Skip to main content
To KTH's start page

Legal aspects of generative AI

The use of generative AI has several legal implications that must be considered and managed, just like with any other digital tool at KTH. Here we briefly explain how you as a teacher handle intellectual property rights and copyright, the General Data Protection Regulation (GDPR) and the AI act from the EU.

Intellectual property and copyright

Copyright protects you as a creator by giving you exclusive rights to what you have created for a limited time. Copyright is a type of intellectual property right that comes into effect automatically, while you need to apply for the other three types of intellectual property rights (patent law, trademark law and design law). Read more at Intellectual property rights (prv.se) .

Material created by generative AI lacks copyright protection as copyright only applies if a human has created the material. Therefore, unless otherwise stated in the terms of use of the AI tool, the generated material is free to use by anyone, including those who own the AI tool. In order for the material to be copyrighted, you must edit the material to the extent that you are deemed to have created a new work. 

If you create a prompt that contains other people's material, make sure that you have permission from the copyright owner for that type of use. This also applies to material created by students. Learn more about Using other's teaching material .  

A major risk with generative AI is that you may accidentally recreate protected works when generating new material. This can happen because generative AI tools need to be trained on large amounts of human-generated material, and the internet is the easiest source for the amount required. Much of the material available on the internet is not free to use. The training data for generative AI tools therefore likely contains copyrighted material. 

Copyright for AI-created material is explained in more detail by the Swedish Patent and Registration Office: Copyright on AI images (prv.se) . 

General Data Protection Regulation (GDPR) 

The overall purpose of the GDPR is to ensure and strengthen the individual's right to their privacy through the protection of personal data. KTH must ensure that the rights of the individual are ensured at all stages of the processing of personal data and regardless of the way. Read more about GDPR on the page General Data Protection Regulation (GDPR) .

You are advised to clear prompts from personal data when using generative AI tools. It is difficult to delete personal data once it has ended up in the training data of the tool, which makes a preliminary purge the safest and easiest method to ensure proper handling of personal data.  

If you do not purge personal data, you must verify that your use of generative AI tools meets GDPR requirements. In the following list, you'll find a selection of key questions to answer before using generative AI tools: 

  • What is your lawful grounds for handling personal data with the AI tool? 
  • How do you guarantee that no personal data is sent or stored outside of Europe or stored with a third party?  
    • A third party means someone other than you or the company behind the AI tool. 
  • How do you guarantee that no personal data is used to train the tool? 
    • Many generative AI tools have this as a setting. For example, in ChatGPT, you need to turn off the setting "Improve the model for everyone". 

What is personal data?

The Swedish Authority for Privacy Protection states the following: "Personal data is any kind of information that can be directly or indirectly linked to a person who is alive" on the page What is actually meant by personal data? (imy.se) . 

This includes obvious things like names and social security numbers, but also email addresses, pictures and audio recordings.

The AI act

The AI act is an EU law that determines (among other things) how AI may be used and under what conditions. The law covers all kinds of AI, including generative AI. You can find the text of the law on the page EU Regulation 2024/1689 (eur-lex.europa.eu) .

The AI Regulation focuses on the use of AI that is categorized as prohibited or high risk but also includes rules that apply to all use cases. High-risk means AI that risks having a negative impact on our safety, health or fundamental rights. 

As a teacher, you need to do the following: 

  • Meet the requirement for transparency. The easiest way to achieve this is to state when and how you have used a generative AI tool. Make sure that the information can be read by both humans and machines. There are exceptions to the transparency requirements, if you are interested in them, you are welcome to read the legal text. 
  • Meet the requirement for understanding AI. You, as a teacher, must provide your students with an adequate understanding of the risks, opportunities, and possible harm that can occur due to AI. The acceptable level of understanding should be adapted to the target group and expected use of AI. 
  • Exclude prohibited uses. This is very simple as prohibited use mainly involves the analysis and manipulation of people's decisions and feelings with the intention of causing harm. 
  • Try to avoid high-risk use. For example, high-risk uses could be using AI for grading or for controlling student learning. See the end of this page for exactly what counts as high-risk in education. 
    • Tip: Exceptions are made if the use of AI does not significantly affect the outcome of the decision-making. 

Note that high-risk use is not prohibited, it is only resource-intensive and requires that the use is registered in an EU database. 

Under the following headings, you will find the legal text for high-risk and prohibited use of AI.