Five Things the Law Is Teaching Us About AI Right Now

The legal issues surrounding AI are increasingly not questions of technology. They are questions of governance, supervision, contracting, and accountability.

By Andrew R. Silverman, Esquire

On October 14, 2026, I participated on a panel at TECH360 in Malvern titled “AI in Action: Navigating Legal Risk & Governance Across Industries.” This year’s conference theme was “Beyond the Hype,” and our panel looked at how AI is changing legal risk in technology, healthcare, fintech, and manufacturing.

I was asked to speak about AI in the manufacturing space. In preparing, I reviewed the court decisions and enforcement actions from 2023 through this fall that say something useful about how organizations should govern AI. What stood out was how little of it is industry-specific. Decided cases squarely about AI quality control, predictive maintenance, or smart factories are still rare.

The lessons come instead from lawyers sanctioned for unverified filings, experts whose AI-assisted reports were thrown out, court orders restricting what data may be put into AI tools, and software contracts enforced exactly as written. Those lessons apply equally to a plant floor, a medical practice, a bank, or a software company.

Perhaps the most surprising takeaway is that many of these disputes are not really about AI accuracy. They are about governance. The recurring question is not whether the technology worked, but whether anyone stopped to ask if the organization was permitted to use it the way it did.

Below are the five themes I shared on the panel, with manufacturing examples alongside examples from other industries. One caution at the outset. Much of this law is early (many decisions are sanctions rulings or motions to dismiss rather than final judgments), so the holdings are best read as signals of where courts and regulators are heading.

1. AI Does Not Change Who Is Responsible

AI may assist the work, but legal responsibility stays with the people and organizations using it. Courts are consistently treating AI as a tool, not as a decision-maker that can absorb liability. Existing duties (a professional’s duty of care, a company’s duty to stand behind its products, a firm’s duty to supervise) apply with full force when the work is done with AI.

The attorney cases make the point most clearly. In Mata v. Avianca, Inc. (S.D.N.Y. 2023), lawyers who filed a brief citing cases ChatGPT had invented were sanctioned, and their firm was held jointly liable. In Johnson v. Dunn (N.D. Ala. 2025), the court reached the attorneys who signed and filed the motions, not only the one who inserted the AI-generated citations. Financial regulators take the same view. FINRA has described its rules as technology neutral, meaning firms remain fully responsible for supervision and cannot point to a vendor as a shield.

In manufacturing, the translation is direct. If a predictive maintenance platform tells a plant manager that a critical pump can safely run six more months and it fails two weeks later, the vendor will say its recommendation was informational. The customer will ask why the company relied on it. The same is true when an AI tool recommends a credit decision, drafts a patient communication, or flags a contract clause as acceptable. Regulators, customers, and courts will still ask who approved the decision, not what the algorithm thought.

2. Human Oversight Is Becoming the Expected Standard

The cases repeatedly show that blind reliance on AI is risky. Organizations should assume that if AI is involved in an important decision, a qualified person must meaningfully review and validate the output.

The Second Circuit put it plainly in Park v. Kim (2d Cir. 2024). Attorneys must read and confirm the authorities they cite. In Benjamin v. Costco Wholesale Corp. (E.D.N.Y. 2025), a lawyer who admitted she only skimmed an AI-rewritten brief was told she could not hand core professional responsibilities to an AI platform and file the result without review.

This expectation is not limited to lawyers. In Matter of Weber (N.Y. Sur. Ct. 2024), an expert used Microsoft Copilot to check damages calculations but could not say what prompt he used or what sources it relied on. The court refused to accept the AI-generated figures and required parties to disclose AI use before offering AI-generated evidence. In Kohls v. Ellison (D. Minn. 2025), an expert’s sworn declaration was excluded entirely because it contained citations GPT-4o had fabricated.

Three practical points follow.

1. The reviewer must be someone capable of independent judgment, so the review itself cannot be delegated back to AI.
2. Review should be most rigorous where the decision affects safety, quality, health, finances, or customer commitments. And the review should be documented.
3. A manufacturer that periodically audits an AI quality-control system, tests samples, and validates its performance is in a far stronger position than one that accepts every AI determination as final.

AI works best as a copilot, not an autopilot.

3. The Biggest Risk Often Occurs at the Input Stage

Most organizations worry about bad outputs. Many legal problems, however, arise earlier, when employees put confidential, regulated, or contractually restricted information into an AI system in the first place. The question is increasingly what data went in, not just what came out.

Courts are now writing this standard into their orders. In three 2026 decisions (Skaf v. Google LLC in the Southern District of New York, Morgan v. V2X, Inc. in the District of Colorado, and Stansfield v. International Business Machines Corp. in the District of Nevada), courts restricted the use of confidential litigation material in AI tools. Under these orders, confidential information may go into an AI tool only if the provider’s contract bars training on the inputs, bars disclosure to third parties, and allows the data to be deleted. The Skaf order treats use of a non-compliant tool as an unauthorized disclosure to a third party. The Morgan court acknowledged that these conditions would rule out most free or low-cost mainstream AI tools.

Every organization holds information of this kind. For a manufacturer, it is engineering drawings, customer specifications, formulas, production methods, and supplier pricing. For a healthcare provider, it is patient information. For a financial services firm, it is customer account data. For a software company, it is source code. An engineer who uploads proprietary CAD drawings to a free AI platform to get design suggestions may have created trade secret, confidentiality, or contract problems before the tool produces a single word. The first compliance question should always be whether this information can go into this tool.

4. Your AI Vendor Is Probably Not Carrying Your Risk

Many AI providers use contracts that disclaim responsibility for inaccurate output and cap their liability. If an AI mistake causes significant business loss, the customer may find that most of the legal and financial risk stays with it.

Courts are enforcing those terms. In Baldwin Hackett & Meeks, Inc. v. Early Warning Services, LLC (8th Cir. 2025), applying Delaware law, the court enforced a clause capping a software provider’s liability at the fees paid, describing it as the bargain two sophisticated parties made. In HI Technology Corp. v. Quality Investment Properties Suwanee, LLC (Ga. Ct. App. 2023), a carve-out for gross negligence was honored, but even grossly negligent conduct remained subject to a $1 million cap. In Hydro Systems, Inc. v. Factory Automation Systems, Inc. (N.D. Ga. 2025), a manufacturer that paid about $1.16 million for robotic finishing systems found that the contract’s exculpatory clause barred its claim for consequential damages.

There are limits to these protections. Courts have allowed product liability claims against AI developers and have held that disclaimers stop working once a provider knows its output is false. Those exceptions mostly help injured third parties, though, not the business customer that signed the contract.

Consider a manufacturer relying on an AI forecasting platform that causes a shortage of a critical component. Production stops for a week, and the losses run into the millions, while the vendor’s contract limits recovery to the annual subscription fee. AI procurement deserves the same legal scrutiny as any other major technology acquisition, including negotiated carve-outs for data misuse, security failures, and gross negligence, along with clear acceptance criteria.

5. The Governance Problem Is Usually Unauthorized Adoption

The most common challenge is not whether an organization approved AI use. It is whether employees started using AI before anyone in legal, compliance, IT, or management evaluated the contractual, regulatory, confidentiality, or cybersecurity implications.

AI features now arrive inside software organizations already own, and employees often start using them without telling anyone. A purchasing manager uses an AI tool to analyze vendor bids. An engineer drafts process improvements with a generative AI platform. A sales team uploads customer proposals to create summaries. None of this is malicious, and none of it was reviewed. Most organizations have stronger procurement controls than AI controls, and leadership often overestimates how much visibility it has.

Unreviewed adoption also reaches public statements. The FTC’s “Operation AI Comply” and the SEC’s first “AI washing” cases targeted companies that claimed AI capabilities they could not support. A marketing team that describes a product as “AI-powered” without evidence is creating the same kind of unmanaged risk as an employee using an unapproved tool.

What Organizations Should Do Now

The controls that hold up best in these cases are not complicated. Organizations that can show a reviewed, approved, and documented process are consistently better positioned than those that cannot, regardless of how the technology itself performs.

Every governance program starts with the same question: Where is AI already being used inside the organization? Most organizations know less than they think. Before a company can govern AI, it first needs visibility into both approved and unapproved uses.

1. Find out where AI is already in use. Build an inventory that includes AI features embedded in existing software, not only stand-alone tools.
2. Route every AI tool through one approval process. IT, security, legal, and compliance should each review a tool before employees use it, and the approved list should be easy to find.
3. Adopt a written rule for data inputs. Confidential, proprietary, personal, and customer or vendor information should go only into approved tools, with written authorization for exceptions.
4. Confirm the three contract terms courts now look for. Approved providers should be contractually barred from training on your inputs and from disclosing them to third parties, and you should be able to delete your data. Keep written proof for each tool.
5. Require documented human review scaled to the stakes. The reviewer should be qualified to exercise independent judgment, and the review should be recorded.
6. Name an accountable owner. Each AI use case should have a responsible person, with oversight at the management or board level.
7. Negotiate vendor contracts deliberately. Seek carve-outs from liability caps for data misuse, security failures, and gross negligence, and define acceptance criteria and remedies up front.
8. Substantiate any public claim about your AI. Marketing materials, sales presentations, and investor communications should describe AI capabilities only as far as the evidence supports.
9. Keep physical safeguards in place for automated operations. For manufacturers, cases such as Alicea v. Cincinnati Inc. (1st Cir. 2026) show that emergency stops, presence sensing, intact machine guarding, and documented maintenance remain where liability is decided, whether or not AI is running the line.

Existing Law Is Doing Most of the Work

One of the most important observations from the current body of AI litigation is how little of it depends on new AI-specific legal doctrines. Courts and regulators are largely applying familiar legal principles: negligence, contractual allocation of risk, fiduciary duties, confidentiality obligations, trade-secret protection, supervision requirements, professional responsibility rules, securities laws, and consumer protection statutes.

Organizations should not mistake the absence of extensive AI-specific regulation for the absence of legal risk. Most disputes involving AI today are being resolved under legal principles that have existed for decades.

The Bottom Line

The legal issues surrounding AI are increasingly not questions of technology. They are questions of governance, supervision, contracting, and accountability. Organizations are free to use AI, but they are expected to govern it.

The organizations that succeed will not be the ones that avoid AI. They will be the ones that know where it is being used, what data it touches, who is accountable for it, and how its outputs are being validated.

Andrew R. Silverman is a partner in the Business Department at MacElree Harvey, Ltd., where his practice focuses on mergers and acquisitions, tax structuring of complex transactions, and corporate governance for Delaware and Pennsylvania entities. If your organization is evaluating AI tools, reviewing an AI vendor agreement, or building an AI use policy, contact Andrew at 610-840-0286 or asilverman@macelree.com.

This article is for general informational purposes and is not legal advice.