Understand how other existing laws apply to AI

At a glance

This competency covers the non-privacy existing laws that already apply to AI. There is no AI carve-out here either: if an output infringes copyright, discriminates, deceives a consumer, or comes from a defective product, the ordinary law applies. Four bodies of law:

1. Intellectual property — training-data/copyright and the human-authorship rule (II.B.1)
2. Nondiscrimination — Title VII, ECOA, FHA; disparate impact across employment, credit, lending, housing, insurance (II.B.2)
3. Consumer protection — FTC Act §5 UDAP, deceptive AI claims, algorithmic disgorgement (II.B.3)
4. Product liability — design, manufacturing and warning defects; the revised EU Product Liability Directive (II.B.4)

II.B.1 — Intellectual property

Two distinct IP questions — do not merge them.

(a) Training inputs. Does copying copyrighted text, images or code to train a model infringe? In the U.S. this turns on fair use (an unsettled, fact-specific defence, heavily litigated). Other regimes use narrower exceptions — e.g., the EU’s text-and-data-mining (TDM) exception, which rights-holders can opt out of (reserve their rights). The EU AI Act requires GPAI providers to respect such opt-outs and to publish a summary of training content.

(b) AI outputs. Can AI-generated content be owned/protected? The U.S. Copyright Office position: copyright protects only human authorship. Output generated purely by a prompt, with no human creative control over the expressive elements, is not copyrightable; works with sufficient human authorship (selection, arrangement, modification) may be protected in those human-contributed parts.

II.B.2 — Nondiscrimination

Existing civil-rights statutes reach algorithmic decisions in the sectors the BOK names:

Two theories of liability:

• Disparate treatment — intentional discrimination (e.g., a model deliberately using a protected trait).
• Disparate impact — a neutral practice that disproportionately harms a protected group without sufficient business justification. No intent required. This is the dominant theory for AI bias: a model can be facially neutral yet produce discriminatory outcomes via proxy variables (e.g., zip code standing in for race).

Agency posture. The EEOC has confirmed Title VII applies to AI hiring tools; the CFPB has confirmed ECOA’s adverse-action-notice duty applies even when an opaque model makes the decision (lenders cannot hide behind “the algorithm did it”). City/state rules add specifics — e.g., NYC Local Law 144 requires an independent bias audit and candidate notice for automated employment decision tools.

II.B.3 — Consumer protection

FTC Act §5 bars unfair or deceptive acts or practices (UDAP) in commerce — the FTC’s primary AI tool in the U.S. Two prongs:

• Deceptive — false or misleading claims. Targets “AI-washing”: overstating what a product’s AI can do, claiming a system is “bias-free,” or misrepresenting that a service is human (or AI). Keep your AI claims in check.
• Unfair — practices causing substantial, unavoidable consumer injury not outweighed by benefits — e.g., deploying a model known to harm consumers, or training on data collected deceptively.

Algorithmic disgorgement (model deletion). A signature FTC remedy: where a company built a model using illegally or deceptively obtained data, the FTC can require it to delete the data and the models/algorithms derived from it. This destroys the tainted asset itself — a far stronger deterrent than a fine alone (seen in matters such as Everalbum and Rite Aid).

II.B.4 — Product liability

When an AI-enabled product causes physical or economic harm, product-liability doctrine applies. The three classic defect theories:

• Design defect — the product is unreasonably dangerous as designed (the AI’s intended behaviour is itself unsafe).
• Manufacturing defect — the product departs from its intended design (a flawed build/training run).
• Failure to warn (warning defect) — inadequate instructions or warnings about foreseeable risks and limitations (e.g., not disclosing a model’s known failure modes or operating envelope).

EU Product Liability Directive (revised 2024). The modernised PLD explicitly brings software and AI systems within strict product liability, treats software updates and self-learning as relevant, and eases the claimant’s burden of proof (disclosure duties and presumptions of defectiveness/causation where AI complexity makes proof excessively difficult). Defectiveness can arise after sale through updates or the system’s own learning. A separate AI Liability Directive proposal addressed fault-based claims but was later withdrawn — so the revised PLD is the operative EU instrument the exam expects.

Sector-specific regulators (know they exist)

Beyond the horizontal regimes above, several sector regulators already govern AI within their remit — the exam expects you to recognise which regulator owns which context:

How this shows up later

• Disparate impact is the legal engine behind fairness testing and bias audits you will design in Domains III–IV, and behind the Colorado AI Act’s “algorithmic discrimination” duty (II.C).
• Human authorship / training-data IP connects to data-governance and provenance policies (Domain III) and vendor/licensing terms (Domain IV).
• Product-liability defect theories reframe “safety and reliability” (I.A.4) as legal exposure, motivating documentation, warnings and post-market monitoring (Domain III).