AIGP Quest · cheat sheet · BoK v2.1

II.B Other laws meet AI

II.B Other laws meet AI (4 to 6 exam questions)

Understand how other types of existing laws apply to AI.

II.B.1 · Copyright and AI: data in, content out

Training copies works, so it needs a license or an exception.
US: fair use, decided case by case on four factors; early rulings turned on how data was acquired and on market harm.
EU: TDM exceptions allow commercial mining unless the rightsholder opted out in machine-readable form.
Purely AI-generated works lack US copyright and AI can't be a patent inventor, so use contracts.
Contracts, licenses, trade secrets and personality rights also limit training data.

Fair use:: A US defense that permits some unlicensed use of copyrighted works, decided by weighing purpose, nature, amount and market effect.
Text and data mining (TDM):: Automated analysis of text and data to find patterns; the EU allows it under two copyright exceptions.
Reservation of rights (TDM opt-out):: A rightsholder's machine-readable statement that its online works may not be mined under the EU's general TDM exception.
Human authorship:: The US requirement that a work be created by a human to qualify for copyright protection.
Data provenance:: A documented record of where training data came from and the rights attached to it.

Exam tips: Publicly available is not public domain. Any option built on 'it's online, so it's free' is wrong. · Copyright fixes live at the input stage (license, fair use analysis, honor opt-outs) and the output stage (similarity filters). Disclaimers and after-the-fact deletion don't cure copying. · Keep the lanes separate: Thaler v. Vidal is about patent inventorship; Thaler v. Perlmutter is about copyright authorship. · When default ownership of AI output is uncertain, the IAPP answer is to allocate rights in the contract.

II.B.2 · Bias and the law I: how AI discriminates

Disparate treatment is intentional or explicit differential treatment; disparate impact is a neutral practice with unequal effects.
AI discriminates mostly through proxies, biased history and unrepresentative data.
Title VII, the ADEA and the ADA govern AI hiring, and employers stay liable for vendor tools.
Federal agencies retreated from disparate impact in 2025–26, but the statutes and private lawsuits remain.

Disparate treatment:: Intentionally treating people differently because of a protected characteristic, including deliberately using a proxy for it.
Disparate impact:: A facially neutral practice that disproportionately disadvantages a protected group, regardless of intent.
Proxy variable:: A seemingly neutral input, such as ZIP code, that correlates closely with a protected characteristic.
Four-fifths rule:: A rule of thumb from the 1978 Uniform Guidelines: a selection rate below 80% of the highest group's rate signals possible adverse impact.
Business necessity:: The US employer defense that a practice causing disparate impact is job-related and necessary, defeated if a less discriminatory alternative was refused.
Reasonable accommodation:: An ADA-required adjustment, such as an alternative assessment, that lets a qualified person with a disability compete fairly.

Exam tips: 'We don't collect race, sex or age' is never a defense to disparate impact. Look for the option that deals with proxies and outcomes. · The employer is liable for a vendor's tool. Contract clauses shift costs, not legal duties. · The four-fifths rule is a red flag, not a verdict: the best answer investigates and validates. · Withdrawn agency guidance isn't repealed law. Title VII, the ADEA and the ADA still apply to AI hiring.

II.B.3 · Bias and the law II: credit, housing, insurance

ECOA and Regulation B require specific principal reasons for credit denials; complex models are no excuse.
FCRA adds notice and dispute rights whenever a consumer report drives an adverse decision.
The Fair Housing Act reaches tenant screening, lending and ad delivery, including disparate impact.
Insurers face state unfair discrimination laws, Colorado's algorithm law and the NAIC AI bulletin.

ECOA and Regulation B:: The US credit anti-discrimination law and its implementing rule, which also require specific reasons when credit is denied.
Adverse action notice:: A required notice telling a consumer about a negative decision and, depending on the law, the reasons or the consumer report behind it.
Fair Housing Act:: The 1968 US law banning discrimination in housing sales, rentals, lending and advertising, including through disparate impact.
Fair Credit Reporting Act (FCRA):: The US law governing consumer reports, with notice and dispute rights when a report drives an adverse decision.
Unfair discrimination (insurance):: The state-law standard barring insurers from distinctions not justified by risk, or based on protected traits.

Exam tips: 'Internal standards' or 'insufficient score' fails Regulation B. The best answer names the specific principal reasons. · FCRA vs ECOA: FCRA follows the consumer report; ECOA follows the credit decision. One scenario can trigger both. · Housing questions point to the Fair Housing Act, which covers screening, lending, advertising and disparate impact. · Don't over-read the 2025–26 rollbacks: agency rules changed, but statutes, courts and state laws still police AI bias.

II.B.4 · Consumer protection: unfair and deceptive AI

Section 5 bans deceptive (misleading and material) and unfair (substantial, unavoidable, unjustified harm) practices.
AI capability claims need evidence before you make them; AI washing is deception.
The FTC can order deletion of models trained on ill-gotten data (Everalbum, Kurbo, Rite Aid).
Federal posture softened in 2025, but deception enforcement continues, alongside state attorneys general and the EU's Unfair Commercial Practices Directive.

FTC Act Section 5:: The US federal prohibition on unfair or deceptive acts or practices in commerce, applied to AI without any AI-specific statute.
Deceptive practice:: A material representation or omission likely to mislead a consumer acting reasonably, judged by its net impression.
Unfair practice:: A practice causing substantial injury that consumers can't reasonably avoid and that isn't outweighed by benefits.
Algorithmic disgorgement:: An FTC remedy requiring deletion of models and algorithms built from improperly obtained data.
AI washing:: Overstating or misrepresenting the use or capabilities of AI in a product.
Substantiation:: The reasonable basis, such as test evidence, a company must have before making objective product claims.

Exam tips: No AI-specific statute is needed: Section 5 reaches AI claims and practices directly. · 'We never sell the data' answers the wrong question. Deception is about misleading statements or omissions; unfairness is about unavoidable harm. · Disclaimers don't cure a misleading net impression. · Algorithmic disgorgement means deleting the model built on improperly obtained data, which is why data provenance matters.

II.B.5 · Product liability: when AI causes harm

Product liability can apply without fault: defect plus damage plus causation.
Know the three defects: manufacturing (one unit), design (every unit) and warning (an undisclosed risk).
US courts are still deciding whether AI software is a product; some now say yes for design claims.
The EU's new Directive (transposition by 9 December 2026) covers software and AI, reaches post-sale updates and eases the burden of proof.
Product safety regulators (CPSC, FDA, NHTSA; the EU's General Product Safety Regulation) work alongside liability, and federal approval can sometimes preempt state claims.

Strict liability:: Liability for harm caused by a defective product without proof that the maker was negligent.
Manufacturing defect:: A flaw where a particular unit departs from its intended design.
Design defect:: A flaw in the design itself that makes every unit unreasonably dangerous, typically where a reasonable safer alternative existed.
Failure to warn:: A defect arising from inadequate instructions or warnings about foreseeable risks.
Product Liability Directive (EU) 2024/2853:: The EU's revised no-fault product liability law, which treats software and AI as products and eases the burden of proof.
Liability reform:: Changing the legal rules that decide who is accountable for harm, as opposed to cost-shifting tools like insurance or recalls.

Exam tips: One faulty unit is a manufacturing defect; a flaw in every unit is a design defect; an undisclosed risk is a failure to warn. · Strict liability doesn't need negligence. An option saying the victim must prove carelessness under strict liability or the EU Directive is wrong. · Under the new EU Directive, software and AI are products, and updates within the maker's control keep it on the hook. · Liability reform changes who is accountable. Recalls, insurance and waivers are operational mechanisms, not reform.

Independent study aid, not affiliated with the IAPP. Written with AI from primary sources; laws change, so check the sources. Last updated 7 Nov 2026.