Dr. Philipp Mels, orka: "The biggest battle in the 21st century will be AI versus Copyright"

LEADERS LEAGUE: In addition to the AI Act, which areas of law require particular attention when developing, operating, and using AI?

Philipp Mels: In addition to the AI Act, the most important areas of law regarding the use of AI are clearly intellectual property rights, trade secret protection, and data protection.

Could you specify exactly where companies and government authorities need to take intellectual property rights and trade secrets into account when using AI?

I always recommend considering three key stages in this process. The first stage is when I, as a company or government agency, acquire, license, or develop - or commission the development of - an AI system. The second stage involves feeding and training the AI with data. And the third stage pertains to the AI-generated results and their use. This third stage is divided into two parts.

One question is whether the AI-generated results are subject to intellectual property rights or trade secret protection. The other question that needs to be answered is whether the use of the AI-generated results infringes the rights of third parties.

What exactly do you need to examine at these three checkpoints?

At the first review stage, I must take into account copyrights related to the AI software, as well as any trade secrets that may be contained therein, and - only in very exceptional cases - patent rights. At the second review stage, particular attention must be paid to whether the data contains copyrights or trade secrets that could be infringed. The latter may also be compromised here if adequate confidentiality measures have not been taken. At the third review stage, the AI-generated results may be protected by trade secret law; copyright protection applies only in very exceptional cases, and design protection may apply. If the AI-generated results are used, this may infringe on copyrights, design rights, trademark rights, patent rights, and trade secrets.

Is it even permissible to use copyrighted works, or data protected as trade secrets, to train AI?

Yes, that is possible. To do so, you need either the rights holder’s consent or a license from them. Alternatively, you must use publicly accessible sources for example, on the internet and identify and utilize such sources therefor. Under German copyright law, this is permitted as an exception - for example, as text and data mining - if the data is collected and used solely for training AI. However, this does not apply if the copyright holder has declared a machine-readable copyright notice.

Why is the use of trade secrets in AI systems so legally risky?

In practice, the most relevant risk for companies is not so much the violation of third-party trade secrets, but rather the fact that employees may enter trade secrets into the AI system. This can be seen as evidence that the company, as the owner of the trade secret, has failed to take the necessary and appropriate measures to ensure confidentiality. As a result, the company loses the protection afforded to those trade secrets.

How significant is the conflict between AI providers and operators on the one hand, and creators or copyright holders on the other?

You may be surprised by my choice of words. The biggest battle that providers and operators of AI systems must fight in the 21st century is against copyright holders, who understandably want to take action against the infringement of their copyrights.

And where does data protection fit into all of this?

Data protection law is the other major Achilles' heel when it comes to the use of AI. The AI Regulation and the GDPR coexist. This means that the GDPR must be fully complied with when using AI. This means that a legal basis for data processing is always required. The AI Act does not provide any further guidance in this regard.

What steps must companies take to ensure compliance with intellectual property rights, trade secrets, and data protection regulations?

First and foremost, this requires a firm commitment. The most important step is for companies to develop an AI policy and make it binding. They must form an AI team comprising members from the legal department, IT, management, and the data protection officer, who will work together. Above all, however, the company must ensure that control is exercised - specifically, over which AI systems are brought into the company and for what purpose they are used. checks must be conducted regularly, and the results must be documented. Employees must acquire AI skills, which means they need to be trained. However, they must also be trained in AI compliance, which means adhering to all legal regulations—not just the AI Act, but also, for example, copyright law.