From the filing
PDF page 60
Printed filing page 49 · Extracted page text
Read the page text
Table of Contents Individuals at risk of suicide or self-harm or who have committed acts of violence toward others have used, and may also in the future use, our models, notwithstanding our safeguards. AI models developed by others in our industry have been and may in the future be alleged to have played a role in instances of suicide, acts of violence toward others, or serious self-harm, which have resulted and may in the future result in significant public scrutiny, litigation, criminal investigations, regulatory attention, and reputational harm. Similar incidents involving our models have presented and could in the future present substantial risk to our reputation, expose us to legal, regulatory, and other proceedings, and adversely affect our business, financial condition, and results of operations. While our current Consumer Terms of Service requires our users to be at least 18 years of age, minors have accessed in the past, and may in the future access, the platform, and risks relating to child safety may be particularly acute, as minors may be more susceptible to harmful content, manipulation, or overreliance on AI outputs, and incidents involving children tend to draw heightened regulatory, media, and public scrutiny. State attorneys general and private plaintiffs have also begun to assert tort, product liability, consumer protection, and failure-to-warn claims against companies in our industry, alleging that AI models caused or contributed to harm and that the developer failed to adequately warn users of known risks. In at least one case, a state attorney general has initiated a criminal investigation against another company offering similar services. Regulators have obtained substantial monetary settlements and injunctive relief against other technology companies based on analogous theories of product-design or algorithmic harm, and we believe similar theories are likely to continue to be tested against us and other companies in our industry as adoption of our models grows, including by minors and other vulnerable users, notwithstanding our efforts to restrict such access. The relief sought in such matters has, in at least one instance, extended beyond data-handling, disclosure, or age- verification practices to include a request to enjoin an AI company from developing new models absent independent, third-party safety review and approval, illustrating the potential breadth of remedies governmental actors may pursue against companies in our industry. Any determination that we are liable under such theories, or any judicial or regulatory expansion of tort, product liability, or consumer protection law, or criminal liability, as applied to AI models, could result in significant liability and require us to change how we design and offer our models, platform, and applications. A substantial portion of our traffic is subject to Zero Data Retention (“ZDR”) terms under which we retain only classifier scores, not prompts or outputs. For that traffic, we cannot conduct offline analysis, cross-conversation investigation, human review, or otherwise analyze historical data to detect, investigate, and document security events or incidents, which thereby reduces our ability to detect misuse. ZDR may also prevent us from producing records for subpoenas, regulatory examinations, or incident-reporting obligations, and there is no certainty a regulator or court would excuse non-production based on a lack of available records, and such regulators or courts may construe the lack of records against us through unfavorable inferences or other sanctions. As our models become more capable, our safety framework has required and may continue to require monitoring and retention incompatible with ZDR for certain model classes. Because ZDR is a competitive expectation for enterprise customers in regulated industries and on third-party cloud platforms, these requirements have caused and could continue to cause customers to migrate to other providers or to deployments where our visibility is more limited. In the European Union (“EU”), the United Kingdom (“UK”), and elsewhere, cybersecurity and AI-related incidents are subject to increasingly stringent reporting obligations. European regulators expect companies to provide detailed information about incidents under several laws and regulations, which we may not be able to provide within the prescribed time frame. Similarly, in the United States, companies are increasingly subject to incident reporting obligations. In addition, other jurisdictions around the world have adopted, or may adopt, similar laws and regulations with similar implications. Any of the foregoing could result in regulatory action, litigation, customer attrition, or reputational harm that adversely affects our business. For more information regarding our incident reporting obligations, see the section titled “—Any security breaches or other incidents, including those that affect our networks, systems, or data, or the networks, systems, or data of our service providers, suppliers, or customers, could adversely affect our business, financial condition, and results of operations.” The legal frameworks governing liability for actions taken autonomously by AI systems, including our agentic products, are unsettled and could expose us to significant and unpredictable legal claims. Existing legal doctrines governing agency, product liability, and professional negligence were developed in the context of 49
Text is provided for reference. Check the original for tables, images, and exact formatting.