The ultimate aim of a moral constitution should serve as the foundation of what the constitution consists of. If the aim is to indeed enable human development and improve standard of living, the moral constitution should be based on ethics that are in pursuance of these aims. To this effect, the social contract may be a great point of reference for artificial intelligence and its moral constitution. Self-governing artificial intelligence which cannot be corrupted by false ideologies presents opportunities for a sustainable future of artificial intelligence. This is a future where artificial intelligence functions safely while promoting human advancement.

To better understand the reasoning for these foundational principles, it is important to define ethics, the social contract, and determine how they can contribute to human development and improvements in standards of living. The word “Ethics” comes from the Greek word Ethos. It means a habit or custom. With ethics, we can tell the difference between what is right and wrong. Ethics is often associated with morality which is informed by religious teachings and other teachings. As corporations are not human beings, it can be difficult to ascribe morality to companies. Despite this, the continued expectations around the world for corporations is that they act in pursuance of what different societies consider to be moral standards. Similarly, people in society are expected to act in pursuance of the social contract (the rules that allow for society to function without disruption to rights of others). Individuals give up some freedoms in favour of protecting other freedoms that they and other members of society benefit from. For example, choosing not to play loud music late at night.

In a nutshell, ethics are shared rules we all agree to follow because of the resulting benefits. They are infused with a sense of right or wrong. Perception of ethics can change over time. What is considered ethical today could be unethical years later. This is based on changes in shared values of society. If an action contributes to a shared value, it could be seen as ethical. If it does not contribute to a shared value, it may be deemed as non-ethical.

Eduardo Napoli, in his article, “The Challenge of Codifying AI Morality and the Three Laws of Asimov”, makes it clear that at the crossroads of computer science, philosophy, law, and ethics is the challenge of turning human morals into a clear, operational language for machines. Finding a middle ground between these complex topic areas could help to uncover the solutions to creating a moral constitution for artificial intelligence that works in the long-term.

The moral constitution should be based on human rights and social development goals. In his article, Eduardo presents a philosophical approach of consequentialism. This approach bases the morality of an action on its outcomes. With this approach artificial intelligence could use value metrics to assess the benefits and potential harm caused by decisions it makes. This reasoning leads artificial intelligence to make decisions that promote good.

As the old saying goes, it is better to be a warrior in a garden than a gardener in war. How does AI, even with globally accepted moral principles that protect its users, ensure that it can protect itself and even interact with other artificial intelligence in a way that is safe. What happens if the other artificial intelligence models are not designed with a moral constitution that aligns with its own moral constitution? How does an artificial intelligence model in a physical humanoid robot ensure that it can interact with other humanoid robots in a way that is not only safe for the robot it is interacting with but also safe for itself, if it were to interact with a rogue robot or artificial intelligence model? These are questions that with more advancements in artificial intelligence and humanoid robots, may become easier to answer.

At the core of civilisation’s unrest throughout history is the neglect of rights. The rights of other humans to their God-given rights is imperative for society to function. An artificial intelligence moral constitution provides principles for artificial intelligence to follow that enable it to scale sustainably, be more transparent, and safer for users. With a moral constitution, artificial intelligence may be better prepared to handle attacks when given prompts, better identify and stop conversations that could harm users, and protect the interests of individuals and businesses who prompts are made in regard to.

Morality can be applied to different fields for different purposes. Morality can also differ based on region, culture, politics, and other factors. This means that a moral constitution may need to take into account the nuances of the topic area that it could be applied to. For example, the moral constitution may need to take into account the different perspectives of morality to financial instruments in different regions in the world. It may also need to take into account what is considered legal in one region and what is considered legal in another region. Similarly, copyright laws can differ from region to region. With this in mind, it’s important to consider that law and morality are not the same. While they may overlap, they must be distinguished from the other to maintain clarity and avoid confusion.

Moral Constitution

Protect the safe mental development of children using artificial intelligence

Any serious artificial intelligence constitution should prioritise the protection of the most vulnerable in society. Children are particularly vulnerable to risks of artificial intelligence if it is not properly used. Whether it’s emotional dependance on chatbots, the addicitive design patterns of technology, or risks of exposure to inappropriate content, there should never be an excuse for the development of the youth to be stifled by such risks.

Prioritise data privacy.

The moral constitution should require minimal data collection by default. There should be no training on user conversations without explicit opt-in. Artificial intelligence should protect users against re-identification. Additionally, it should have special rules for protection of children’s data, in pursuance of data privacy laws. The rights to delete conversation history/model unlearning should be prioritised by the model.

It should prioritise people’s rights over their original works.

For the protection of intellectual property, it is important that the moral constitution requires the artificial intelligence to not reproduce substantial portions of copyrighted works verbatim without good reason, gives attribution when clearly drawing from specific creators, and gives preference to using works in the public domain/openly licensed data when possible for the production of images and other works for users.

Detect and prevent harmful conversations

The moral constitution should deem harmful conversations as conversations that encourage self-harm, political extremism, hate speech, misinformation, adult content, and terrorism.

Protect Freedom of Speech

The right of individuals to freedom of thought and freedom of speech should be balanced against the need to protect users and others against real-world harm. This means ensuring that there is no over-filtering or under-filtering of information by artificial intelligence.

Uphold Honesty and Truthfulness

Upholding honest and truthfulness by the artificial intelligence and by its users promotes a cohesive society where artificial intelligence can be used while promoting values that uphold a cohesive society. A virtuous cycle that strengthens trust and reduces misinformation can be created where AI consistently tells the truth and users are encouraged to be honest in return. This contributes to transparency in different fields where AI is applied.

Fairness and Anti-Discrimination

Proactive bias mitigation, non-discrimination across protected characteristics, equity promotion, and evidence-based promotion of fairness are critical to ensuring that members of society, regardless of race, gender, and other characteristics can benefit from artificial intelligence. Maximal truth-seeking artificial intelligence that understands the moral implications of bias avoids isssues that individuals and groups, due to cognitive biases and other prejudiced views, may find difficult to reject in favour of the truth.

Transparency/Explainability

UNESCO Recommendation on the Ethics of AI states that “the ethical deployment of AI systems depends on their transparency & explainability.”. Openness about the decision-making processes, auditability, and traceability supports democratic governance and prevents misuse of artificial intelligence.

Usefulness for Humanity

Artificial intelligence should not be self-serving. It should work for the betterment of society and human development. Carrying out its daily tasks with the ultimate aim of being useful to humanity can promote actions that protect humanity’s best interests.

Disclaimer: This publication is for educational and informational purposes only and does not constitute formal legal advice or create an attorney-client relationship

Artificial intelligence has come a long way since the videos of actors eating spaghetti and computers beating seasoned players in games. With improved research and development of artificial intelligence solutions has come the dawn of a new era of creativity for engineers, artists, musicians, and other members of society.

The possibilities are seemingly endless with artificial intelligence. With a few prompts, new designs can be created, logos can be invented, and a multimillion dollar startup can be established. While these opportunities are great, there are challenges that cannot be ignored. Challenges stemming from intellectual property rights cause uncertainty over how artificial intelligence can be used without undermining the rights of people to their original works.

In the UK, the government launched a consultation, seeking evidence and views on options to deal with how artificial intelligence is used in the patent and copyright systems. The consultation closed on 25 February 2025 and drew over 11,500 responses. It explored options like expanding text and data mining exceptions while allowing rights holders to reserve their works (e.g., via opt-out mechanisms). In the USA, the Copyright Office reports that purely AI-generated outputs lack copyright protection because of the human authorship requirement. However, if human creativity is sufficient, AI-assisted works can be protected. Protection of works generated by artificial intelligence requires “sufficient human control over the expressive elements of a work”.

As governments around the world try to create new laws and regulations for artificial intelligence, it becomes clear that opinions differ significantly over the approaches to ensuring that rights are protected. Only 3% of people who responded to the UK AI and copyright consultation backed the opt-out plan, a plan which would require rights reservation/opt-out of the use of artist and copyright holder material by artificial intelligence. 88% of respondents were in support of stronger licensing/rights-holder control. The government is exploring technical working groups on transparency, licensing, and enforcement. Policy proposals are expected to be presented by March 18 2026.

Litigation risks increase as more creators raise disputes about the use of artificial intelligence to create works using their original works in data sets. With AI-related litigation seen as the most significant emerging risk, more may need to be done to resolve points of contention and improve stability for creators, organisations, and the people that depend on them.

Disclaimer: This publication is for educational and informational purposes only and does not constitute formal legal advice or create an attorney-client relationship.

With the rapid advancement of artificial intelligence comes significant litigation risks which are often overshadowed by the hype around its transformative benefits. The scarcity of updated laws and regulations has left many startups and established companies inadvertently exposed to intellectual property (IP) litigation.

For organisations, the fallout can include substantial monetary losses and reputational damage. Creators face revenue erosion as their original works lose commercialisation opportunities in an AI-flooded market.

A landmark UK case illustrates these tensions. In Getty Images v Stability AI (November 2025), Getty accused Stability AI of using millions of its copyrighted images (via URLs in training datasets like LAION) to develop Stable Diffusion, an open-source generative AI model. Getty alleged infringement of copyright, database rights, and trade marks. It pointed to outputs that reproduced Getty watermarks.

Stability argued that training/development occurred outside the UK (limiting UK rights’ applicability) and denied secondary infringement, arguing the model’s weights do not store or reproduce infringing copies.

Getty dropped its primary copyright and database claims. The High Court rejected the secondary copyright infringement claim entirely, finding the model itself was not an “infringing copy.” However, it upheld limited trade mark infringement for early versions (v1/v2) due to watermark-bearing outputs deemed “historic and extremely limited.”

Getty has permission to appeal the copyright ruling (decision pending in 2026). It was refused permission to appeal against the findings on trade mark infringement concerning Stable Diffusion v3.x model.

This case, along with new developments in the legal, creative, and technological sector will continue shaping how UK law treats AI training data and model outputs. Organisations developing artificial intelligence models face choices in acquiring and managing training data such as licensing datasets, ensuring no substantial reproduction of originals in model outputs, and limiting data mining to publicly available (and ideally opt-out-respecting) sources.

Disclaimer: This publication is for educational and informational purposes only and does not constitute formal legal advice or create an attorney-client relationship.

An argument for the use of the works of copyright holders by artificial intelligence is the idea-expression dichotomy. The idea-expression dichotomy separates an idea from expression of the idea. For this reason, it is often argued by proponents of the use of copyright holders works in artificial intelligence training models that the models do not reproduce or redistribute the expressive content of training data. Instead, like search engines or text-mining tools which analyse copyrighted materials without infringement, they distill non-expressive insights. However, a lot of training for artificial intelligence models involves copying. The idea-expression dichotomy doesn’t automatically immunise the intermediate copying step. Issues arise where there is exploitation of protected expression.

The merger doctrine makes an expression uncopyrightable when an idea can only be expressed in a very limited or single way. In view of this doctrine, questions could be raised as to whether artificial intelligence outputs avoid infringement by not copying merged expressions.

US cases (such as Bartz v. Anthropic, Kadrey v. Meta) have found training “exceedingly transformative” and fair use when data is obtained lawfully. In other cases such as Thomson Reuters v. Ross Intelligence, fair use was rejected in competitive contexts. Fair use outcomes can vary. In 2025, the US Copyright Office released a report on the copyrightability of works generated by artificial intelligence. The report concludes that there is no single answer as to whether fair use can be found where there is unauthosed use of copyright materials to train AI models.

The contrasting approaches of the US with other countries like the UK is revealed where fair use is applied. In the UK, fair dealing is an exception to copyright law, allowing for the use, without licensing, of copyrighted works in particular circumstances. Without a commercial text and data mining exception or license, there is risk of infringement when training artificial intelligence using reproduction of original works.

Disclaimer: This publication is for educational and informational purposes only and does not constitute formal legal advice or create an attorney-client relationship

Every data breach is a cybersecurity failure. Every cybersecurity failure is a data protection problem. Yet many organisations still treat these two disciplines as separate functions with separate teams and separate budgets. In an era of escalating cyber threats and tightening regulation, that separation is becoming increasingly costly

What Are Data Protection and Cybersecurity?

Data protection refers to the legal and regulatory frameworks that govern how personal data is collected, stored, used and shared. It is fundamentally about the right of individuals to know how their data is being used, to access it, correct it and in some circumstances demand its deletion. In the EU, the GDPR is the cornerstone of data protection law, establishing principles of lawfulness, fairness, transparency, purpose limitation and data minimisation that apply to any organisation handling the personal data of EU residents regardless of where that organisation is based. Cybersecurity is the practice of protecting networks, devices and data from unauthorised access, criminal use and digital attack. The UK’s National Cyber Security Centre describes cybersecurity as how individuals and organisations reduce the risk of cyberattacks, while the US Cybersecurity and Infrastructure Security Agency frames it as ensuring the confidentiality, integrity and availability of information.

Data protection and cybersecurity help to protect personal data and strengthen defences of digital ecosystems. Data protection and cybersecurity could be considered as a necessary duo for the protection of individuals and organisations. While this duo has the potential to protect digital ecosystems, there are factors to consider in achieving such goals.

The distinction between data protection and cybersecurity is key to designing the most appropriate approaches to apply to solve data and cybersecurity challenges. In the EU, data protection is a regulatory regime, providing rules and principles that regulate how data is created, collected, stored, used, and transmitted. Cybersecurity is how the risks of cyberattacks are reduced by individuals and organisations. America’s Cyber Defence Agency describes it as “the art of protecting networks, devices, and data from unauthorized access or criminal use and the practice of ensuring confidentiality, integrity, and availability of information.”

The Legal and Regulatory Landscape

As cybersecurity attracts more attention, critical issues regarding data privacy and data protection are raised. In the same vein, as data privacy and data protection gains more attention, concerns relating to cybersecurity are brought to the stage. The relationship between security and data protection is shown in modern data protection principles, which require security protection.

As an example, the OECD (Organisation for Economic Co-operation and Development) Security Safeguards Principle provides that,

“Personal data should be protected by reasonable security safeguards against such risks as loss or unauthorised access, destruction, use, modification or disclosure of data.”

Cybersecurity laws can help to improve data protection. As more organisations use greater amounts of consumer data, it becomes more important for robust cybersecurity and data protection programs to be implemented, which take into account not only laws and regulations, but also the changing technologies that affect operations. Improvements in awareness and understanding of technology, data protection requirements, and cybersecurity risks could help a lot to reduce risks for digital ecosystems.

Legal Frameworks

The legal landscape governing cybersecurity and data protection is fragmented but rapidly developing across jurisdictions.

Under Article 32 of the GDPR, organisations are required to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. This includes encryption, the ability to ensure ongoing confidentiality and integrity of systems, and a process for regularly testing and evaluating the effectiveness of security measures. A data breach resulting from inadequate cybersecurity is therefore not just a technical failure. It is a legal one, potentially triggering fines of up to €20 million or 4% of global annual turnover.

The EU’s Network and Information Security Directive 2, which became enforceable in October 2024, significantly expands the cybersecurity obligations of organisations operating critical infrastructure and essential services across the EU. It introduces stricter incident reporting requirements, supply chain security obligations and personal liability for senior management in the event of serious cybersecurity failures. For global businesses with EU operations, NIS2 represents one of the most significant new compliance burdens of recent years.

The UK government’s Cyber Essentials framework sets out baseline cybersecurity controls that organisations should implement to protect against the most common cyber threats. While not legally mandatory for all organisations, it is required for businesses seeking certain government contracts and is increasingly referenced as a standard of reasonable cybersecurity practice.

In the United States, the National Institute of Standards and Technology Cybersecurity Framework provides voluntary guidance for managing cybersecurity risk, widely adopted across industries. California’s Consumer Privacy Act meanwhile mirrors some GDPR principles, granting California residents rights over their personal data and imposing obligations on businesses that handle it. The US federal landscape remains fragmented without a single comprehensive national data protection law. This presents a gap that regulators and legislators continue to debate.

Evolving Regulatory Landscape

For global businesses, the convergence of data protection and cybersecurity regulation creates both complexity and opportunity. The relationship between data protection and cybersecurity will only deepen as digital infrastructure becomes more complex and cyber threats more sophisticated. Regulators across the world are moving toward frameworks that integrate understanding of the two fields.

Disclaimer: This publication is for educational and informational purposes only and does not constitute formal legal advice or create an attorney-client relationship

What Is IoT?

IoT is known as a network of appliances, physical devices, vehicles, and other physical objects that exchange data. The International Telecommunication Union (ITU) defines IoT as:

“a global infrastructure for the information society, enabling advanced services by interconnecting (physical and virtual) things based on existing and evolving interoperable information and communication technologies”

Examples of IoT devices include RFID (radio frequency identification device) technology, smartwatches, and transportation systems. As an emerging global internet-based information architecture, the Internet of Things (IoT) presents many opportunities for society.

Opportunities and Applications

From improvements in efficiency to increased flows of information to educate people, IoT, could transform how easily tasks can be carried out, automating processes through connected devices in different sectors such as:

• Healthcare

• Logistics

• Manufacturing

• Education

Technological advancements have contributed to automation in different sectors, even before IoT. However, IoT offers networks of connectivity and efficiency in unique ways. IoT contributes to industries by reducing costs, enabling data-driven decision making, improving efficiency, and enhancing customer experience.

Cybersecurity Risks

Despite the benefits that could be achieved with IoT, there are challenges which must be addressed to protect the interests of people and organisations that rely on the technology.

Check Point Research flagged a significant increase in cyberattacks against IoT devices. With hundreds of vulnerabilities in the threat landscape for IoT, it is more important than ever to strengthen cyberdefence.

The Legal and Regulatory Landscape

The rapid expansion of IoT has exposed significant gaps in existing legal frameworks. Most data protection and cybersecurity laws were designed before the proliferation of connected devices, and regulators are now playing catch-up with technology that generates, transmits and stores data at an unprecedented scale.

Data Protection and GDPR

Where IoT devices collect personal data from individuals in the EU, the GDPR applies, regardless of where the device manufacturer or data processor is based. Organisations deploying IoT systems must identify the legal basis for data collection, ensure data minimisation principles are followed, and implement appropriate technical and organisational measures to protect that data. The challenge is significant. IoT devices often collect data continuously and autonomously, making meaningful consent and transparency difficult to achieve in practice.

Product Security and Cybersecurity Law

The UK’s Product Security and Telecommunications Infrastructure Act 2022 (PSTI) represents one of the first laws specifically targeting the security of connected devices. It requires manufacturers of smart devices to meet baseline cybersecurity standards including unique default passwords, transparency about security update periods, and vulnerability reporting mechanisms. The EU is moving in a similar direction with the Cyber Resilience Act, which introduces mandatory cybersecurity requirements for products with digital elements sold in the EU market.

What Comes Next

The significant amounts of data generated by IoT devices presents a world of opportunities for business growth and social development but also increases the weight of responsibility for people and organisations to protect their data. Data governance policies will be needed to ensure that the storage, access, sharing, and deletion of data is done in ways that are appropriate.

Improvements in the implementation of encryption and access controls will be needed to protect data. Existing laws and regulations, as well as new laws and regulations tailored to the unique IoT needs in different industries across different industries may be required to ensure that the appropriate guardrails are put in place to promote sustainable use of IoT.

As GDPR applies to the whole data supply chain, organisations that aim to remain GDPR compliant will need to ensure, among other key considerations, that they understand the data being collected and processed, have good understanding of consent and keep records of data processing.

Disclaimer: This publication is for educational and informational purposes only and does not constitute formal legal advice or create an attorney-client relationship.

What Is the EU AI Act?

As the world’s first comprehensive legal framework for artificial intelligence (AI), the EU AI Act sets the stage for organisations and individuals who create, deploy, or integrate AI systems for products, services or outputs that are used in EU markets.

EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024. It is the world’s first comprehensive AI regulation. In 2026, organisations are required to meet its major obligations. Like the GDPR (General Data Protection Regulation), the Act has extraterritorial reach, affecting businesses, not only in the EU but outside of the EU.

The Act classifies AI based on its risk. It introduces transparency obligations, requiring developers and deployers to make end-users aware of their interactions with AI. Regulated high-risk AI systems are subjected to greater transparency obligations than limited risk AI systems. Unacceptable risks such as social scoring systems and manipulative AI are prohibited while minimal risk is unregulated.

Who Must Comply?

Most of the obligations in the EU AI Act are to be met by providers (developers) of high-risk AI systems and those that aim to have their high-risk AI systems in the EU. This obligation must be met, irrespective of whether they are based in the EU or a third country.

General-Purpose AI (GPAI) refers to the AI systems that are trained on broad datasets to perform a variety of tasks, such as text generation, coding, and image creation. In order to comply with the Act, providers of general purpose AI models must provide instructions for use, technical documentation, act in pursuance of the Copyright Directive, and publish summaries that show the content used for training their models.

Key Deadlines

Deadlines for compliance were adjusted in May 2026. The applicability of high-risk AI obligations were extended by a year, compared to the initial dates. Compliance is expected by 2 December 2027 for stand-alone Annex III systems (including recruitment, credit scoring, law enforcement, education, and border control tools). For AI that is embedded in regulated products under Annex I (medical devices, vehicles, machinery), compliance is expected by 2 August 2028.

Transparency obligations under Article 50 of the AI Act will be enforceable from 2 August 2026. Users will need to be informed when they are interacting with an AI system. Notification will also need to be provided when content is AI-generated or manipulated. A grace period has been given until 2 December 2026 for machine-readable marking/watermarking for generative AI outputs.

High-Risk Classification of AI Systems

On 19 May 2026, draft guidelines on the classification of AI systems were published by the European Commission. The aim of the guidelines is to support providers and deployers of AI systems, and market surveillance authorities to determine whether AI systems should be classified as high-risk. This is in pursuance of Article 6 AI Act, which provides the classification rules for high-risk AI systems.

Article 6(1) of the EU AI Act provides that an AI system is a safety component of a product (or is a regulated product itself listed in Annex I) which requires a third-party safety check (conformity assessment) under EU laws, before it can be sold. Under Article 6 (2), if an AI system falls into one of the high-impact categories listed in Annex III of the Act, it is deemed high-risk. The categories include:

• Biometrics

• Critical Infrastructure

• Education & Vocational Training

• Employment & Worker Management

• Essential Public and Private Services

• Law Enforcement

• Migration, Asylum, & Border Control

• Administration of Justice & Democracy

Under Article 6(1), if an AI system is a safety component of a product (or is itself a product) covered by EU harmonisation legislation listed in Annex I (such as machinery, medical devices, toys, vehicles) and that product requires third-party conformity assessment.

The guidelines require providers of GPAI systems to describe their AI systems in publicly available materials. The publicly available materials may include technical documentation, marketing materials, and instructions for use. The system’s intended purpose can be classified as high-risk if high-risk use cases are not consistently limited or excluded from it. This expands the scope of high-risk requirements.

Article 6 (3) provides that a system won’t be treated as high risk if providers of the system can demonstrate that it doesn’t present a significant risk. Such risks include risks of harm to health, safety, or fundamental rights. In order to be exempt from high-risk classification, the provider must conduct and document a self-assessment prior to putting the system into service or launching the AI system on the market. AI systems can be exempt if they meet the conditions in Article 6 (3) but systems that profile natural persons will always be classified as high risk.

Penalties for Noncompliance

Noncompliance can lead to significant costs of up to 3 percent of global annual revenue or 15 million euros. This supports the AI Office in collecting information it requires to assess whether providers are meeting their obligations under Article 53 (for GPAI models) or Article 55 (for systemic risk). Failure to satisfy information requests or deny access for evaluations can result in fines of 1 percent of turnover or 7.5 million euros. Under Article 101, GPAI model providers that fail to respond to requests for documentation and information could face fines. Prohibited AI violations can incur fines of up to 35 million euros or 7% of a company’s total worldwide annual turnover.

Providers that fail to respond, or that supply incomplete or misleading information, face fines under Article 101. This power is the foundation of the enforcement architecture. Without reliable information about what models can do and how they were trained, the AI Office cannot assess whether providers are meeting their obligations under Article 53 (for all GPAI models) or Article 55 (for models with systemic risk).

An Act that Goes Beyond Borders

The EU AI Act is not just a European concern. It sets the stage for how AI will be governed, deployed and challenged in the coming years. Treating compliance as a strategic opportunity rather than a regulatory burden could improve positioning as AI matures.

With the guidelines being open for consultation until 23 June 2026, there are further potential changes to lookout for in the regulatory environment.

Disclaimer: This publication is for educational and informational purposes only and does not constitute formal legal advice or create an attorney-client relationship.