Source: https://www.globallegalinsights.com/practice-areas/ai-machine-learning-and-big-data-laws-and-regulations/considerations-in-venture-capital-and-manda-transactions-in-the-ai-mobility-industry
Timestamp: 2019-10-18 19:26:35
Document Index: 175837413

Matched Legal Cases: ['sui generis', '§ 1', '§ 101', '§ 1839', '§ 1798', '§ 2']

AI, Machine Learning & Big Data Laws and Regulations | Considerations in Venture Capital and M&A Transactions in the AI Mobility Industry | GLI
Home Practice areas AI, Machine Learning & Big Data 2019 Considerations in Venture Capital and M&A Transactions in the AI Mobility Industry
AI, Machine Learning & Big Data 2019 | Considerations in Venture Capital and M&A Transactions in the AI Mobility Industry
Intellectual property considerations in transactions
Who’s to blame? Liability in the (coming) age of autonomous vehicles
Who are the potentially liable actors?
Control as the proxy for liability
Applying these considerations in real life: two accident case studies
The rise of autonomous machines in recent years has been enabled, in part, by the advances made with respect to “big data” aggregation and analytics. Without the ability for machine learning algorithms or natural language processors to access historical data and update their own functions as new data is collected, the capabilities and applications of Artificial Intelligence (“AI”) would be significantly hindered. The power to collect and analyse large volumes of varied data has led to the commercial implementation of drones and robots, along with the advent of the Internet of Things (“IoT”) ecosystem of interconnected devices. Practical applications of AI in the various industries have also emerged, and research expenditures in the area are steadily increasing.1 For example, the transportation industry (including mobility-as-a-service) (collectively, the “mobility industry”) has been going through and will continue to go through a significant transition to a new business model, driven in large part by the rise of AI and AI-related and AI-enabling technologies. Over the last five years or so, traditional automobile manufacturers have begun to shift their long-time business model by investing in various transportation services,2 such as ride-sharing models, monthly subscription models,3 micro-mobility (last mile urban transportation) models,4 and the development of autonomous vehicle technologies,5 through M&A6 activities and investments7 in venture capital (“VC”)-backed companies. VC investments in the mobility industry have grown dramatically since 2009, with 2017 and 2018 being standout years, while M&A activity has been sporadic since 2011, with 2017 being a standout year.8 For companies9 to continue to conduct M&A and investment activity, and to develop and innovate in this space, they will need to be increasingly cognisant of the array of legal implications which arise from a system that is designed, controlled and sometimes even built by autonomous machines. It will be important to understand and anticipate the transactional and regulatory risks surrounding AI implementations, in particular the crucial role intellectual property (“IP”) protections play in the commercialisation of these technologies.
With the significant financial investments most companies make in developing or obtaining access to AI technologies, the ability to secure IP protection for those developments and to maintain freedom to operate (“FTO”) is paramount to ensuring a return on those investments. For example, a software algorithm capable of analysing anonymised data sets could be protected under a patent, a copyright or pursuant to trade secret laws. How a company decides to protect its IP related to AI algorithms may be informed by the capabilities and expertise the company has, those it lacks, and the availability of any development or commercialisation partners across its supply chain. Thus, understanding how to think of the various components of an AI algorithm from a contractual rights perspective is an increasingly necessary skill for businesses looking to compete in industries leveraging AI technologies.
Before a company can use an AI algorithm in a commercial context, it must first gain access to large quantities of “raw” data, which will be analysed by the algorithm (“AI Inputs”). Generally, this data comes from one or more of the following three sources: (1) publicly available information (from government or academic data sets, or which may be “scraped” off the web, typically using specialised software); (2) voluntarily from “data subjects” themselves (by obtaining legally valid consent); or (3) pursuant to a business-to-business (“B2B”) contractual relationship (such as a data processing, licence or data transfer agreement). How a company obtains this raw data is important, as the scope of IP rights a company receives to such raw data impacts the manner in which a company is able to use the data, and ultimately whether a company may be able to derive revenue from the AI algorithm it owns or controls. The output of the AI algorithm, the “AI Outputs” or “processed data”, will be valuable commercially (e.g., as part of a software-as-a-service (“SaaS”) business model) and have value for the internal development and improvement of the algorithm itself (i.e., enabling the AI to “learn” and improve performance or efficiency). Since the processed data often constitutes a derivative work of the raw data, the scope of rights each party receives to the raw and processed data is a point of focus during negotiations. Matters of IP ownership and FTO may be further complicated by joint development efforts between the parties, which risk enabling a collaborator to become a competitor. When entering into any transaction regarding the collection and transfer of big data to be analysed using AI technologies, the following questions should be considered:
• What rights does each party need to the pre-existing IP of the other party (if any) in order to commercialise and achieve its ultimate business goals?
• Does either party need to impose any field of use, purpose, territorial or other limitations on licences to any pre-existing IP contributed to the transaction?
• How will the parties enforce their rights in IP, e.g., which party(s) can enforce which rights in which jurisdictions?
• Are limitations needed on the licensee’s right to sublicense or transfer the IP rights granted under the agreement?
• Will the counterparty require access to information or technology which constitutes a trade secret?
• Does the contract draw clear lines between disparate pieces of IP contributed (and not contributed) by each party?
• What rights will each party have in any jointly developed IP? E.g., will the parties be able to compete against each other using any jointly developed IP, and to what extent will each party be able to further develop any jointly developed IP?
• What is the exit strategy? What happens if one party decides to stop aiding IP development or wants to end the relationship?
• What happens if the AI technology itself generates IP without human intervention that is valuable or otherwise protectable under IP laws? Which party should bear the risk of an AI application’s infringement of third-party IP?
The final question above, regarding the ability for an AI program itself to create new IP, highlights issues over whether existing IP legislative and regulatory frameworks are suited to address the myriad implications of AI-driven business models. For example, under current U.S. laws, non-humans cannot be the author of a copyrightable work nor the inventor of a patentable invention; this foundational tenet of U.S. IP law is inherently at odds with the burgeoning applications for AI technologies. As governmental authorities work to either adapt existing IP frameworks or build entirely new frameworks regarding the impact AI has on the creation of IP, it is increasingly imperative that companies approach IP contracts for AI applications with fresh perspectives and innovative drafting if they want to mitigate the risks to IP posed by the escalating adoption and implementation of AI technologies.
Companies should carry out a comprehensive due diligence investigation of the target’s intellectual property, as is always the case, but the following are some IP considerations unique to AI. Companies should identify and understand the fundamental AI asset that is driving the value and premise of the transaction. An AI system may be comprised of algorithms/software, the AI inputs and AI outputs, or a combination of both. Knowing which of these components is the value driver will allow companies to focus their IP due diligence accordingly. Companies should understand the target’s product functionality, the extent to which it “learns”, boundaries or precautions that are in place on the AI’s ability to act independently, and processes for updating the AI systems. Companies should also take a careful look at the target’s IP protection practices, which should include identifying the inventors and contributors to the AI.
Algorithms/software. Algorithms and processes should be subject to trade secret protection, whether or not the algorithms and process may be patented, as long as they are kept confidential and derive independent economic value from not being generally known. Thus, it is important to examine the target’s treatment of algorithms in contracts and its trade secret protection practices. With respect to algorithms/software, companies should seek to understand (i) the extent to which the algorithm/software is derived from open-source or third-party software, and (ii) whether the target has taken reasonable efforts under the circumstances to protect the secrecy of this information, as required by U.S. law, to achieve trade secret protection.10
AI inputs. With respect to AI inputs, companies should seek to understand (i) the source of the data, (ii) how the data is used, (iii) whether the target has the appropriate rights to use the data to train its algorithm/software, and (iv) if the data is personal data, whether the target has obtained appropriate consents to use that data.11 Note that some AI inputs may use publicly available data sets. While the underlying publicly available data may not be legally protectable, the employer’s manipulation, interpretation, and uses of that data may be protectable. For example, certain jurisdictions, particularly in Europe,12 provide sui generis database rights which are similar to, but distinct from, copyright protections. Companies should be mindful of this if a target has used web scraping software or other automated means to aggregate publicly available information from the Internet to use as training data for a machine learning algorithm, as the target’s automated processes may have unwittingly run afoul of these database laws in the course of their data collection.
AI outputs. With respect to AI outputs, companies should seek to understand whether the target owns the AI outputs. This can often be determined through a review of the target’s commercial contracts, but in some cases may require the analysis and application of intellectual property ownership laws.13 Like algorithms, AI outputs may be subject to trade secret protection, so companies should examine the target’s trade secret protection practices and the public accessibility of the AI outputs.
Review of IP agreements. Companies should review the target’s inbound supply and development agreements, outbound licence agreements, actual IP protection practices and the terms of the target’s form of proprietary information and inventions assignment agreement (“PIIAA”). In addition to customary provisions, companies should review the target’s licence agreements for use specifications and limitations and, within the permitted use, the definition of product failure and the consequences of failure to achieve any specified objectives.
While the processes, algorithms, and data related to AI technologies are likely encompassed within the general definition of confidential information, it may be wise for the target’s (and the buyer’s) form of PIIAA and its third-party contractor agreements, as well as its various other licence agreements, to include a more tailored definition of AI information. At a minimum, the definition of confidential information should include:
• Processes, data analytics processes, algorithms, analyses, data, data compilations, metadata, device configurations, embedded data, and technologies.
Although the following terms are probably covered by the broader definition, some employers may want to add more specific terms, such as:
• System elements, neural networks, training sets, parameters, rules, ensemble methods, generated code and decision trees.
Similarly, to the extent the PIIAA includes a non-compete, it is important to ensure the scope of the non-compete encompasses the foregoing definitions.
Companies should make sure that the definitive agreements relating to the transaction have the appropriate representations and warranties, as further described below under “Liability matters”.
In addition to thinking through the contractual rights in IP created or incorporated into AI technologies, companies also need to be cognisant of the shifting regulatory landscape regarding data privacy and exposure that may result from inadequate security measures. The issue of how parties allocate the risks of data breaches, including enforcement actions by regulatory bodies and resulting consumer class actions, is becoming increasingly salient in the field of big data and analytics. As the demand for data increases, and as the type of data collected may be viewed as increasingly invasive (such as biometric information or consumer profiling), demands have similarly increased for the implementation and enforcement of regulations regarding the collection, storage, processing and transfer of data, including data which constitutes the personally identifiable information (“PII”) of data subjects.
Indeed, increasingly burdensome and restrictive regulations concerning data privacy and cybersecurity are being enacted across the world to protect data subjects from unauthorised access or misappropriation of PII and other sensitive information.14 Consumers’ increasing understanding of the risks of data breaches, their control (or lack thereof) over aggregated data and PII, and the potential for misuse of such personal information has also driven further growth and sophistication of consumer class actions based on data security breaches. As a result, companies looking to leverage big data and AI technologies must proactively implement and maintain robust cybersecurity frameworks to mitigate the risk of a potential data breach, and to mitigate damages if a data breach is suffered. A careful review of a company’s cybersecurity compliance posture, and whether the company’s approach is appropriate in light of the risks of a data security breach, is a bare necessity in light of these legislative developments. Contractual mechanisms are useful to allocate these risks and liabilities between parties in privity with one another, but they will not relieve a party of its independent legal obligations. Contractual protections may also be inadequate to cover the costs of defending and resolving class action suits. A more holistic approach to cybersecurity is necessary to ensure the success of an AI-driven, data-reliant business venture. Implementation of “privacy by design” concepts can help avoid data breaches resulting from design decisions, and other precautions, such as procuring cybersecurity insurance, can help mitigate the damage of a successful data breach.
By adopting a privacy by design framework, a company can adopt a systems engineering approach which inherently enhances the privacy protections of their products or services. The seven foundational principles of privacy by design15 are specifically tailored to maximise privacy by ensuring that PII and other sensitive data are protected by default within a given IT system, product or business practice. Policies and protocols adopted in accordance with the privacy by design principles become embedded across the entire lifecycle of a product or service. Privacy by design is often followed in accordance with various international or industry-specific standards that have been promulgated, such as ISO/PC 317 (promulgated by the International Organization for Standardization)16 or the Payment Card Industry Data Security Standard (promulgated by the PCI Security Standards Council),17 but can also be applied independently and adapted to a company’s processes. For example, a company can use various “differential privacy” software tools and statistical techniques to analyse usage or other patterns of a large number of users without compromising individual privacy.18 The privacy by design methodology may be used to decrease the risk that a data breach occurs; however, it does not necessarily help a company deal with the aftermath when a data breach does occur.
As discussed below in “Liability considerations – contractual risk allocation”, contractual mechanisms can be useful for allocating risks and liability amongst business partners leveraging big data and AI technologies, but tensions can arise between contracting parties in the aftermath of a data breach. It can be difficult and expensive to conduct a root cause analysis pinpointing the source of a data breach in order to determine the degree of fault each party should bear for the breach. Additionally, the typical indemnities, limitations of liability and contractual remedies for breach of representations and warranties or confidentiality obligations usually included in a contract may be insufficient to adequately protect a company from liability stemming from a data breach, or one party to a contract may simply not have the resources to fully indemnify the other party in the event of a data breach. As a result, many companies obtain cybersecurity insurance to cover the gaps in risk exposure which cannot be addressed through normal contractual provisions. Cybersecurity insurance can provide additional comfort that a company is reasonably protected from the damages of a data breach; however, it is important to understand the full scope of coverages, and any carve-outs or exceptions to the insurer’s coverage obligations. Companies which purchase cybersecurity insurance should make certain to notify their insurer of any attempted data breach in accordance with their policy requirements (whether there was unauthorised access to data or not), and keep their insurer apprised of any plans to expand the business into new jurisdictions. A company that proactively communicates with its insurer can be more confident that its insurance policy is sufficient in scope to cover any potential data breach and the resulting exposure, which may result from historical security events or future business plans.
Ultimately, however, as AI-driven services become increasingly pervasive and invasive, the legal system’s demands for transparency and accountability will also increase.
As of the date of this chapter, no unified regulatory framework has been put into place regarding autonomous vehicles, which potentially leaves investors a little bit in the dark about how to analyse regulatory compliance issues in connection with an investment. Autonomous vehicles have been operating under a patchwork of state19 rules with limited federal oversight, but over the last few years there have been several proposals and developments that have the industry heading in the direction of a national regulatory framework. Attempts at developing a federal regulatory approach to autonomous vehicles include:
• The Volpe Center FMVSS Review.20 The United States Department of Transportation (“USDOT”) commissioned the Volpe National Transportation Systems Center to identify instances where the existing Federal Motor Vehicle Safety Standards (“FMVSS”) may pose challenges to the introduction of automated vehicles. It identifies standards requiring further review – both to ensure that existing regulations do not unduly stifle innovation, and to help ensure that automated vehicles perform their functions safely.
• USDOT Data for Automated Vehicle Integration (DAVI).21 The USDOT launched DAVI as a multimodal initiative to identify, prioritise, monitor, and – where necessary – address data exchange needs for automated vehicles integration across the modes of transportation.
• USDOT Request for Comment on V2X Communications.22 The USDOT requested comment on how recent developments in core aspects of the communication technologies that could be associated with connected vehicles, including vehicle-to-vehicle, vehicle-to-infrastructure, and vehicle-to-pedestrian communications, collectively referred to as “V2X” communications, could impact both V2X in general and the USDOT’s role in encouraging the integration of V2X.
• National Highway Traffic Safety Administration (NHTSA) Federal Automated Vehicles Policy.23 The NHTSA published a preliminary statement of policy concerning automated vehicles in order to harness the benefits of automated vehicle technology by providing a framework for doing it safely, which was updated in September 2017.24
• SELF DRIVE Act.25 The “Safely Ensuring Lives Future Deployment and Research In Vehicle Evolution” or “SELF DRIVE” Act was passed by the House in September 2017, and includes a broad preemption of the states from enacting legislation that would conflict with the Act’s provisions or the rules and regulations promulgated under the authority of the Act by the NHTSA. The Act empowers the NHTSA with oversight of manufacturers of self-driving cars by enacting future rules and regulations that will set the standards for safety, and govern areas of privacy and cybersecurity relating to such vehicles.
• AV START Act.26 On October 4, 2017, the Senate Committee on Commerce, Science, and Transportation unanimously approved its own version of the SELF DRIVE Act, the American Vision for Safer Transportation through Advancement of Revolutionary Technologies (AV START) Act. The bill remains pending in the Senate.
CFIUS and export controls. Investors may also need to take into account recent legislation relating to CFIUS and export controls laws when considering investments in AI. The Foreign Investment Risk Review Modernization Act of 2018 (“FIRRMA”),27 passed in August 2018, overhauled the US law governing CFIUS national security reviews. In October 2018 regulations, CFIUS implemented new rules that extend CFIUS jurisdiction to certain non-controlling foreign investments in certain US “critical technologies”, and by subjecting those investments, whether controlling or not, to a mandatory short-form CFIUS declaration.28 While the new CFIUS rules do not explicitly call out AI as one of the enumerated “critical technologies”, AI may be directly or indirectly implicated or relevant to some of those enumerated “critical technologies”. In addition, the Export Control Reform Act of 2018, which was enacted as part of the same legislative package as FIRRMA, requires the President to start an interagency process to identify “emerging and foundational technologies” that “are essential to the national security of the United States” and not already included in existing definitions of critical technologies. On November 19, 2018, the US Commerce Department published a notice seeking comment on the criteria for determining which “emerging technologies are essential to national security” under the Export Control Reform Act of 2018, and explicitly called out several categories of AI and machine learning for consideration in that notice.29 Accordingly, companies should determine whether CFIUS and/or export controls regulations are implicated in connection with its transaction.
There are a myriad of possible liabilities that arise from AI in the mobility industry, as discussed in detail in the “Who’s to blame?” section below, but these risks generally arise from IP infringement, privacy laws and product liability. An investor and the target may allocate the risk of these possible liabilities primarily through contractual allocation of risk and through insurance.
Representations and warranties. The definitive agreement should have appropriate representations and warranties (including sufficiently broad IP definitions) regarding: IP ownership; validity; non-infringement; sufficiency of rights; IP assignments by employees and contractors; IP protection; ownership of or appropriate licences to data sets and databases; encumbrances on IP (including third-party licences); absence of defects; absence of viruses; routines or components allowing access or damaging data; failures or losses; compliance with privacy and data security laws and disclosure of government inquiries, claims experience, breaches or non-compliance with such laws; protection of personal data; and disclosure of security breaches and unauthorised access. Knowledge qualifications in these representations lessen investor protection if the product violates a representation (particularly the non-infringement representation) without the knowledge of the “knowledge group”.
Covenants. Consider whether pre-closing covenants regarding remedial actions would be appropriate. Companies should also consider whether AI could affect affirmative and negative covenants with its actions. Should an action taken by AI be a breach of a covenant, whether or not the action is known to the target?
Indemnification. Companies should consider customary indemnification provisions, including survivability of representations, warranties and covenants; extended survival periods to the extent warranted; and indemnification baskets and caps. Companies should factor into account due diligence analysis, specific industry considerations, the target’s AI products and how they are used, in determining whether it should require specified line item indemnification provisions, such as contracts not adequately mitigating risk to the target, any strict liability issues and damages that may be caused by the actions of the AI.
Insurance risk allocation
Companies may also mitigate and allocate risk relating to AI through a combination of the target’s and companies’ own first and third-party insurance policies. As part of the due diligence process, companies should consider the adequacy of the target’s insurance for actions that occur prior to the closing, and should assess the sufficiency of its own insurance coverage for AI matters post-closing. Companies and the target should have in place third-party insurance coverage for errors and omissions, security privacy, regulatory matters, and media liability coverage and first-party coverage for breach response, network interruption, data restoration and cyber extortion. In some cases, it may be appropriate to also consider product liability insurance and employer practices liability insurance. Finally, in lieu of contractual indemnification, in an M&A transaction it may be appropriate to obtain a representation and warranties insurance policy for companies. The terms of these products shift regularly because the product is so new; thus, companies should review the coverage carefully to ensure companies will be adequately protected.
In 2016 and 2017, more than 37,000 roadway deaths were recorded in the United States.30 The NHTSA reports that “[d]angerous actions” by drivers “such as speeding, distracted driving, and driving under the influence” are the primary causes of these fatalities.31 Indeed, the NHTSA attributes 94% of serious crashes to human error.32 One of the goals of autonomous vehicles is, of course, a world in which sophisticated technology reduces the number and severity of accidents, because the AI is better equipped than humans to avoid accidents.33 Unless AI technology becomes so advanced that car accidents can be avoided entirely, however, the inevitable question of liability remains: when a self-driving vehicle is involved in an accident, whose fault is it?
The short answer is that it depends. As discussed in the “Regulatory matters” section above, the statutory framework surrounding the use of AI in the mobility industry is still developing.34 Given the rate at which technology is advancing, and companies’ ongoing testing of self-driving vehicles (like Uber) and sale of vehicles equipped with automated driving systems, or “ADS” (like Tesla), the development of a statutory framework addressing liability will inevitably trail the occurrence of accidents in which liability is disputed. Accordingly, participants in the autonomous vehicle industry should be mindful of how courts may evaluate the allocation of liability in the absence of laws that dictate who bears the burden of legal responsibility for accidents. Indeed, these same considerations may well shape the development of the statutes and regulations that are ultimately put in place.
The discussion below considers the potentially liable actors, outlines legal standards and factual considerations that may be taken into account when allocating fault among those actors, and evaluates how liability might be allocated in two case studies drawn from real-life events.
When an autonomous vehicle is involved in an accident, traditional legal theories might allocate liability to the owner and driver of the AI-equipped vehicle,35 the manufacturer of the vehicle that includes AI, or the manufacturer of component parts of the vehicle (e.g., the manufacturer of the radars used to gather information about the driving environment that is used by the AI to make driving decisions). Where the ADS controlled the driving decisions at the time of the accident, and those decisions arguably caused the accident, a fourth actor could also face liability – the AI itself.
Which actor should bear responsibility for an accident depends upon not only the specific facts giving rise to the accident, but also the legal theory that is applied. Various theories for how allocation of liability should be determined have been explored to fill the void that presently exists, due to a dearth of legislation and little case precedent that is directly applicable. For example:
• Vehicle owner/driver. Some authors argue that the owner of an autonomous vehicle should be liable for any accident caused by the vehicle, even if the ADS is controlling the car, because the owner has assumed responsibility for any harm caused by the vehicle by purchasing it.36 This is most consistent with the traditional allocation of liability to vehicle owners and the accompanying insurance regime.37 However, allocating harm based purely on ownership could have unintended consequences, creating substantial disincentives to owning autonomous vehicles.38
• Vehicle manufacturer/AI programmer: As vehicles become more autonomous, and ADS ultimately become equipped to make value-based decisions derived from programming inputs designed by the AI manufacturer, others have theorised that because the manufacturer of the vehicle is the ultimate decision-maker, the manufacturer should be held liable for accidents that occur when the ADS controls the vehicle (even if the ADS functioned properly and made the “correct” decision in an unavoidable accident).39 This theory of liability can be likened to a product liability theory,40 except without the traditional considerations of manufacturer defect, failure to warn, and design defect.41
• AI: Although the AI ultimately makes the decision as to how to respond to external stimuli, even in those instances where the AI’s decision is the direct cause of harm to persons injured in an accident (whether the occupants of the vehicle or third parties), holding the AI itself liable is challenging for the obvious reason that it is not an independent actor.42 Some authors have argued that the AI is effectively the agent of the manufacturer because, even though it is the “actor”, the AI carries out functions as prescribed by the manufacturer.43 Under such a theory, ultimate liability for the AI’s actions would flow to the manufacturer as principal.44
• Components manufacturer: To the extent an accident is caused by a failure of one of the component systems that works together with the AI, such as radars employed by the AI to inform the AI about its surroundings, liability may be extended to the components manufacturer under a traditional theory of product liability.
The evaluation of where to place liability is of course developing in parallel with ADS technology itself. Cars are not yet fully autonomous, and thus drivers of AI-equipped vehicles retain a degree of control over the vehicle and thus some responsibility for any accident.45 As cars become more autonomous and drivers exercise less control, the responsibility imposed on owners/drivers may diminish over time, but the imprint of the framework derived from the intervening years – i.e., the actor exercising control bears greater liability – may well influence the analysis of the circumstances under which liability may be imposed on drivers of even fully autonomous vehicles.
This differentiation is apparent in the six-tiered framework presently used by the NHTSA to classify autonomous vehicles, which was adopted from SAE International in September 2016.46 The framework takes into account whether the “human operator or the automated system is primarily responsible for monitoring the driving environment”:47
• Primary responsibility for controlling driving tasks falls to driver:48
a. Level Zero: no automation. Driver performs all driving tasks, even if assisted by enhanced warning systems or similar technology.
b. Level One: driver assistance. Driver controls majority of driving tasks, with some assistance by automated systems, such as stability control.
c. Level Two: partial automation. Vehicle is equipped with some autonomous system controls (e.g., steering and acceleration), but driver retains control of all other driving tasks.
• Primary responsibility for controlling driving tasks falls to AI (“Highly Autonomous Vehicles”):
a. Level Three: conditional automation. Vehicle controls majority of driving tasks, monitors environment, and gathers data from that environment to respond to changes therein; driver must be ready to take control of the vehicle at all times (e.g., to intervene in emergency situations).
b. Level Four: high automation. Same autonomous controls as Level Three; driver has discretion as to whether to intervene in an emergency situation (can but is not required).
c. Level Five: full automation. Vehicle controls all aspects of driving functions at all times and under all conditions.
The first fatal accident involving a self-driving car occurred in March 2018 in Tempe, Arizona, when an autonomous vehicle being tested by Uber struck a pedestrian with a bicycle crossing the street in front of the vehicle. According to the NTSB’s preliminary report, Uber had equipped the vehicle (manufactured by Volvo) with “developmental” self-driving technology that functioned in two modes, computer control and manual control.49 When the vehicle was in computer control mode, automated emergency braking technology (installed by Volvo) was disabled to prevent erratic vehicle behaviour.50 The vehicle was not programmed to alert the operator when the vehicle perceived that emergency braking was necessary, even though the system relied upon the operator to exert manual control to stop the car in such circumstances.51
The vehicle detected the pedestrian six seconds before impact and, at just over one second before impact, determined that emergency braking was necessary. The driver did not apply the brakes until just after impact with the pedestrian. The NTSB concluded that the ADS was operating normally, as it was designed to do, just after the crash. A later-issued report by the Tempe Police Department concluded that the driver of the test vehicle was watching a television show on her phone at the time of the crash.52 The report also concluded that the driver could have avoided the accident had the driver been watching the road.
In this example, the driver could be held liable under a negligence theory for both failing to watch the road and failing to exert control as required in order to safely drive the autonomous vehicle. An argument could also be made that Uber should be held liable under a design defect theory of product liability. “A design defect occurs when a product is performing as intended but presents an undue risk of harm.”53 Here, one might argue that because Uber restricted the functionality of the automated emergency braking technology but did not create a corresponding alert system to advise drivers when the vehicle perceives that emergency braking is necessary, Uber’s design presented an undue risk.54
Tesla vehicles equipped with the manufacturer’s “Autopilot” feature have been involved in several crashes, including an October 2018 incident involving a 2017 Tesla Model S. In that accident, the Tesla crashed into a stationary vehicle that was stalled in the left lane of a highway at a speed of approximately 80 mph when the Autopilot – a paid upgrade feature – was engaged but did not detect the vehicle.55 The owner and driver sued Tesla, asserting claims of strict liability for design defect, negligence for breach of the duty of care, breach of implied warranty, misrepresentation/misleading advertisement, and violation of Florida’s Deceptive and Unfair Trade Practices, on the theory that the Autopilot system failed and is not as capable and safe as marketed by Tesla.56
Tesla has moved to dismiss the case, arguing that the driving manual for the Model S makes clear that the Autopilot function is not capable of detecting stationary objects when the vehicle is traveling at highway speeds (at more than 50 mph).57 Indeed, this limitation has also been reported by news media and has been described as a well-known limitation of the existing technology for self-braking systems for Tesla and other manufacturers that use the technology, because the system cannot yet distinguish between stationary objects in the road – such as a fire truck – and stationary objects above the road, like an overpass.58 Tesla vehicles also provide alerts when drivers’ hands have been off the wheel for more than a few seconds to remind them that their attention is required.59
The stationary-object limitation of the Tesla is arguably different from the vehicle modification imposed by Uber, which was designed to eliminate a technologically available protection. With respect to the Tesla accident, the restriction arguably derives from an existing technological limitation, meaning that the design cannot – at this stage in development, with existing technology – be corrected or improved upon. To the extent that Tesla can establish that the warnings provided with the Model S were sufficient to alert the driver, or that the limits of the technology were widely known, it is arguable that the driver assumed the risk by driving the Tesla. One could also argue that, assuming the driver was aware of the limitations of the technology, which his lawyer seems to have acknowledged in speaking to the press, the driver’s failure to pay attention to the road would support an argument that, just like in the Uber accident, the driver should ultimately bear the liability.
Due to the shifting regulatory landscape and the iterative nature of design and innovation, companies seeking to expand or improve their business operations by leveraging AI technologies, whether through development, acquisition or strategic investments, should be as proactive as possible in addressing the numerous business and legal complexities presented by autonomous machines and big data analytics. The subjects discussed in this chapter constitute one part of what should be a holistic approach to conducting due diligence, mitigating the risks and maximising the benefits of acquiring, investing in, or developing and commercialising any AI-based technologies.
1. P&S Intelligence Prvt. Ltd., AI in Transportation Market Overview, available at https://www.psmarketresearch.com/market-analysis/ai-in-transportation-market (last accessed Feb. 16, 2019).
2. Mike Ramsey, Ford Says It Will Focus More on Transportation-Services Sector, Wall St. J. (Jan. 5, 2016, 12:49 PM), available at: https://www.wsj.com/articles/ford-says-it-will-focus-more-on-transportation-services-sector-1452016172.
3. Michael J. Coren, There’s a New Subscription Business Model Arriving For Cars, QZ.com (Nov. 30, 2017), available at: https://qz.com/1142296/a-new-subscription-business-model-is-arriving-for-cars-thanks-to-volvo-ford-porsche-and-silicon-valley-startups/.
4. Joshua Brustein, Ford Acquires Electric Scooter Startup Spin, Bloomberg (Nov. 7, 2018, 5:10 PM), available at: https://www.bloomberg.com/news/articles/2018-11-07/ford-is-said-to-buy-scooter-startup-spin.
5. Jack Stewart, Mapped: The Top 263 Companies Racing Toward Autonomous Cars, Wired.com (May 10, 2017, 7:30 AM), available at: https://www.wired.com/2017/05/ mapped-top-263-companies-racing-toward-autonomous-cars/.
6. See Brustein.
7. Mike Isaac, General Motors, Gazing at Future, Invests $500 Million in Lyft, N.Y. Times (Jan. 4, 2016), available at: https://www.nytimes.com/2016/01/05/technology /gm-invests-in-lyft.html.
8. Pitchbook, 2019 Emerging technology Outlook (2018), available at: https://files.pitchbook.com/website/files/pdf/PitchBook_2019_Emerging_Technology_Outlook.pdf.
9. For the purposes of this chapter, “company” or “companies” generally include and refer to companies attempting to commercialise these technologies, companies and private equity investors engaging in M&A activity for AI technologies, and companies and investors acquiring equity in companies developing AI technologies.
10. See Uniform Trade Secret Act § 1(4) (Unif. Law Comm’n 1985) and Economic Espionage Act of 1996 § 101(a), 18 U.S.C. § 1839(3).
11. For example, Facebook recently had its Apple enterprise licence revoked for collecting personal data on iPhones in contravention of Apple’s policies. See Tom Warren and Jacob Kastrenakes, Apple Blocks Facebook From Running Its Internal iOS Apps, The Verge (Jan. 30, 2019, 10:27 AM), available at: https://www.theverge.com/2019/1/30/18203551/apple-facebook-blocked-internal-ios-apps.
12. See Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases, available at: https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex:31996L0009.
13. U.S. IP law has historically refused to credit works to non-human agents. See Naruto V. Slater, No. 15-cv-4324, 2016 WL 362231, at *3-4 (N.D. Cal., Jan. 28, 2016) (challenging the standing of an animal to raise a copyright infringement claim); see Russ Pearlman, Recognizing Artificial Intelligence (AI) as Authors and Investors Under U.S. Intellectual Property Law, 24 Rich. J. L. & Tech. no. 2, 2018.
14. See General Data Protection Regulation (EU) 2016/679 (EU/EEA); California Consumer Privacy Act, Cal. Civ. Code § 1798.198(a), as amended by SB-1121 (2018) (State of California, United States); Lei Geral de Proteção de Dados Pessoais, Law No. 13.709/2018 (Brazil).
15. Ann Cavoukian, Privacy by Design: The 7 Foundational Principles, Information and Privacy Commissioner of Ontario (2011), available at: https://www.ipc.on.ca/wp-content/uploads/Resources/7foundationalprinciples.pdf (last accessed Feb. 16, 2019) (setting forth the following principles of systems design: (1) proactive not reactive, preventative not remedial; (2) privacy as the default setting; (3) privacy embedded into design; (4) full functionality – positive-sum, not zero-sum; (5) end-to-end security, full lifecycle protection; (6) visibility and transparency; and (7) respect for user privacy by making it user-centric).
16. Available at: https://www.iso.org/committee/6935430.html (last accessed Feb. 16, 2019).
17. Available at: https://www.pcisecuritystandards.org/document_library?category=pcidss& document=pci_dss (last accessed Feb. 16, 2019).
18. See Differential Privacy, Harvard University Privacy Tools Project, 2014, available at: https://privacytools.seas.harvard.edu/differential-privacy (last accessed Feb. 16, 2019).
19. See Autonomous Vehicles: Self-Driving Vehicles Enacted Legislation, Nat’l Conf. of States (Nov. 7, 2018), available at: http://www.ncsl.org/research/transportation/ autonomous-vehicles-self-drivingvehicles-enacted-legislation.aspx.
20. Kim, Anita, David Perlman, Dan Bogard, and Ryan Harrington, Review of Federal Motor Vehicle Safety Standards (FMVSS) for Automated Vehicles Preliminary Report, Cambridge, Mass.: U.S. Department of Transportation, John A. Volpe National Transportation Systems Center, March 2016.
21. Data for Automated Vehicle Integration (DAVI), U.S. Dep’t of Transportation, available at: https://www.transportation.gov/av/data (last accessed Feb. 20, 2019).
22. Notice of Request for Comments: V2X Communications, 83 Fed. Reg. 66,338 (Dec. 26, 2018).
23. National Highway Traffic Safety Administration, Federal Automated Vehicles Policy: Accelerating the Next Revolution In Roadway Safety (Sept. 2016).
24. National Highway Traffic Safety Administration, Automated Driving Systems 2.0: A Vision for Safety (Sept. 2017).
25. H.R. 3388, 115th Cong. (2017), available at: https://www.congress.gov/bill/115th-congress/house-bill/3388/text.
26. S. 1885, 115th Cong. (2017); see also Press Release, U.S. Senate Committee on Commerce, Science and Transportation, Senate Commerce Approves AV START Act, Other Bills and Nominations (Oct. 24, 2017), available at: https://www.commerce.senate.gov/public/index.cfm/pressreleases?ID=BA5E2D29-2BF3-4FC7-A79D-58B9E186412C.
27. The Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA), H.R. 4311, 115th Cong. (2017), was integrated into the John S. McCain National Defense Authorization Act of 2019, Pub. L. No. 115-232, which was signed by the President on August 13, 2018. The John S. McCain National Defense Authorization Act of 2019 also integrated the Export Control Reform Act of 2018, H.R. 5040, 115th Cong. (2018).
28. Provisions Pertaining to Certain Investments in the United States By Foreign Persons, 83 Fed. Reg. 51,316 (Oct. 11, 2018) (to be codified at 31 C.F.R. pt. 800).
29. Review of Controls for Certain Emerging Technologies, 83 Fed. Reg. 58,201 (Nov. 19, 2018) (to be codified at 15 C.F.R pt. 744).
30. Nat’l Highway Safety Admin., U.S. Dep’t of Transp., USDOT Releases Fatal Traffic Crash Data (Oct. 6, 2017), available at: https://www.nhtsa.gov/press-releases/usdot-releases-2016-fatal-traffic-crash-data; Nat’l Highway Safety Admin., U.S. Dep’t of Transp., USDOT Announces 2017 Roadway Fatalities Down (Oct. 3, 2018), available at: https://www.nhtsa.gov/press-releases/us-dot-announces-2017-roadway-fatalities-down.
31. Nat’l Highway Safety Admin., U.S. Dep’t of Transp., USDOT Announces 2017 Roadway Fatalities Down (Oct. 3, 2018), available at: https://www.nhtsa.gov/press-releases/us-dot-announces-2017-roadway-fatalities-down.
32. Nat’l Highway Safety Admin., U.S. Dep’t of Transp., Automated Vehicles for Safety, available at: https://www.nhtsa.gov/technology-innovation/automated-vehicles-safety (last accessed Feb. 28, 2019).
33. See Nat’l Highway Safety Admin., U.S. Dep’t of Transp., Automated Vehicles for Safety, available at: https://www.nhtsa.gov/technology-innovation/automated-vehicles-safety (last accessed Feb. 28, 2019); accord Knowledge@Wharton, “Autonomous Car Crashes: Who – or What – Is To Blame?” (Apr. 6, 2018), available at: http://knowledge.wharton.upenn.edu/article/automated-car-accidents/.
34. The NTHSA has suggested that the allocation of tort liability rests with States, which creates the potential for a patchwork of inconsistent regulations. See U.S. Dep’t of Transp., Automated Driving Systems 2.0: A Vision for Safety (Sept. 2017) at 24, available at: https://www.nhtsa.gov/sites/nhtsa.dot.gov/files/documents/13069a-ads2.0_090617_v9a_tag.pdf.
35. This discussion assumes for the sake of simplicity that the owner and the driver are the same person. To the extent the driver of the autonomous vehicle that is involved in an accident is not the owner, that may introduce additional complexity to evaluating liability. For example, traditional questions of agency may arise where the driver of the vehicle is an employee of the company that owns the vehicle.
36. See Moolayil, Amar K., The Modern Trolley Problem: Ethical and Economically-Sound [sic] Liability Schemes for Autonomous Vehicles, 9 Case W. Reserve J. L. Tech & Internet 1, at 15–16 (2018).
37. See, e.g., Crane, Daniel A., Kyle D. Logue, and Bryce C. Pilz, A Survey of Legal Issues Arising from the Deployment of Autonomous and Connected Vehicles, 23 Mich. Telecomm. & Tech. L. Rev. 191, at 256–257 (Spring 2017).
38. See, e.g., Cowger, Alfred R., Jr., Liability Considerations When Autonomous Vehicles Choose the Accident Victims, 19 J. High Tech. L. 1, at 53–54 (2018).
39. See Okun, Jill J. and Ryan Rawlings, OEMS: Mitigating Potential Liability Posed by Autonomous Vehicle Crash Optimization Systems, 60 No. 11 DRI for the Def. 63 (Nov. 2018); accord Cowger, Alfred R., Jr., Liability Considerations When Autonomous Vehicles Choose the Accident Victims, 19 J. High Tech. L. 1, at 54–55 (2018).
40. See, e.g., Bogost, Ian, “Can You Sue a Robot?”, The Atlantic, Mar. 20, 2018, available at: https://www.theatlantic.com/technology/archive/2018/03/can-you-sue-a-robocar/556007/.
41. See RESTATEMENT (THIRD) OF TORTS: CATEGORIES OF PRODUCT DEFECT § 2(a) (AM. LAW INST. 2012) (outlining the different categories of product defects).
42. See Moolayil, Amar K., The Modern Trolley Problem: Ethical and Economically-Sound [sic] Liability Schemes for Autonomous Vehicles, 9 Case W. Reserve J. L. Tech & Internet 1, at 18-19 (2018).
43. See Moolayil, Amar K., The Modern Trolley Problem: Ethical and Economically-Sound [sic] Liability Schemes for Autonomous Vehicles, 9 Case W. Reserve J. L. Tech & Internet 1, at 18-20 (2018).
44. See Moolayil, Amar K., The Modern Trolley Problem: Ethical and Economically-Sound [sic] Liability Schemes for Autonomous Vehicles, 9 Case W. Reserve J. L. Tech & Internet 1, at 18-20 (2018).
45. One study performed in August 2018 concluded that even in accidents involving self-driving vehicles in California, where many companies test autonomous vehicle technology, humans continue to be the leading cause of accidents. See Kokalitcheva, Kia, “People cause most California autonomous vehicle accidents”, Axios (Aug. 29, 2018) available at: https://www.axios.com/california-people-cause-most-autonomous-vehicle-accidents-dc962265-c9bb-4b00-ae97-50427f6bc936.html.
46. SAE International, Automated Driving (2014), https://www.smmt.co.uk/wp-content/uploads/sites/2/automated_driving.pdf.
47. Nat’l Highway Safety Admin., U.S. Dep’t of Transp., The Federal Automated Vehicle Policy (Sept. 2016) at 9.
48. U.S. Dep’t of Transp., Automated Driving Systems 2.0: A Vision for Safety (Sept. 2017) at 4, available at: https://www.nhtsa.gov/sites/nhtsa.dot.gov/files/documents/13069a-ads2.0_090617_v9a_tag.pdf.
49. National Transportation Safety Board, “Preliminary Report Highway HWY18MH010”, at 2, available at: https://www.ntsb.gov/investigations/Accident Reports/Reports/HWY18MH010-prelim.pdf.
50. National Transportation Safety Board, “Preliminary Report Highway HWY18MH010”, at 2, available at: https://www.ntsb.gov/investigations/AccidentReports/Reports/HWY18MH010-prelim.pdf.
51. National Transportation Safety Board, “Preliminary Report Highway HWY18MH010”, at 2, available at: https://www.ntsb.gov/investigations/AccidentReports/Reports/HWY18MH010-prelim.pdf.
52. Korosec, Kristen, TechCrunch.com “Uber safety driver of fatal self-driving crash was watching Hulu, not the road”, available at: https://techcrunch.com/2018/06/22/uber-safety-driver-of-fatal-self-driving-crash-was-watching-hulu-not-the-road/.
53. Okun, Jill J. and Ryan Rawlings, OEMS: Mitigating Potential Liability Posed by Autonomous Vehicle Crash Optimization Systems, 60 No. 11 DRI for the Def. 63 (Nov. 2018).
54. Depending upon how well-informed the driver was concerning the necessity of braking, one could also imagine liability arising under a failure-to-warn product liability theory. Uber could also be potentially liable under traditional theories of principal/agent liability because the driver of the vehicle was employed by Uber.
55. Davies, Alex. Wired, “A Florida Man Is Suing Tesla for a Scary Autopilot Crash”, Oct. 30, 2018, available at: https://www.wired.com/story/tesla-autopilot-crash-lawsuit-florida-shawn-hudson/.
56. See Hudson v. Tesla Inc., et al., Case No. 2018-CA-011812-O (Cir. Ct. Fla. Oct. 30, 2018).
57. The manual reads in relevant part: “Traffic-Aware Cruise Control cannot detect all objects and may not brake/decelerate for stationary vehicles, especially in situations when you are driving over 50 mph (80 km/h) and a vehicle you are following moves out of your driving path and a stationary vehicle or object is in front of you instead.” Davies, Alex. Wired, “A Florida Man Is Suing Tesla for a Scary Autopilot Crash”, Oct. 30, 2018, available at: https://www.wired.com/story/tesla-autopilot-crash-lawsuit-florida-shawn-hudson/.
58. Lee, Timothy B., “Another Tesla with Autopilot Crashed into a Stationary Object – the Driver Is Suing”, Oct. 30, 2018, available at: https://arstechnica.com/cars/2018/10/man-sues-tesla-says-autopilot-steered-him-into-a-stalled-car-at-80-mph/.
59. See Davies, Alex. Wired, “A Florida Man Is Suing Tesla for a Scary Autopilot Crash”, Oct. 30, 2018, available at: https://www.wired.com/story/tesla-autopilot-crash-lawsuit-florida-shawn-hudson/.
Buy Chapter PDF - £ 125.00 Order the Considerations in Venture Capital and M&A Transactions in the AI Mobility Industry chapter of AI, Machine Learning & Big Data 2019 in PDF format or read free online FREE ONLINE In stock