Legal Risks AI Companies Should Address Before a Product Launch

An AI company preparing to launch a product needs a legal review that follows how the product actually works. The important questions begin with the information entering the system, continue through the vendors processing it, and extend to what customers are told they can safely do with the results. A functioning demonstration does not answer whether the company has adequate data permissions, whether its privacy arrangements fit its operations, or whether its sales promises match its testing.

For founders and commercial teams, a useful starting point is to separate legal requirements from negotiated business protections. Copyright law, California privacy regulations and federal consumer protection law address different conduct. Contract provisions can help organize responsibilities, but should be reviewed against the underlying rules and the technical arrangements they describe. The discussion below addresses those general issues for AI developers and vendors serving the US market, with California requirements where relevant. Products used in specialized sectors or other jurisdictions need an additional review of the rules applicable to those uses.

Identify the Rights Behind the Data

Copyright review should begin before a dataset is incorporated into development. Section 106 of the Copyright Act gives copyright owners specified exclusive rights, including reproduction and preparation of derivative works, subject to statutory limitations. Section 107 provides for fair use through a contextual assessment that includes the purpose and character of the use, the nature of the work, the amount used and the effect on the potential market. These provisions do not supply a blanket answer for every AI training activity. [1]

Start with an inventory of the material the company plans to use. Distinguish content created internally, customer uploads, licensed collections and material obtained from public websites. For each category, record where it came from and the basis on which the company proposes to use it. Public availability should prompt a rights assessment rather than replace one. Where the business relies on fair use, counsel should evaluate the proposed use and its supporting facts instead of treating the label 'AI research' as the conclusion. [1]

Licensing negotiations should identify the activities contemplated by the product. Permission to access a database may describe a different commercial arrangement from permission to train a model, retain copies or supply a service to downstream customers. Review the actual license language against each intended activity. Keep the relevant license version and any negotiated permissions with the dataset records. If a supplier cannot explain its own rights, consider whether further diligence, a narrower dataset or a different source would better fit the launch plan.

California also requires a separate training-data transparency review. Civil Code sections 3110 and 3111 address developers of generative AI systems or services made publicly available to Californians, whether paid or free, including covered substantial modifications. Section 3111 requires developers to post training-data documentation on their websites by January 1, 2026, and before subsequent covered public releases; it addresses systems or services released on or after January 1, 2022. The documentation includes a high-level dataset summary covering sources or owners, data types, whether protected material or personal information is included, and whether datasets were purchased or licensed, among other required disclosures. The statute contains exceptions for specified security, aircraft-operation and federal national-security uses. Developers should assess the definitions and exceptions against the actual product and prepare the required documentation before a covered launch. Transparency disclosures do not resolve the separate copyright-permission analysis. [2]

Match Privacy Practices to the Actual Use

An AI company should establish its role and whether the California Consumer Privacy Act applies before treating every data flow alike. For covered businesses, California's regulations require collection, use, retention and sharing of personal information to be reasonably necessary and proportionate to the purposes for which it was collected or processed, or another disclosed purpose compatible with the context of collection. Those purposes must also satisfy the rules on consumers' reasonable expectations and compatibility. A broad description of future innovation should therefore be assessed against the actual proposed processing, rather than treated as a complete answer. [3]

As a practical review, map the information in prompts, uploaded files, account records and diagnostic logs. Identify which information remains in the company's own systems and which passes to a model provider or other vendor. Separate processing needed to deliver a customer's requested service from proposed uses for training, evaluation or unrelated product development. The legal review should examine the relevant notices and permissions for each proposed use. A customer's contractual willingness to upload material should not be assumed to resolve every privacy question involving the individuals described in it.

For example, a tool intended to summarize customer-support records may receive names, account information and sensitive details embedded in free-text messages. Before allowing those records to enter a broader training process, the company should evaluate that separate use and the safeguards it would require. Product settings, published explanations and vendor instructions should describe the same arrangement. Assign someone to review proposed changes so a technical update does not quietly expand the uses of information beyond the arrangement counsel evaluated.

Covered businesses should also determine whether a pre-processing risk assessment is required. Section 7150 identifies specified high-risk activities, including processing sensitive personal information, using automated decisionmaking technology (ADMT) for a significant consumer decision, and processing personal information intended to train ADMT for such decisions or specified identification technologies. These rules do not make every use of AI a risk-assessment trigger. For new covered processing, sections 7150(a) and 7155(a)(1) require a documented assessment before processing begins. Processing initiated before January 1, 2026 and continuing afterward has a transitional assessment deadline of December 31, 2027 under section 7155(b). For the support-record example, assess whether the information and proposed use fall within a listed category rather than assuming all free-text data are legally sensitive. [4]

Define the Obligations of Model Providers and Other Vendors

California's service-provider rules make the wording of the data-processing agreement important. Section 7051 requires contracts with service providers and contractors to identify specific business purposes and include restrictions and protections concerning personal information. These include limits on use, oversight rights and notice when the provider can no longer meet its obligations. Section 7050(e) states that an entity without the required compliant contract is not a service provider or contractor under the CCPA. The applicable role therefore needs more than a label in the sales proposal. [5]

During negotiations, ask whether the model provider will use customer information for its own purposes and whether it relies on additional providers. Compare its written commitments with the account settings available for the product being purchased. A commitment relating to one enterprise service should not be assumed to describe every tool offered by the same supplier. Where the California service-provider framework is applicable, use the required contractual terms as the starting point, then identify additional operational commitments the customer needs. [5]

Useful subjects for negotiation include access controls, retention periods, incident communications and assistance with consumer requests. Clarify what happens when a customer closes an account, asks for information to be deleted or disputes whether an instruction was followed. Distinguish handling stored files from handling information already used in model development, and ask the provider to explain the operations it can perform. The agreement should describe practical procedures the parties can implement rather than promise a technical result nobody has assessed.

Oversight should continue after signing. Section 7051(c) explains that diligence concerning service providers and contractors affects whether a business has reason to believe information is being used unlawfully. A business that never enforces its contract or exercises audit or testing rights might be unable to rely on the defense that it had no reason to believe the provider intended an unlawful use when the information was disclosed. [5]

Review Product Claims Before They Reach Customers

The Federal Trade Commission Act supplies an important legal starting point for businesses within the FTC's jurisdiction. Section 5(a)(1) prohibits unfair or deceptive acts or practices in or affecting commerce. Marketing an AI product should therefore involve a review of whether the claims presented to customers could mislead them about its capabilities or limitations. Statements about accuracy, security, confidentiality or professional performance deserve particular attention when those statements influence a purchasing decision. [6]

Build a record connecting important claims to the tests and assumptions supporting them. If the company advertises a performance percentage, identify the task measured, the testing conditions and the relevant product version. If the claim concerns a comparison with human performance, examine whether the comparison describes the actual intended use. These are practical steps for evaluating advertising risk, not a claim that one particular testing method will establish compliance for every product.

Review sales demonstrations and customer presentations alongside the website. A carefully qualified product description can lose its meaning if a salesperson promises that the system never makes mistakes or that customer information is never retained. Give the sales team language reflecting the features the product actually offers. When testing identifies limitations, discuss whether to change the product, narrow the claim or restrict the proposed use before making further commitments.

Negotiate Responsibilities That the Company Can Perform

Commercial agreements should distinguish the customer's permitted uses from any promises about exclusivity, ownership or third-party rights. Ask which inputs the customer supplies, which components the provider controls and what documentation supports the promised permissions. Review proposed intellectual-property indemnities against that division of responsibility. Consider who selects defense counsel, controls a settlement and pays the associated costs, as well as the exclusions and liability limits that may affect the protection being negotiated.

Operational remedies also deserve attention. An AI company dependent on an external model should consider the consequences of a material model change, a suspension or a discontinued feature. Discuss notification, transition assistance and access to customer information. A customer may prefer a defined exit process to a broad assurance of uninterrupted service that the provider has not supported. The appropriate bargain will depend on how important the product is to the customer's operations and which dependencies the vendor can realistically manage.

Before launch, bring the product description, data inventory, privacy materials, evidence supporting sales claims and proposed contracts into the same review. Record the unresolved issues and identify who can decide whether to address them technically, renegotiate them or narrow the launch. Repeat that review when a material feature or data use changes. This gives founders and their advisers a concrete basis for deciding what the business is ready to sell, which protections it can offer and where further work is needed.

Primary Legal Authorities

[1] 17 U.S.C. §§ 106(1)-(3), 107. Exclusive rights and statutory fair-use factors.

[2] Cal. Civ. Code §§ 3110–3111. Training-data transparency; § 3111 as amended by Stats. 2025, ch. 67, § 35 (AB 1170), effective January 1, 2026. Definitions: § 3110.

[3] 11 Cal. Code Regs. § 7002(a)–(c), pp. 13–15. Processing purposes, reasonable expectations and compatibility.

[4] 11 Cal. Code Regs. §§ 7150(a)–(b), 7155(a)(1), (b), pp. 83–84, 88–89. Risk-assessment triggers and timing, including transitional processing.

[5] 11 Cal. Code Regs. §§ 7050(e), 7051(a)–(c), pp. 59–62. Service-provider status, contractual requirements, subcontractors and diligence.

[6] FTC Act § 5(a)(1), 15 U.S.C. § 45(a)(1). Prohibition of unfair or deceptive acts or practices in or affecting commerce.

General information only. This article does not constitute legal advice or create an attorney-client relationship.

Discuss Your Situation

For advice on a specific business transaction or legal issue, contact Alex Nahai Law to discuss the relevant documents and circumstances.

This article is for general informational purposes only and is not legal advice. Reading it does not establish an attorney-client relationship.