%20-%20Teams%20Logo.png?width=576&height=182&name=Logo%20in%20standard%20arrangement%202%20(RGB)%20-%20Teams%20Logo.png "Epic Fusion")
«Waiting it out and not addressing the issues is not a strategy.» Caroline Danner makes this clear when it comes to artificial intelligence and the legal issues associated with it.
Caroline Danner is an attorney and the owner of ONLAW, a boutique law firm specializing in IT law, data protection, and AI compliance. She provides practical, solution-oriented advice to companies on legal issues at the intersection of technology, data protection, and artificial intelligence. We spoke with her about what companies need to know and clarify when using AI today.
Caroline, you are a tech lawyer specializing in IT, AI, and data protection. How did you get into this field, and what fascinates you about the intersection of law and technology?
That is a good question, because it was not part of my original plan. When I was looking for my first job as a lawyer over 20 years ago, I wanted to work at a large company. Fortunately, that worked out at an IT company, no less. Back then, I had no IT experience and, to be honest, did not even fully understand what my responsibilities were according to the job posting. However, my colleagues at the time – both from the legal department and from the business side – gave me a very thorough introduction. As a result, I quickly became fascinated by IT topics, and it soon became clear: I never wanted to leave this industry.
What questions do companies most frequently ask you these days when it comes to AI?
There are two main topics: On the one hand, what needs to be addressed in contracts or terms of service when AI is used to provide services. On the other hand, companies ask what they need to consider when using AI internally, particularly how they can effectively regulate employees’ use of AI.
Where is AI already being used in companies, even though there is actually still quite a bit of legal uncertainty?
In my consulting work, I see two main categories: On the one hand, there are companies in the technology sector that are already using AI in a targeted manner. They usually have a deep understanding and know quite well in many areas what is permissible and what is sensitive. Here, I primarily provide support with concrete, specific questions. On the other hand, the topic affects virtually all other companies. In these companies, generative AI in particular is being used in daily work. Such companies want to know what they need to be aware of. Incidentally, this is supported by a recent study showing that around 80% of the Swiss population uses AI. At the same time, current figures show that more than 50% of AI use in companies is so-called shadow AI – that is, unauthorized and unmonitored use of AI tools. In my experience, these figures are quite realistic. Many companies are likely not yet aware of the risks involved.
However, it is important to note that existing laws can be applied to AI in many areas, and much can already be clearly regulated today.
You work with companies in Switzerland and those with ties to the EU. What has changed the most in your consulting work over the past one to two years, now that AI has become a part of every company?
Quite clearly: I hardly ever receive client briefs, especially drafts that were not generated by AI or at least created with AI support.
Many people hear «data protection» and immediately think, «that is holding us back.» What is your take on this? Is it a hindrance to the use of AI?
Not necessarily, from my perspective. Of course, data protection can become a barrier if a company wants to use just any AI tool in a business context. In my data protection training sessions and workshops, however, I often experience the opposite: Once the principles are understood, there is usually more understanding than resistance. At the very latest when participants put themselves in the shoes of a data subject, it becomes clear why data protection is important.
Employees upload customer data, internal documents, or confidential information into AI tools. Which of these is actually problematic, and when does «just giving it a quick try» turn into a legal risk?
Caution is always advised if the AI tool has not been approved by the employer. In this case, no personal data should be entered. In other words, no information that allows direct or indirect identification of a person. Likewise, no trade secrets should be entered. If you still wish to do so, various legal and organizational aspects must first be carefully examined.
Then there is the EU AI Act to consider. Many Swiss companies think, «We are in Switzerland. This does not affect us.» Is that really true? No, it is not. Swiss companies must also comply with the EU AI Act if, for example, they place an AI system on the market in the EU or if the outputs generated by the AI system are used in the EU.
I have summarized here when a Swiss company must comply with the EU AI Act.
In your opinion, what is currently the biggest mistake companies are making when it comes to AI, data protection, and the law?
Waiting to see what happens and not addressing these issues. Because only those who address these issues can realistically assess the specific risks to their own company.
AI is here. But are we actually allowed to use it?
ONLAW: Law that keeps Pace with Technology.
