Guidelines for Responsible AI · Topic 4 of 6
GenAI Legal Risks and Guardrails
Recognise the legal and trust risks of generative AI, such as IP claims, biased outputs, hallucinations and toxicity, and the controls that reduce them.
- 4 min
- Includes a diagram
- GenAI legal and trust risks include IP infringement claims, biased outputs, loss of customer trust, end user risk and hallucinations.
- The deploying company is responsible for its application's output.
- Toxicity, privacy breaches and misuse are further risks to control.
What it is
Generative AI creates content, so it can create content that causes legal or reputational harm. A company is still responsible for what its AI application says or produces.
The exam lists a set of risks that you should be able to name, explain and match to a control.
How it works
Main risks
| Risk | What it means |
|---|---|
| Intellectual property (IP) infringement claims | Output may resemble copyrighted material, or training data may have been used without rights |
| Biased model outputs | Unfair or discriminatory results, which may lead to legal claims |
| Loss of customer trust | Wrong, offensive or unsafe answers damage the brand |
| End user risk | Harm to people who act on wrong advice, such as medical or financial errors |
| Hallucinations | Confident but false statements, which can mislead or defame |
| Toxicity | Offensive, hateful or harmful language in outputs |
| Privacy breaches | Personal data revealed in prompts, training data or answers |
| Misuse | Using the system to produce fraud, harmful content or disinformation |
Why companies carry the risk
A model provider offers a tool, but the company that deploys it answers to its customers and regulators. If a chatbot gives a customer wrong information about a policy, the company may be held responsible. Contract terms and indemnity from providers differ, so read them.
Intellectual property
Training data can include copyrighted works. Output can occasionally echo existing material. Reduce the risk by using models whose providers document their data and licences, by keeping humans in the review step for published content, and by not feeding in material you have no right to use.
Hallucination and end user harm
A hallucination in a casual chat is an annoyance, but in legal, medical or financial advice it can cause real harm. Ground answers in trusted sources, show citations, tell users when they are talking to AI, and add human review for high stakes use.
Toxicity and unsafe content
Models can produce or be pushed to produce harmful content. Content filters, topic restrictions and safe default behaviour reduce this. Test with hostile prompts before launch.
Amazon Bedrock Guardrails
Amazon Bedrock Guardrails is a feature that applies safety controls to both user inputs and model outputs. It works with models on Amazon Bedrock and can also be applied to other models through an API.
| Guardrail control | What it does |
|---|---|
| Content filters | Block harmful categories such as hate, insults, sexual content and violence, at adjustable strength |
| Denied topics | Block subjects you do not want the application to discuss |
| Word filters | Block chosen words or phrases |
| Sensitive information filters | Detect personal data and mask or block it |
| Grounding check | Flag answers that are not supported by the source text |
The same guardrail can be reused across applications, which keeps policy consistent.
Other safeguards
| Safeguard | Purpose |
|---|---|
| Human review | A person approves content with high impact |
| Clear disclosure | Users know they interact with AI and understand its limits |
| Policies and training | Staff know what the system may be used for |
| Logging and monitoring | Problems are found and traced |
| Testing | Hostile and edge case prompts are tried before release |
| Legal review | Terms, data rights and local rules are checked |
Layered defence
No single control is enough. Combine a well chosen model, grounding, guardrails, human oversight and monitoring.
What to remember for the exam
- GenAI legal and trust risks include IP infringement claims, biased outputs, loss of customer trust, end user risk and hallucinations.
- The deploying company is responsible for its application's output.
- Toxicity, privacy breaches and misuse are further risks to control.
- Amazon Bedrock Guardrails filter content, block topics and words, and mask sensitive data.
- Guardrails apply to both inputs and outputs.
- Grounding with RAG and citations helps reduce hallucination.
- Human review is the main safeguard for high stakes content.
- Use layered controls, since no single control removes all risk.
A chatbot's wrong answer is the company's problem, not only the model provider's. Do not assume that using a provider's model moves all the legal responsibility to the provider.
Common mistakes
Assuming the provider carries all the risk. The deploying company stays accountable to its users.
Thinking Guardrails only filter outputs. They check user inputs too.
Treating hallucination as a minor flaw. In regulated areas it can cause real harm.
Skipping disclosure. Users should know when they interact with AI.
Using one control alone. A filter without testing and review leaves gaps.
Check yourself
Name three legal or trust risks of GenAI.
Examples are IP infringement claims, biased outputs, hallucinations and loss of customer trust.
Which Bedrock feature can mask personal data and block denied topics?
Amazon Bedrock Guardrails.
Who is accountable for a chatbot's harmful answer?
The company that deploys the application, not only the model provider.
Topic 4 of 6 in Guidelines for Responsible AI
Test yourself on Guidelines for Responsible AI
The full AWS AIF-C01 question bank has 849 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.