This is the second article in our two-part series on protecting reputation in the AI era. Read the first part.
Introduction
As outlined in Part 1, AI-driven reputational threats take many forms – from deepfakes and voice cloning to coordinated fake review campaigns and bot-driven harassment. Each can cause serious and rapid harm, and each raises distinct legal questions. There are not (yet) specific rights or remedies under English law targeted at AI-generated content. However, the existing legal framework is more versatile than is often assumed, and offers a range of tools – both established and emerging – to those who act decisively.
This section provides a guide to the key legal levers available, covering traditional causes of action, practical enforcement mechanisms, and the developing question of liability for harms caused by AI systems themselves:
Harassment
Where AI-powered bots are deployed to harass an individual or business – through coordinated pile-ons, doxxing or mass false claims – the Protection from Harassment Act 1997 may provide injunctive relief and damages. Courts have shown a willingness to extend harassment principles to coordinated online campaigns, and the fact that the campaign is AI-assisted does not diminish the legal exposure of those who deploy or direct the bots.
AI forensic tools can be used to assess the likelihood that material is authentic or AI-generated, strengthening the evidential foundation for any claim.
Defamation and consumer protection
A claim in defamation may lie against the publisher of a fake recording, a fabricated quote or AI-generated fake reviews. AI-assisted review bombing – where fake reviews are generated at scale – may also give rise to claims under consumer protection legislation, which prohibits fake reviews. Platforms' own terms of service may require removal, and injunctive relief may be available to prevent ongoing harm.
Data protection and misuse of private information
Where AI tools are used to process or leak private information, data protection law – in particular the UK GDPR and the Data Protection Act 2018 – may be engaged, giving rise to claims against the data controller responsible for the breach.
The tort of misuse of private information remains a powerful tool where private information is published or disseminated without consent, regardless of whether AI was the vehicle for obtaining or generating it – for example, against someone who reposts doctored intimate images or fabricated medical records.
Disclosure orders
Where the identity of the person responsible for harmful AI-generated content is unknown, it may be appropriate to seek a Norwich Pharmacal order requiring a platform or third party "mixed up in the wrongdoing" to disclose identifying information. This can be a technically and jurisdictionally complex exercise, particularly where the relevant platform is based outside the United Kingdom.
We work with our Cyber & Complex Investigations team and specialist contacts to trace and identify sources of AI-generated harmful content, navigate cross-border challenges and, where there is technical evidence that content is AI-generated, deploy that analysis proactively in correspondence with platforms to accelerate takedown.
Online Safety Act 2023
The Online Safety Act 2023 introduces new duties on platforms to act against illegal content – including content that is false and likely to cause psychological harm, and non-consensual intimate image deepfakes. Platforms' obligations under the Act can be invoked as part of a targeted takedown strategy. Ofcom's forthcoming regulatory regime will, over time, increase accountability for platforms that fail to act on harmful AI-generated content.
AI liability – an emerging question
A currently untested question in this jurisdiction is whether a claim arises where an AI chatbot generates a defamatory response or repeats private information scraped from the public domain. In a recent legal statement, the UK Jurisdiction Taskforce (UKJT) concluded that, since AI cannot be treated as a legal person, harms caused by false AI-generated statements would in most cases give rise to negligence claims against the developers of the relevant AI model or tool – focusing on the human decisions behind its design, testing and deployment – rather than claims in misstatement, defamation or deceit.
It remains to be seen how and where liability falls for harms caused by AI. In the meantime, there are numerous ways to target the publication – including repetition – of AI-generated content that is unlawful. The mainstays of reactive as well as proactive reputation protection still apply, even if monitoring reputational risks and preparing for the truth to be challenged need to be more sophisticated than ever.
How Mishcon can help
Mishcon's Reputation Protection & Crisis Management team brings together expertise across defamation, privacy, harassment and data protection. We use AI-powered monitoring to identify threats in real time, as well as sophisticated technology to assess whether content has been AI-generated.
Our proactive offering includes advising on vulnerabilities in protocols and policies, developing bespoke crisis plans and running simulation exercises. Our reactive offering includes engaging with publishers and platforms to seek corrections and takedowns and, where necessary, formal legal action. We work in close collaboration with colleagues across the firm – including in Cyber & Complex Investigations, Intellectual Property and Fraud – to provide a bespoke and comprehensive response.