Reducing the Legal Exposure of a Generative Feature

The situation

An online retailer sells around 60,000 product lines across homewares, groceries and small appliances. About 19,000 of them carry a description somebody wrote. The other 41,000 show whatever the supplier sent, usually a model number and a spec table. Those pages convert at roughly half the rate of the ones with prose on them.

Three generative features came out of the same planning session. The first writes a description for every line that lacks one, from the supplier’s spec sheet. The second generates 400 lifestyle images for a spring homewares campaign, instead of booking a photographer and a studio. The third puts a two-sentence summary of customer reviews at the top of each product page. All three worked in the prototype, and the demo went well enough that a launch date got written down.

Then legal read it. The memo that came back does not say no on principle. It lists five things that have to be answered before anyone signs, and it is written in the vocabulary of exposure rather than the vocabulary of models. Who is liable if a generated sentence turns out to belong to somebody else. What the retailer says when a customer works out that the review summary was never read by a person.

What actually matters

The AI Practitioner material files this under the legal risks of working with generative AI, and names five of them. Intellectual property infringement claims, biased model outputs, loss of customer trust, end user risk, and hallucinations. They arrive together in a memo, but they are five different problems, and each one closes somewhere different.

Intellectual property infringement claims run in two directions. There is what goes in, which here means prompting the model with a competitor’s product copy or fine-tuning on a scraped corpus of descriptions the retailer has no right to. And there is what comes out. Generated text can reproduce wording that belongs to someone else, and a generated image can reproduce a protected character, a distinctive brand element, or a photographer’s recognisable work. The first direction is entirely within the retailer’s control: what the team is allowed to paste into a prompt. The second is a property of the model and its training data. It is also the one place in the memo where a supplier’s contract can carry some of the liability.

Biased model outputs show up here without anybody writing a rule and without a protected attribute appearing in the input. Run the generator over the whole catalogue and read the results by category. The cleaning products and the kitchen storage come back addressed to a harried mother. The power tools and the audio gear come back as flat technical specification. The model learned that association from its training corpus and applied it consistently, at a scale no copywriter would have. The image generator does the same thing in pictures: 400 lifestyle shots where the person in the kitchen is a woman and the person in the shed is a man. The exposure is a discrimination complaint, and the reputational damage arrives first.

Loss of customer trust attaches to the review summary more than to anything else. The summary sits above the reviews in the retailer’s own voice, and a shopper reading it reasonably assumes an editor read the reviews. The harm comes from the discovery rather than from the text. A summary that is accurate, useful and machine-written with nothing on the page saying so is still a story once a competitor, a journalist or a detection tool gets there first.

End user risk is the one where somebody outside the company gets hurt. A shopper reads “suitable for induction hobs” on a pan that is not. Or “contains no nuts” on a product whose supplier sheet never said so. Or an outdoor rating on a heater built for indoor use. The remedy for a bad page is to correct it, and correction arrives after the burn, the reaction, or the fire. One wrong allergen line across 41,000 correct descriptions is the whole exposure.

Hallucinations are the mechanism underneath most of that. A model asked to write a description from a thin spec sheet produces a fluent one either way. The missing capacity, the invented warranty length and the confidently stated dishwasher-safe all come out in the same register as the true parts of the paragraph. Nothing in the output marks the invented clause. That makes hallucinations an architectural problem: either the model is given the facts and constrained to them, or the claim does not get published.

Sorting those five, three closure classes fall out. One risk moves by choosing a different model and reading the contract that comes with it. Three are engineering problems, solvable in the pipeline by grounding, filtering and marking. And two come down, in part, to a person deciding, because no automated check can be trusted with the sentence that tells a shopper what is safe to eat. None of the five closes by the model simply being better. A more capable model writes more convincing wrong allergen lines.

What we’ll filter on

1. Where the liability sits: does any party outside the retailer carry part of it, and under what conditions?
2. Licensing and acceptable use: what do the model’s terms permit for commercial output, and do they restrict the use we have in mind?
3. Traceability: can every factual claim in the output be pointed back to a record the retailer owns?
4. Automatic rejection: can the system block an output that fails a check, with nobody in the loop?
5. Provenance: can we prove later that a given image or paragraph came out of a model, and which one?
6. Cost of the human step: how many outputs need a person to read them, and is that number small enough to staff every week?

The landscape

Choosing the model, and reading what arrives with it

Model access in Amazon Bedrock is not the gate people picture. Access to every Bedrock foundation model is enabled by default for an account holding the right AWS Marketplace permissions, and invoking a third-party model for the first time is itself agreement to that model’s end user licence agreement. An organisation that wants the terms read before they bind has to deny bedrock:InvokeModel by service control policy or IAM policy, review, then enable. Anthropic models add a one-time use-case form per account or organisation.

Two documents matter, and they are not the same. The licence sets out what may be done with the model and its output, and it is provider-specific. What may not be generated at all comes from the AWS Acceptable Use Policy and the AWS Responsible AI Policy, which apply across AWS AI services, with some providers layering their own terms on top.

A model deployed from Amazon SageMaker JumpStart runs on the retailer’s own endpoint, which feels like ownership and is not. Open weights commonly arrive under a community licence with named prohibited uses, attribution requirements, and an obligation to pass the same terms to anyone you redistribute to. The Llama community licences add a threshold at 700 million monthly active users, above which you have to request a separate licence from Meta and Meta decides whether to grant it. Running the model on your own endpoint changes none of that, and it leaves the output risk with the retailer, because nobody indemnifies what an open-weight model emits.

Against that, AWS offers uncapped intellectual property indemnity for copyright claims arising from the generative output of its own generally available services: the Amazon Nova models, and the other services listed in section 50.10 of the AWS Service Terms. Read the scope before leaning on it. Third-party models in the Bedrock catalogue are outside it, whatever their own provider offers separately. The conditions are worth memorising too. The customer has to use the service responsibly, which means not feeding it infringing input and not disabling the service’s filtering features.

Two documents help before the decision, not after it. An AWS AI Service Card sets out the use cases a service is intended for, how machine learning is used in it, and the considerations in designing and using it responsibly, in language a non-specialist can act on. Amazon SageMaker Model Cards do the equivalent job for a model the retailer trains or tunes itself, recording intended use, a risk rating, training details, and evaluation results and observations in one place a reviewer can be pointed at.

Grounding the output in data the retailer owns

Amazon Bedrock Knowledge Bases indexes the product catalogue, the supplier spec sheets and the approved claims register. Every description is then generated from retrieved records rather than from the model’s general knowledge of pans. The technique is the one behind answering questions from your own documents, applied to writing rather than to answering. The citations-required arrangement matters more here than usual. A claim with no source record attached cannot be published.

Grounding does a second job. A model rewriting a spec sheet the retailer owns has less room to emit somebody else’s sentence than one asked to invent copy from a product name, so the control that reduces invented facts also narrows the surface for an infringement claim.

Filtering at the boundary

Amazon Bedrock Guardrails sits between the application and the model and applies the same policy whichever model is behind it. Content filters catch harmful categories at configurable strengths. Denied topics block subjects defined in natural language rather than by keyword, and word filters match exact competitor names or banned marketing phrases. Sensitive information filters block or mask anything that looks like personal data leaking in from a review.

The relevant piece for this catalogue is the contextual grounding check. It needs three things: the grounding source, the query, and the response to be checked. It returns two confidence scores. A grounding score says how well the response is supported by the source, where anything new counts as ungrounded. A relevance score says how well the response answers the query. Thresholds run from 0 to 0.99 on each, and a response scoring below either one is blocked. Applied to a generated description, that stops a sentence the spec sheet does not support from reaching the page, which is the closest thing available to a machine check for hallucinations.

Marking what the model made

Amazon Nova Canvas applies an invisible watermark to every image it generates, and writes C2PA Content Credentials into the file alongside it, which any C2PA tool can read. Bedrock’s watermark detection is still a public preview, confined to us-east-1 and us-west-2, and it covers the watermarks from Nova Canvas and Titan Image Generator G1. Both of those models are in the legacy lifecycle, Titan Image Generator past its 30 June 2026 end of life and Nova Canvas reaching 30 September 2026, so a campaign starting now chooses its image model and its provenance mechanism together.

The detection path is weaker than it sounds in any case. AWS says an image modified from the original detects less reliably, and C2PA metadata disappears whenever a tool rewrites the file. The retailer’s own record survives both, so log the model identity, the prompt, the retrieved sources, the timestamp and the person who approved it, alongside every published asset. That record is what turns “we think that one was generated” into an answer with a date on it. Amazon Rekognition content moderation gives a second pass over generated images before publication, catching the ones that came back with something nobody wants on a homewares page.

Human review, scoped narrowly

Nobody has to staff a person to read 41,000 descriptions. Route by claim type instead of by model confidence, because confidence is exactly the signal a hallucinating model gets wrong. Allergen and ingredient statements, safety and electrical ratings, age suitability, medical or health claims, warranty terms and price all go to a person before publication. Colour, dimensions, material and tone of voice publish automatically once they pass the grounding check. In this catalogue that split sends roughly 6,000 lines to review rather than 41,000, which is a fortnight of work for a small team instead of a hiring round.

Disclosure

Say that the content is AI-assisted, on the page where a shopper is already looking, rather than in a policy document three clicks away. The discovery is what loses trust, and one line on the page removes it.

Evaluation

Side by side

Risk	Model choice and licensing	Grounding in owned data	Guardrails	Watermark and record	Human review	Disclosure
Intellectual property infringement claims	✓	✓	✗	✓	✗	✗
Biased model outputs	✗	✗	✓	✗	✓	✗
Loss of customer trust	✗	✓	✗	✓	✓	✓
End user risk	✗	✓	✓	✗	✓	✗
Hallucinations	✗	✓	✓	✗	✓	✗

Read the first column downwards: model selection and its contract move exactly one row. That single row is worth moving, because an infringement claim is the one exposure here that arrives from outside with a lawyer attached. A team that spends three weeks comparing model licences and then ships without grounding has answered one fifth of the memo.

Read the human-review column and it ticks four rows. That is why the instinct to put a person on everything runs so strong, and why it has to be resisted on scope rather than on principle. A review step applied to 41,000 descriptions gets skimmed by week two and stops being a control.

The grounding column ticks four rows and underpins a fifth. The guardrail column reaches its full strength only once the grounding column is filled, because a contextual grounding check with no retrieved source has nothing to score against.

What happens to one generated output

The ordering is doing the work. Traceability is checked before harm, because an untraceable claim is blocked whether or not it is dangerous, and a reviewer asked to adjudicate a sentence with no source record has nothing to adjudicate against.

The solution

Start with the model and its paperwork, because that decision constrains everything downstream and is slow to reverse. If the indemnity matters to legal, that narrows the choice to Amazon’s own generally available models, since the AWS cover does not extend to third-party models in the catalogue. Keep the service’s filters on so the conditions hold. File the licence and the applicable acceptable use terms alongside the design, so a reviewer can find them a year from now. If an open-weight model from SageMaker JumpStart is genuinely better for the catalogue, legal makes that decision with the licence in front of them rather than engineering making it on benchmark scores. The same care applies going in. Forbid pasting competitor copy into a prompt, and do not fine-tune on anything whose provenance the team cannot state. That is the curated-sources question arriving in a legal register.

Then build the pipeline so an unsourced fact never reaches the page. Every description is generated from records retrieved out of a Bedrock Knowledge Base over the retailer’s own catalogue, spec sheets and approved-claims register. The prompt instructs the model to write only from the supplied records and to omit anything not present rather than fill the gap. A Bedrock guardrail wraps the call, with a contextual grounding check thresholded so an unsupported sentence fails, and word filters blocking competitor names and the marketing superlatives compliance already bans. Generated images pass through Rekognition moderation, and the file’s own provenance marks plus your generation log give two independent answers to “where did this come from”.

Handle bias as a review of the corpus rather than of individual outputs, because it is invisible one description at a time and obvious across a category. Generate a sample, group it by product category, and read the tone. Then look at the same slices in the image set: who is in the kitchen, who is in the workshop, whose hands are on the appliance. Prompt-level constraints hold the register steady across categories, and a diversity brief on image prompts stops the generator defaulting to whatever its training corpus over-represents. Neither is a one-off. Re-run the category read after any model change, because a model swap resets every assumption about output tone.

Route the regulated claims to a person and let the rest publish. The classifier that sorts them need not be clever. A claim register listing the attributes that require review, matched against the generated text, is more auditable than a model classifying its own output. When a reviewer rejects something, capture why, because the rejection log is the evidence that the control operates, and it is where the prompt improvements come from.

Disclose. One line on the page saying descriptions are AI-assisted and reviewed, and a link to a short explanation of what that means. Then make it possible for a customer to reach a person about a specific page. That route back to a human turns a complaint into a correction rather than a story.

Three things bite afterwards. Indemnity conditions are conditions. Disabling a filter to clear a false positive on a Tuesday removes the protection the whole business case rested on, with nothing else in the pipeline changing to signal it, so filter changes go through review rather than a console toggle. Guardrail thresholds drift out of calibration as the catalogue changes, and a threshold set against homewares behaves differently over groceries. Sample the blocked outputs monthly and read what is being stopped. And the review capacity has to be sized for the ongoing intake. Six thousand lines reviewed once is a project. Four hundred new lines a week arriving forever is a role somebody has to own.

Worked example

A supplier sheet for a cast-iron casserole lists the brand, a model number, 4.2 litres, enamelled cast iron, and dimensions. Nothing about hob compatibility, oven temperature or dishwasher suitability.

Ungrounded, the model returns a paragraph naming it induction-compatible, oven-safe to 260 degrees and dishwasher-safe. All three are plausible for enamelled cast iron and none of them appears on the sheet. The oven figure is the one that matters, because an enamel knob rated to 190 degrees fails at 260 and the shopper is holding a hot lid when it does. That is end user risk produced by hallucinations, and the paragraph reads beautifully.

Grounded against the catalogue record and the approved-claims register, the same request returns capacity, material, dimensions and colour, and omits the three claims the register does not carry. The contextual grounding check scores the response against the retrieved records and passes it. Hob compatibility is on the regulated list, so the field stays empty and a task goes to the merchandiser to ask the supplier. An empty field states what the retailer actually knows. The published page carries the AI-assisted line, and the generation log holds the model identity, the retrieved records and the timestamp.

Six weeks later a customer service enquiry asks whether the lifestyle photograph on that page is a real kitchen. The generation log names the model, the prompt and the person who approved it, which answers the question without depending on a preview API in two Regions.

What’s worth remembering

1. The legal risks of working with generative AI that this material names are intellectual property infringement claims, biased model outputs, loss of customer trust, end user risk, and hallucinations, and each one closes in a different place.
2. Only intellectual property exposure moves meaningfully by choosing a model: AWS indemnifies the output of its own generally available services, not the third-party models in the Bedrock catalogue, and only while the filters stay on and nobody feeds it infringing input.
3. Licensing is part of model selection, because an open-weight model from SageMaker JumpStart can carry prohibited uses, redistribution obligations, a user-count threshold and no indemnity at all, none of which changes because it runs on your own endpoint.
4. Grounding generation in data you own, through Bedrock Knowledge Bases with a Guardrails contextual grounding check over it, reduces hallucinations, narrows end user risk and shrinks the surface for an infringement claim at once.
5. Human review works when it is scoped to regulated claims such as allergens, safety ratings and health statements, and stops working when it is applied to every output.
6. Watermarks and C2PA credentials can both be lost when an image is edited, and Bedrock’s watermark detection is still a preview in two Regions, so the retailer’s own log of model, prompt and approver is what keeps provenance answerable later.