Nowadays, one can hear a lot about generative artificial intelligence ("Generative AI"), which can be used to create different types of content (e.g., text, images, software source code) in an automated way by giving simple instructions (so-called "prompts"). Companies may reasonably ask whether it is worth investing, at this point, in software using Generative AI; however, the current Hungarian legislative environment does not provide answers to this question, which could clearly provide guidance in all cases, on a general basis. For this reason, the legal implications of each investment (be it either procurement or "in-house" development) need to be examined on a case-by-case basis.
In the following, we will present a number of considerations that may be key, from a Hungarian legal point of view, before investing in software using Generative AI.
What data has been used to "teach" the AI?
A key prerequisite for the lawful use of Generative AI is whether the data used in the machine learning of Generative AI has been lawfully used, exploited or utilized (collectively: "use").
For Generative AI, the content used in machine learning is often protected by some form of intellectual property rights. This is because if the content is of individual and original nature, then the author - or, in certain cases, their legal successor - has, at least, rights stemming from copyright law without any further registration requirements. Naturally, the content may also be protected by a trademark (e.g., the image to be used may be a figurative trademark) or other intellectual property rights, e.g., the use of certain types of content may lead to the exploitation of patents or utility model related rights (e.g., if the purpose of Generative AI is to generate design documentation for technical equipment and the software development company develops Generative AI by using design documentation).
If the relevant content is protected by any of the intellectual property rights mentioned above, then the content's user must obtain an appropriate license from the respective right holder to use the content lawfully. The absence of appropriate licenses will not only make the use of the content in the context of machine learning unlawful, but will also likely affect the legal status of the content generated by the end user of Generative AI (e.g., an image generated by Generative AI may contain elements that are either directly derived from other images that have been unlawfully used in the course of machine learning or, at least, very similar to elements of such images).
If machine learning also involves the use of personal data, the relevant data processing activities must be compliant with the EU General Data Protection Regulation ("GDPR") and Hungarian data protection laws. To mitigate data protection risks, in most cases it may be recommended to anonymize personal data prior to its use; however, this does not relieve the software developer of its data protection related legal obligations prior to anonymization if the data is not initially collected anonymously. Among the relevant rules of data protection law, it is worth noting that before beginning a data processing activity relative to Generative AI, it is particularly justified to assess whether conducting a data protection impact assessment is necessary, considering that new technology is involved. In such an impact assessment, the data controller must assess, among others, the risks that the data processing might cause to natural persons concerned with the data processing, and whether such risks can be mitigated to a level that complies with the principles of necessity and proportionality.
In addition to the above, the use of data in machine learning should not conflict with other laws, including in particular rules on trade secrets and know-how and, where appropriate (e.g., if the software was originally developed by the developer for a public body and subsequently "recycled"), requirements on the use of classified data.
Legal status of generated content
The most common question about content created by Generative AI is whether the content is eligible for copyright protection and, if so, who is the author. Is it possible that Generative AI itself is the author? Although we often see articles (or headlines) that make these questions appear settled, in reality, such questions can only be answered in relation to a particular jurisdiction. Therefore, we will approach them on the basis of the Hungarian Copyright Act (Act LXXVI of 1999; "Act"). The Act provides that a work is eligible for copyright protection if it is the result of the intellectual activity of an author and is of an individual and original nature.
Of the above criteria, the easiest to examine is the existence of "individual and original nature". The Act itself does not define this term, but, based on case law and legal literature, nothing precludes content created by Generative AI from having it. This is made possible by the fact that, in the course of machine learning, the AI is able to produce not only elements that it knows but also outputs that are different from those elements.
Regarding the term "author", the Act states only that "the author is [the person] who creates the work". The pronoun "who" (in Hungarian: aki), which can only refer to a person, implies that the author can only be a human being. The author could be someone else - a company, an animal or even Generative AI - only if the pronoun "which" were used here. Another element in the definition of author is that they "created the work", i.e., had an active role in the creation of the work. The end user of Generative AI may be reassured to know that this relationship is, in our view, rather indirect between the software developer and the content, i.e., the software developer would most likely not acquire any rights over the content. In contrast, under the current wording of the Act, the end user who has shaped the output/ content that was generated after using Generative AI is certainly an author in relation to the modifications made by them. For example, if the end user has drawn buildings and people on an image of a landscape produced by Generative AI, and these drawings have an individual and original nature, then the end user may be considered the author of these drawings. Similarly, if a coder generates certain elements of the source code of the software using Generative AI but adds to or rewrites them in an individual and original manner, then such coder may be considered as an author in relation to those additions or rewritings.
However, there is one more player whose authorship is uncertain: the person who gives the prompt. Although without their contribution the output would not have been produced, the giving of the prompt is unlikely to constitute creation in itself. This is supported by the fact that, according to case law and legal literature, "intellectual activity" is ultimately an expression of personality, of the individual's freedom of choice. However, content production by Generative AI cannot be considered as self-expression as the actual "creation" is done by the software, without human intervention.
According to a conservative interpretation of the Act, content produced by Generative AI can, therefore, be protected by copyright if the content has an individual and original nature and the content has been shaped by someone after the Generative AI. However, it is worth considering that neither the Hungarian nor the EU legislator has so far introduced specific rules for content created by Generative AI, nor, to our knowledge, are they planning to do so. We are also unaware of any court judgments within the EU that have examined the authorship of such content. (We note, however, that there is already a judgment outside the EU that confirm our findings: in the US, in Thaler v. Register of Copyrights, a federal district court ruled that AI-generated works that were created "absent any guiding human hand" cannot be protected by copyright.) Therefore, it may be worth stipulating explicitly in the license agreement that only the end user has direct rights to the generated content; moreover, for a higher-value or business-critical intellectual property, it is still worth relying overwhelmingly on human creative activity, at least for the most essential elements of the content.
What should be requested from the software provider?
Above we have presented the importance of considering what data has been used to develop Generative AI. For this reason, it may also be legally critical that the company providing the software warrants the following:
- by using the software, the procuring company does not infringe third party rights, such as rights relating to copyright and trade secrets or the right to privacy and the protection of personal data; and
- the company providing the software has the appropriate rights and licenses to grant the procuring company a license to use the content generated by the software for the purposes negotiated during the procurement.
Naturally, it is also of paramount importance that the contract for the use of the Generative AI software accurately reflects the terms negotiated during the procurement process and provides the procuring company with a sufficiently broad license to use the content generated by the software. When concluding the contract, it is also necessary to consider whether the contract must be in writing to be formally valid under Hungarian law, noting that when the contract is concluded electronically, it is deemed to be in writing only if certain conditions are met.
In software contracts, it is common for the company offering the software to limit its liability in relation to any legal claims that may arise. As such limitation of liability is a market practice, avoiding such contractual clauses may not be a realistic option in most cases. However, excessive limitation of liability should be avoided, as risk management is key in the current uncertain legal environment.
For in-house development, it is important to note that there is a difference between the legal status of employees and of contractors (e.g., those contracting as sole proprietors or through single-member LLCs) involved in the development of the software. In order to mitigate the likelihood of future disputes, it is also advisable to set in advance what remuneration the employee or contractor will receive for the creation and use/utilization of the software or, as the case may be, what additional remuneration is excluded.
In addition to the above, it is worth mentioning that a regulation is being drafted in the EU that will set new rules for the use of AI and will be directly applicable in all EU Member States. Although the new legislation, according to the text of the draft currently available, will not cover, for example, intellectual property related issues of Generative AI-generated content, once adopted, that regulation may have an impact on other legal issues in software procurement.
By Andras Gaal, Attorney, and Mihaly Budai, Junior Associate, Baker McKenzie
