AI, Emerging Technologies and Digital Transformation

Introduction

Artificial intelligence (AI), connected devices, blockchain networks, smart contracts and cloud services are changing how governments, businesses and individuals create, exchange and use information. These technologies can improve efficiency, access to services and economic opportunity. They also create legal problems that do not fit neatly within traditional categories of contract, privacy, intellectual property, consumer protection, evidence and criminal law.

The central cyber-law question is not whether a technology is innovative. It is whether the people and organisations that design, deploy, control or benefit from it can be held accountable when it causes harm. A useful legal analysis therefore examines the technology’s function, the actors involved, the information processed, the foreseeable risks, the applicable jurisdiction and the available remedies.

This chapter introduces the principal legal and governance issues surrounding automated decision-making, generative AI, deepfakes, the Internet of Things (IoT), blockchain, smart contracts and cloud transformation. It does not treat any single statute as universally applicable. Laws differ by jurisdiction and change rapidly; students should consult current legislation, regulatory guidance and case law in the relevant country.

Learning Objectives

By the end of this chapter, a student should be able to:

1. Explain how AI and automated decision-making create accountability, bias, transparency and safety issues.
2. Distinguish generative AI outputs, deepfakes, synthetic media and ordinary automated processing.
3. Identify legal risks in IoT, blockchain, smart contracts and cloud environments.
4. Apply a risk-based framework to responsibility, privacy, security, intellectual property and consumer protection.
5. Evaluate a practical technology deployment and recommend proportionate safeguards.
6. Explain why digital transformation requires continuing regulatory review rather than a one-time compliance exercise.

1. A Framework for Analysing Emerging-Technology Law

A technology-neutral analysis begins with six questions:

A useful distinction is between technical capability and legal authority. A system may be able to identify a person, infer a medical condition or generate a contract, but that capability does not itself authorise the organisation to do so. Legality depends on purpose, consent or another lawful basis, necessity, proportionality, contractual arrangements, sector regulation and the rights of affected people.

The main actors are often distributed. A foundation-model provider may train a model; an application developer may integrate it; an employer or bank may deploy it; a cloud provider may host it; and an individual may rely on its output. Contracts can allocate responsibilities between these parties, but contracts cannot always remove statutory duties owed to data subjects, consumers, employees or the public.

2. Artificial Intelligence and Automated Decision-Making

AI systems use computational methods to produce outputs such as classifications, predictions, recommendations, generated content or decisions. Machine-learning systems typically infer patterns from data rather than follow only explicitly programmed rules. The legal significance of AI is therefore connected to its effects, not merely to whether it uses a particular algorithm.

Automated decision-making occurs when a decision is made wholly or substantially by automated means. Examples include credit scoring, fraud detection, recruitment filtering, insurance pricing, content moderation and allocation of public services. Some systems make a recommendation that a human reviews; others produce a result that is effectively final even if a human formally approves it.

2.1 Accountability

Accountability means that an identifiable person or organisation can explain, govern and answer for a system’s operation and consequences. It includes:

• assigning responsibility to a senior owner;
• documenting the purpose, data, model and limitations;
• assessing risks before deployment;
• monitoring performance after deployment;
• preserving records sufficient for investigation; and
• providing correction, appeal and redress mechanisms.

The claim that “the algorithm decided” is not a legal defence. An organisation normally remains responsible for selecting a system, defining its use, supervising it and acting on its outputs. A vendor may also be responsible for defects, misleading claims, inadequate security or contractual non-performance.

2.2 Bias and discrimination

Bias may enter through historical data, unrepresentative samples, inaccurate labels, proxy variables, measurement choices or the context in which a model is used. A model can produce different outcomes for protected groups even where protected characteristics are excluded, because variables such as postcode, language or employment history may act as proxies.

Legal analysis should distinguish:

• disparate treatment: intentionally treating people differently because of a protected characteristic;
• disparate impact: a seemingly neutral practice disproportionately disadvantaging a protected group; and
• measurement bias: using an outcome or label that does not accurately represent the legally relevant concept.

No single fairness metric solves every problem. For example, equal selection rates, equal error rates and equal predictive accuracy can be mathematically incompatible when groups have different base rates. Organisations should therefore select fairness criteria in light of the decision’s purpose, legal requirements and affected interests, and document the justification.

2.3 Transparency and explainability

Transparency may mean different things: notice that AI is being used, information about the purpose and data, documentation for regulators, technical interpretability, or an explanation addressed to an affected person. A complex model need not always be replaced by a simple one, but an organisation should be able to provide a meaningful account of the factors that materially influenced a result, the system’s confidence or uncertainty where relevant, and how a person can challenge it.

A technically accurate explanation may still be legally inadequate if it is incomprehensible, arrives too late or does not allow correction. Meaningful human review requires authority, competence and time to depart from the automated output; a human who merely rubber-stamps the result is not an effective safeguard.

2.4 Safety, reliability and human oversight

AI safety includes robustness against errors, distribution shifts, adversarial inputs, data poisoning, prompt injection, model leakage and unsafe autonomous action. Testing should use realistic cases, edge cases and affected-group analysis. Monitoring should continue because performance may change when users, data or social conditions change.

A practical control hierarchy is:

1. prohibit uses whose risks cannot be acceptably controlled;
2. restrict high-risk uses to defined purposes and authorised users;
3. require human review for consequential decisions;
4. log inputs, outputs, versions and interventions;
5. test, audit and monitor performance;
6. provide incident response, correction and appeal.

3. Generative AI, Synthetic Media and Deepfakes

Generative AI produces text, images, audio, video, code or other content from prompts or other inputs. A deepfake is synthetic or manipulated media that realistically represents a person, event or statement and may mislead viewers. Not all synthetic media is deceptive: satire, dubbing, accessibility tools and disclosed artistic transformation may be legitimate.

3.1 Legal issues

Generative systems create several overlapping risks:

• privacy and personality rights: use of a person’s image, voice, biometric characteristics or private information;
• defamation: false content that harms reputation;
• fraud and impersonation: convincing messages or recordings used to obtain money or access;
• sexual exploitation: non-consensual intimate synthetic images;
• copyright and database rights: training data, prompts, outputs and substantially reproduced expression;
• confidentiality: employees entering trade secrets or personal data into a public service;
• consumer protection: misleading claims about accuracy, originality or human involvement; and
• evidence: difficulty proving whether a recording is authentic.

Copyright treatment of AI-generated output varies by jurisdiction. Human authorship, creative control, substantial human editing, contractual terms and the use of protected source material may all matter. An organisation should not assume that an output is free of infringement merely because a machine generated it.

3.2 Duties of professional users

Before using a generative system, an organisation should define permitted uses, prohibited inputs, review requirements, retention rules and disclosure standards. High-impact outputs should be checked by a competent person against authoritative sources. Users should preserve prompts, relevant source material, model version and review records where the output affects legal, financial, employment, health or safety interests.

Disclosure is context-dependent. A customer should not be misled into believing that a chatbot is a human adviser where that fact affects reliance. Public authorities and regulated professionals may have heightened duties of accuracy, reasoned decision-making and record keeping.

4. Internet of Things and Cyber-Physical Risk

The IoT is a network of physical objects containing sensors, software, communications capability and sometimes actuators. Examples include smart locks, vehicles, medical devices, industrial controllers, cameras and domestic assistants.

IoT creates a continuous data lifecycle: collection, transmission, storage, analysis, sharing and deletion. Devices may collect information about location, behaviour, health, household activity or workplace performance. A user who buys a device may not understand that manufacturers, analytics companies, platforms and service providers can also process the data.

Key legal issues include:

• privacy notices and lawful processing;
• security-by-design and secure default settings;
• product safety and liability for malfunction;
• updates, vulnerability disclosure and end-of-support policies;
• ownership and access to sensor data;
• employee monitoring and consent;
• cross-border transfers; and
• evidential reliability of device logs.

IoT responsibility is difficult because the supply chain may include a chip maker, firmware developer, device manufacturer, connectivity provider, cloud platform, installer and end user. Contracts should identify security obligations, update periods, incident notification, audit rights, data ownership and exit arrangements. Manufacturers should minimise unnecessary data, authenticate devices, protect credentials, encrypt sensitive communications and provide a secure method for updates.

5. Blockchain and Distributed Ledgers

A blockchain is a distributed ledger in which transactions are recorded through a consensus process and linked in a tamper-evident sequence. The legal value of a blockchain record does not arise automatically from the technology. A court may still need to determine who made the entry, whether the system was reliable, whether the transaction was authorised and what legal rule gives it effect.

Important characteristics include decentralisation, replication, pseudonymous addresses and relative immutability. These features can support auditability and reduce dependence on one intermediary, but they can also make correction, deletion and governance difficult.

5.1 Legal and governance questions

A blockchain project should address:

• who operates or controls the network;
• whether participants are identifiable;
• which jurisdiction and law govern transactions;
• how illegal, erroneous or personal data is handled;
• who can amend protocol rules;
• how private keys are protected and recovered; and
• how disputes are resolved.

“Immutable” does not mean impossible to change. A new transaction can record a correction, a network can fork, and a controlling group may alter protocol rules. However, an appended correction may not satisfy a legal right to erase or rectify information if the original remains available.

Personal data placed on a public ledger can create a conflict between transparency and data-protection principles. Hashing may reduce exposure but does not necessarily make data anonymous: a hash can remain personal data if it can be linked to an identifiable person or used as a persistent identifier.

6. Smart Contracts

A smart contract is code that automatically performs actions when specified conditions are met. It may implement a legal agreement, but code and legal contract are not identical. Code can transfer a digital token; it cannot by itself determine whether a party was mistaken, coerced, a minor, insolvent or entitled to equitable relief.

A sound legal design separates:

1. the natural-language agreement defining rights, duties, governing law and remedies;
2. the code implementing selected performance rules; and
3. external information supplied by an oracle, such as a price, delivery event or weather result.

Risks include coding errors, oracle manipulation, private-key theft, irreversible transfers, hidden administrative privileges and conflict between code and natural-language terms. A smart contract should therefore undergo independent testing, access-control review, audit and controlled deployment. Emergency pause and upgrade mechanisms may improve safety but create centralisation and trust risks that must be disclosed.

7. Cloud Transformation

Cloud computing provides on-demand access to shared computing resources, commonly through infrastructure, platform or software services. It can improve scalability and resilience, but it changes rather than eliminates legal responsibility.

The customer generally remains responsible for deciding what data may be processed, who may access it, retention and lawful purpose. The provider may control physical infrastructure, virtualisation, security tools and subcontractors. The allocation of duties is known as the shared-responsibility model and must be verified in the service agreement rather than assumed from marketing language.

Critical contractual issues include:

• data location and international transfers;
• security standards and independent assurance;
• breach notification deadlines;
• availability and recovery objectives;
• audit and regulator access;
• subcontracting;
• intellectual property and service-generated data;
• deletion and return at termination; and
• portability and exit assistance.

Cloud concentration creates systemic risk: an outage or compromise at a major provider can affect many customers simultaneously. Organisations should classify workloads, avoid unnecessary concentration, maintain tested backups and assess whether critical functions can operate during provider failure.

8. Regulatory Change and Risk-Based Governance

Regulation is increasingly risk-based. Rather than applying one rule to every algorithm, regulators may impose stronger obligations where systems affect safety, fundamental rights, employment, credit, health, education or access to essential services. Common regulatory techniques include prohibited-use rules, transparency duties, impact assessments, technical documentation, human oversight, incident reporting, security controls, conformity assessment and penalties.

Relevant legal fields include data protection, equality and human-rights law, consumer protection, product liability, intellectual property, employment law, financial regulation, telecommunications law, criminal law and evidence law. These regimes overlap. Compliance with a privacy notice does not authorise discrimination; a valid contract does not excuse insecure processing; and technical compliance does not necessarily satisfy fairness or due process.

An organisation should maintain a technology register recording each significant system, owner, purpose, data categories, affected groups, supplier, jurisdiction, risk level, controls and review date. Impact assessments should be revisited when the model, data, purpose, user population or legal environment changes.

9. Applied Case: Automated Recruitment Screening

The following is an illustrative case, not a report of a real organisation.

Background

Northbridge Services introduces an AI recruitment tool to rank applicants for customer-support roles. The vendor claims that the tool predicts “cultural fit” from CVs and recorded video interviews. Historical recruitment data is used for training. Applicants are told only that automated tools may assist recruitment.

Problem

After six months, disability advocates report that applicants using screen readers and applicants with strong regional accents are rarely shortlisted. The employer cannot explain individual scores. A manager approves the ranking without reviewing rejected applications. The vendor refuses to provide model details, citing trade secrecy.

Analysis

The system affects access to employment and therefore presents significant discrimination, privacy and procedural risks. Historical recruitment data may reproduce past exclusion. Video analysis may use features unrelated to job performance and may process biometric or sensitive information, depending on the jurisdiction. A general notice may not provide meaningful information about logic, consequences or challenge rights. The employer cannot transfer accountability to the vendor because it selected and relied on the system.

The vendor’s trade-secret concern is relevant to contract design but does not justify denying regulators or affected persons information required by law. Full disclosure of source code may not be necessary; documentation, feature categories, validation results and an effective appeal process may provide meaningful accountability.

Approach and solution

Northbridge should suspend automatic rejection, preserve relevant logs and conduct an independent impact assessment. It should test selection and error rates across relevant groups, validate whether the recorded features are job-related, offer accessible alternatives and provide human review by trained staff. The procurement contract should require audit access, incident notification, model-change notice, security controls and cooperation with complaints or regulatory inquiries.

The organisation should define a job-related selection criterion, minimise data collection, communicate the system’s role clearly and retain evidence of decisions. If reliable safeguards cannot be established, the video-analysis component should not be used.

Outcome

The revised process uses structured, job-related questions and human review. AI may assist with administrative sorting but cannot make final rejection decisions. Applicants receive notice, an explanation of the process and a route to request reconsideration. Periodic audits examine both overall performance and group-specific outcomes.

Learning points

1. A vendor’s technical sophistication does not remove the deployer’s legal duties.
2. Human involvement must be meaningful, not ceremonial.
3. Fairness requires examining data, features, outcomes and context.
4. Accessibility is part of lawful and ethical system design.
5. Procurement terms are a major cyber-law control.

10. Best-Practice Governance Checklist

A proportionate governance programme should:

• identify the system, purpose, owner and affected people;
• classify risk before procurement or deployment;
• establish lawful data sources and retention limits;
• conduct privacy, equality, security and safety assessments where appropriate;
• test accuracy, robustness, accessibility and group impacts;
• document model versions, limitations and material changes;
• provide human oversight, notice, appeal and correction;
• restrict confidential information entered into generative tools;
• secure devices, keys, interfaces, accounts and cloud configurations;
• contractually control suppliers and subcontractors;
• prepare incident-response and business-continuity plans; and
• review the system throughout its lifecycle and retire it safely.

Governance should be evidence-based. Policies are insufficient unless training, access controls, logs, audits and corrective action demonstrate that the organisation follows them.

Challenges and Limitations

Emerging-technology law faces persistent difficulties. Technology develops faster than legislation. Jurisdiction is complicated when data, infrastructure, developers and affected persons are in different countries. Technical systems may be opaque because of complexity, proprietary restrictions or rapidly changing models. Small organisations may lack specialist expertise, while large organisations may create accountability gaps across departments and suppliers.

There are also genuine trade-offs. Stronger privacy may reduce data availability; explainability may conflict with performance or security; immutability may conflict with correction; decentralisation may conflict with clear responsibility; and automated efficiency may conflict with procedural fairness. These are not reasons to abandon regulation. They require explicit choices, proportionality, documentation and accessible remedies.

Contemporary Direction

Current developments include general-purpose AI governance, provenance and watermarking initiatives for synthetic media, machine-readable transparency records, privacy-enhancing computation, confidential cloud environments, software-supply-chain regulation and stronger product-security expectations. None is a complete solution. Watermarks can be removed, provenance systems require adoption, privacy-enhancing tools may still permit inference, and certification cannot replace operational accountability.

The durable principle is lifecycle governance: anticipate risk, deploy cautiously, monitor effects, respond to incidents and revise controls as technology and law change.

Chapter Summary

AI and emerging technologies create legal issues because they distribute decisions, data and control across technical and organisational boundaries. Accountability remains with identifiable human and organisational actors even when a system is complex or supplied by a third party. Automated decision-making requires attention to bias, discrimination, transparency, meaningful human oversight, safety and remedies.

Generative AI and deepfakes raise privacy, personality, defamation, fraud, copyright, confidentiality and evidential concerns. IoT expands the scale and sensitivity of data collection and connects cyber risk to physical safety. Blockchain can improve auditability but creates challenges involving governance, personal data, correction and jurisdiction. Smart contracts automate performance but do not replace legal interpretation or remedies. Cloud transformation depends on a carefully documented shared-responsibility model.

A risk-based, lifecycle approach combines impact assessment, secure design, documentation, testing, contractual controls, monitoring, incident response and review. Digital transformation is legally sustainable only when innovation is matched by accountability, fairness, security and effective redress.

Key Terms

Accountability: The duty and capacity of an actor to explain, govern and answer for conduct and outcomes.

Algorithmic bias: Systematic error or disadvantage associated with data, design or deployment choices.

Automated decision-making: Making a decision wholly or substantially through automated processing.

Blockchain: A distributed ledger that records linked transactions through a consensus process.

Cloud computing: On-demand access to shared computing resources over a network.

Deepfake: Realistic synthetic or manipulated media that may misrepresent a person or event.

Explainability: The ability to give an understandable account of how a system produced an output.

Generative AI: AI capable of producing new text, images, audio, video, code or other content.

Human oversight: Competent human supervision with authority to question, alter or stop a system’s output.

Internet of Things: Connected physical objects that collect, exchange or act on data.

Model drift: Change in system performance as data, users or conditions change.

Oracle: A mechanism that supplies external information to a blockchain or smart contract.

Pseudonymisation: Replacing direct identifiers with substitutes while retaining a possibility of linkage.

Risk-based regulation: Regulation that imposes duties according to the likelihood and severity of harm.

Smart contract: Code that automatically performs specified actions when conditions are met.

Synthetic media: Media generated or materially altered using computational techniques.

Transparency: Providing relevant information about a system, its purpose, operation and effects.

Vulnerability disclosure: Reporting and managing weaknesses in software, devices or services.

Shared-responsibility model: Allocation of security and compliance duties between cloud provider and customer.

Review Questions

Short Answer Questions

1. What is meant by meaningful human oversight in an automated decision system?
2. Identify two legal risks associated with deepfakes.
3. Why does blockchain immutability create difficulties for data correction?
4. What is the shared-responsibility model in cloud computing?
5. Give three security controls relevant to IoT devices.

Long Answer Questions

1. Explain how accountability should be allocated among an AI developer, vendor and deploying organisation.
2. Discuss the relationship between algorithmic bias, discrimination and explainability.
3. Compare the legal characteristics of blockchain records and smart contracts.
4. Analyse the principal privacy and intellectual-property issues raised by generative AI.
5. Explain why digital transformation requires lifecycle governance rather than a one-time compliance assessment.

Analytical / Application Questions

1. A bank uses an AI model to reject loan applications and cannot explain individual results. Apply the framework in this chapter to recommend legal and governance controls.
2. A manufacturer sells a smart home camera that stops receiving security updates after one year. Analyse the responsibilities of the manufacturer, cloud provider and consumer.
3. A company stores employee health data on a public blockchain to improve auditability. Evaluate the benefits, risks and alternative design choices.

Multiple Choice Questions with Answers

Question 1

Which statement best describes organisational accountability for an AI system?

A. The algorithm alone is legally responsible for its outputs.

B. The deploying organisation can remain responsible even when a vendor supplied the system.

C. Accountability ends when a human clicks approval.

D. Only the cloud provider can be accountable.

Correct Answer: B. The deploying organisation can remain responsible even when a vendor supplied the system.

Question 2

What is a deepfake?

A. Any encrypted video file

B. A database backup containing personal data

C. Realistic synthetic or manipulated media that may misrepresent a person or event

D. A hardware device used for biometric authentication

Correct Answer: C. Realistic synthetic or manipulated media that may misrepresent a person or event

Question 3

Which is a major IoT legal concern?

A. Devices can never collect personal data.

B. IoT devices eliminate physical safety risks.

C. Security obligations may involve manufacturers, connectivity providers and cloud services.

D. IoT data is automatically anonymous.

Correct Answer: C. Security obligations may involve manufacturers, connectivity providers and cloud services.

Question 4

Why may hashing fail to eliminate data-protection concerns on a public blockchain?

A. Hashes are always reversible using a password.

B. A hash may remain linkable to an identifiable person or act as a persistent identifier.

C. Blockchains cannot store hashes.

D. Hashing necessarily reveals the plaintext.

Correct Answer: B. A hash may remain linkable to an identifiable person or act as a persistent identifier.

Question 5

Which statement correctly distinguishes code from a legal smart contract?

A. Code automatically resolves mistake, coercion and incapacity issues.

B. A smart contract can never implement contractual performance.

C. Code may automate performance, but legal rights and remedies may require natural-language terms and applicable law.

D. Smart contracts are outside all legal systems.

Correct Answer: C. Code may automate performance, but legal rights and remedies may require natural-language terms and applicable law.

Question 6

Under a cloud shared-responsibility model, which duty normally remains with the customer?

A. Manufacturing the provider’s servers

B. Determining appropriate data use and access permissions

C. Controlling every other customer’s virtual machine

D. Writing the provider’s operating system

Correct Answer: B. Determining appropriate data use and access permissions

Question 7

Which practice provides meaningful human oversight?

A. A reviewer automatically accepts every model output.

B. A reviewer has competence and authority to question or change the result.

C. A system hides the output from all reviewers.

D. A vendor promises that the model is accurate.

Correct Answer: B. A reviewer has competence and authority to question or change the result.

Question 8

Which factor can introduce bias into an AI system?

A. Only the programming language

B. Historical training data and proxy variables

C. The existence of an audit trail

D. A clear appeal process

Correct Answer: B. Historical training data and proxy variables

Question 9

What should an organisation do before deploying a high-impact generative AI application?

A. Permit confidential data to be entered without restriction.

B. Define permitted uses, review requirements, retention rules and disclosure standards.

C. Assume all outputs are copyright-free.

D. Remove all human review to maximise efficiency.

Correct Answer: B. Define permitted uses, review requirements, retention rules and disclosure standards.

Question 10

Why can cloud concentration create systemic risk?

A. A provider outage can affect many customers simultaneously.

B. Cloud systems cannot be backed up.

C. Cloud services operate only on local devices.

D. Cloud providers cannot use subcontractors.

Correct Answer: A. A provider outage can affect many customers simultaneously.