R&I: Is there anything else you think our readers should know about that we haven’t covered?

MB: I think the significant risk that people may not be aware of is how businesses are using IP as a strategic weapon. Big tech companies often use their substantial financial resources to cripple smaller competitors, either by eliminating the competition or acquiring them, leaving them with no other option.

Many policies provide slivers of IP coverage, but the broader world of patents and trade secrets is where people should be vigilant.

Something like 60% of nuclear settlements — meaning damages awards exceeding $10 million — are IP-related. There’s a huge movement now for people to capitalize on what they’ve got, and I don’t think that’s going to change anytime soon. &