Home > Blogs > Can I Use AI for my Online Legals?

Can I Use AI for my Online Legals?

Reliance on AI should not be a substitute for legal advice from a qualified professional. This is especially so where business owners want to maintain professionalism, avoid disrepute, attract investment, shield themselves from regulatory action, and possibly look towards selling in the future.

The use of generative artificial intelligence (AI) to support on key consumer law compliance requirements, as well as to draft documentation such as T&Cs and privacy policies, is a common question from start-up businesses. Though AI may provide something that ostensibly seems to be legally resonant, ultimately, relying only on AI outputs means that no lawyer has been involved in something as imperative as compliance with the law. This may cause issues further down the line for your business.

This article will explain the risks of using only AI for the legals to your online, B2C, or e-commerce business and the consequences of non-compliance with the law. It is written for business owners who are perhaps starting out on their venture and may consequently have the time for self-administration of the law. This article will not discuss the use of AI for complex activities pertaining to specialist businesses that require legal support on high-risk activities. In such situations, reliance on AI for legal compliance should not be in discussion.   

What rules do online businesses need to comply with?

There are various legal requirements which businesses that sell to consumers must adhere to. Generally, these can be categorised into (i) rules for processing personal data under the UK GDPR (ii) compliance with various consumer contractual rights (iii) information requirements (iv) advertising laws. These all usually involve the drafting and preparation of documents, such as privacy policies and consumer terms and conditions, but also a consultancy element insofar as understanding what rules apply, when they apply, how they apply, and best practice for achieving legal compliance considering the nature of your business. Though AI, perhaps coupled with use of free guidance from regulator websites, may give a good overview of what’s required, using a professional is recommended to fully close out any risk of non-compliance and ensure your business does not set itself up for disruption further down the line.

Is AI likely to get things wrong?

When posed with a prompt or question about legal compliance, mainstream AI models (e.g. ChatGPT and Claude) are likely to crawl free resources indexed on search engines to generate its responses. This could be, for instance, legislation and free guidance from regulator websites. Though such sources are strong primary sources of information, there are two key issues that may adversely affect AI’s capability to effectively advise on legal compliance.

The first is that the prompter is equally as important as the tool. Though AI might have access to those primary resources, such as an Act of Parliament published on the gov.uk website, the prompter should already have a good understanding of the content to get the best outputs they require. It may therefore be, quite ironically, that the use of AI for legal compliance may only achieve its best utility when in fact used by a lawyer itself. Indeed, a complex prompt, which takes into account all relevant factors and laws, may itself read as a lawyer’s file note after a thorough consultation and tacit understanding of the law applied to the client’s particular circumstances. AI can therefore be seen as an enhancement to a lawyer’s skillset as opposed to a crutch for self-administration of the law by business owners. A prompter with a lack of knowledge of the laws will likely lead to incorrect prompting and thus epistemic lacunas in the AI’s outputs which then leads to non-compliance with the law.

The second is that AI does not have access to a lawyer’s personal and lived experience about the law. Such experience will have be honed over years of working on real life matters for different businesses, taking into account the vicissitudes between the different and unique contexts the lawyer has advised on. Many lawyers use this practical experience to leverage an increasingly valuable service for each of its successive clients (hence why senior lawyers cost more to commission). It is unlikely AI could replicate this tacit understanding that is birthed from the intersection between law and real-life application.

The privacy policy is the public statement

Since AI ‘large language models’ work on linguistic patterns and predictions, they have a strong tendency to produce text that speciously sounds relevant from just a few simple prompts. A privacy policy generated from a few back and forth questioning may thus read legal and professional, but may ultimately be built on shaky foundations. This is because there is much more involved in compliance with the law, and your privacy policy, consumer T&Cs, platform terms of use, returns policy (etc) are simply the culmination of a legitimate attempt at that. In other words, they are public statements which announce that “we have done our utmost efforts to comply with the law, and you can hold us to account if we haven’t”.

If you have not actually undertaken the legwork that sits behind these documents, then you are effectively lying to your customers. The ‘legwork’ here is the reams and reams of statutory provisions, regulator guidance, and practitioner notes all funneled into the auditing process designed by your lawyer to make the process of legal compliance as simple but as robust as possible for your business. Going through this process is the evidence you will hold to show you have complied with the law (or at least legitimately attempted to). And if anything goes wrong, the first thing regulators will look at is substance, not form.

Reputation and regulatory action

Most, if not all, of the laws affecting businesses that sell to consumers are regulator-led, meaning that non-compliance may lead to enforcement action by regulatory bodies that bring monetary fines and/or reputational harm.

Though it is unlikely AI-led errors will lead to major enforcement activity for start-up and small businesses, regulators often pick up on and investigate smaller breaches of the law. This is because nearly all of a business’s consumer-facing presence is open to scrutiny under relevant consumer protection laws, since it is considered a form of ‘advertisement’. The Advertising Standards Authority (ASA) specifically deals with this area and publishes weekly rulings on breaches of consumer law. No monetary fines are usually involved here, but offenders are named and shamed often for minor infractions of the law.

Notwithstanding the unlikeliness of major enforcement action, smaller AI-led errors may nevertheless spiral into larger or repetitive errors that bring the stronger enforcement actions such as fines and prohibition orders. Indeed, AI has a tendency to reinforce epistemic misunderstandings, particularly those held by the prompter, in a feedback loop that may lead to slow or undetectable scope creep away from correct legal compliance in the absence of the trained eye of a professional. It could be that, for instance, a business ends up relying on an unlawful AI-drafted term in their consumer T&Cs over multiple dealings with its consumers, leading to multiple instances of unfair trading over the long term.

Future disruption

Reliance on AI for something as important as mandatory compliance with the law may eventually backfire later down the line when it comes to your individual business. Complaints from customers and regulatory intervention due deficient legal compliance may cause disruption at pivotal times that your business simply cannot handle. Remedial action and reputational fallout may cause cashflow difficulties and lead to the making of errors elsewhere in the business as a chain effect. Regulators may even order your business to instruct lawyers to rectify compliance errors, so you are effectively back where you started. Paying a few thousand pounds for legal advice may subsequently eliminate the need for further losses down the line.

The identification conundrum

This point essentially boils down to the following question: how do you know whether your legals are compliant when a lawyer has not been involved? Thus, if you maintain ultimate responsibility for legal compliance, knowing whether that compliance is correct is very important.

Some business owners may nevertheless defuse this contention by thinking that any errors in legal compliance will fly under the radar without anyone batting an eye. However, one should not underestimate either (i) hawk-eyed competitors (ii) disgruntled customers with a chip on their shoulder. Both are motivated to cause disruption to your business and can report to regulators directly. Furthermore, regulators and non-profit bodies tend to conduct searches of the internet for non-compliant behaviour with some even using proactive technologies to persistently detect breaches.

Professionalism and directors’ duties

Running a business should involve a degree of professionalism as this directly and indirectly increases its perceived value. A privacy policy which does not comply with the ICO’s latest guidance, or incorrect returns and cancellation practices, all jeopardise the perceived value of the business. This will be important where investment might be needed, or the business has plans to scale or expand, or that a future sale of the business is envisioned (see below).

Where the business is under a limited company, an owner-manager may also be in breach of their fiduciary duties to promote the success of the company whereby disruption is caused due to deficient legal compliance caused by AI reliance. This may mean that a director becomes personally responsible, in addition to any liability imposed on the company.

Selling your business

Some business owners may run their business with a view to sale. Where this is the case, the sellers must be able to evidence that the business was managed effectively, and compliance with the law is a major factor. When businesses are being sold, buyers undertake thorough due diligence. Purchasers may thus be scared off by the discovery of legal mismanagement because of the severe consequences it may have post-acquisition. Using professional advice consistently throughout the life of the business evidences the business has been run well and minimises risk for potential buyers.

Conclusion – any compromises?

‘AI-only’ or ‘AI-first’ legal compliance certainly has many key risks attached to it. It would thus not be in the interest of a business owner to employ such practices. A compromise, nonetheless, might be to let AI do the initial groundwork and then get a lawyer to review, possibly at a cheaper price. Unfortunately, this may not work since, considering the points made in this article vis-à-vis AI’s limitations in legal compliance, this may paradoxically require more work to undo what the AI has done or may simply cost the same because a lawyer may be forced to start from scratch.

About the author

Nabiel Junjua (CEO & Solicitor) is a commercial solicitor with extensive experience in consumer law compliance matters for digital and online businesses. He is also the founder of Click Digital Law - an innovative legal provider which strives to use technology in its service offerings in a sensible and practitioner-first way. Learn more about Nabiel here.