AI-generated works

AI-generated works are outputs created by artificial intelligence systems with minimal or no substantive human creative input. This concept challenges traditional copyright law, which, under frameworks like the Berne Convention, typically requires a human author. The U.S. Copyright Office, for instance, has clarified that works generated purely by AI are not copyrightable. In enterprise risk management, these works are treated as a new class of intellectual property assets with uncertain legal status. According to the ISO 31000 risk management standard, organizations must identify and assess the risks associated with them, such as ownership ambiguity and potential infringement. This differs from 'AI-assisted works,' where a human uses AI as a tool and remains the clear author, thus retaining copyright protection.

Enterprises can manage risks from AI-generated works through a structured approach. Key steps include: 1. Inventory and Classification: Following ISO/IEC 27001 (A.5.9), identify all business processes using generative AI and classify the outputs based on their value and legal risk. 2. Policy Development: Create a clear Acceptable Use Policy for AI tools, specifying approved platforms, prohibiting the input of sensitive data, and defining ownership and disclosure protocols, aligning with transparency requirements in regulations like the EU AI Act. 3. Risk Assessment and Control: Regularly assess outputs for potential copyright infringement and conduct employee training. Implementing this framework can significantly reduce litigation risk and ensure a 100% pass rate in IP management audits, demonstrating robust governance over these novel assets.

Taiwanese enterprises face three primary challenges. First, legal ambiguity, as Taiwan's Copyright Act does not explicitly address AI authorship, creating uncertainty over IP rights. Second, trade secret leakage, where employees might input proprietary information into public AI models, violating the Trade Secrets Act. This risk is addressed by ISO/IEC 27001 control A.5.13 on information transfer. Third, complex vendor contracts, as many AI service terms grant providers broad rights to user data and outputs, undermining corporate IP control. To mitigate these, firms should establish an internal AI governance policy, implement technical controls like Data Loss Prevention (DLP), and conduct rigorous legal due diligence on all AI vendors to align contracts with corporate IP strategy.

Winners Consulting specializes in AI-generated works for Taiwan enterprises, delivering compliant management systems within 90 days. Free consultation: https://winners.com.tw/contact