Update AI Policy

[Yaswant Pradhan (yaswant)]

PR Summary

Update AI policy and tidy some typographical errors.

Code Reviewer: Pierre Siddall (@Pierre-siddall)

Code Quality Checklist

• I have performed a self-review of my own code
• I have locally built the documentation successfully, and the output of changed sections is as expected

Code Review

• The changes are coherent and valid

[Jean-Christophe Rioual (mo-jcrioual)]

We have been challenged by a contributor on the wording "bear full [] legal responsibility". Is this backed up by guidance from the legal team or a wider corporate guidance on Gen AI ?

[Andrew Clark (arjclark)]

Certainly in the ancillary space we've been advised in past (in a ever and rapidly evolving set of opinions and guidance) that it is the submitter's responsibility to ensure they're not violating someone else's IPR and that they've taken appropriate steps to avoid that. We ask the question explicitly regarding IPR in our submission templates, at which point the ANTS team is "acting in good faith" based on the information provided by the submitter who has confirmed that they've taken steps to avoid IPR violations, so the legal question would ultimately fall on the developer.

Our wider (Met Office) guidance only seems to consider the Met Office scope though. It's been somewhat grey in terms of how we interact with external bodies and international partners.

Something to take to the Science Codes Owner and Legal though.

[Jean-Christophe Rioual (mo-jcrioual)]

My question was precisely if this guidance is written down somewhere and approved by legal. If yes, maybe let's refer to it in the text.

Another point is that for me "integrity of the code" can be construed as wider than IPR issues.

[Andrew Clark (arjclark)]

Another point is that for me "integrity of the code" can be construed as wider than IPR issues.

Indeed. On that point, if this policy addition applies to the repositories you're using this license across: https://github.com/MetOffice/simulation-systems/blob/main/LICENSE then integrity itself probably needs defining very clearly. That license is a BSD 3-clause that says:

"THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."

A contributor would not be able to be made liable by anyone accepting and running codebases with that license for quite a lot of things, regardless of whether they used generative AI or otherwise.

[Jean-Christophe Rioual (mo-jcrioual)]

What exactly is the responsibility of the reviewer here ? How can they assert that a code hasn't been plagiarised ? It is not necessarily obvious.

Should we change the text to code contains no obvious proprietary or restrictively licensed snippet.

[Yaswant Pradhan (yaswant)]

Yes, that's a good point. Slightly rewarded the content in the table.

[Jean-Christophe Rioual (mo-jcrioual)]

All the text cleaning is fine but I have added two comments in the code changes

• one about legal responsibility
• one about reviewer responsibility

[Andrew Clark (arjclark)]

I think these look sensible adjustments to me.

[James Penn (jamesp)]

Thanks Yaswant Pradhan (@yaswant) for tagging me on the PR and raising its awareness. I think the wording looks like a sensible and pragmatic approach. I agree with Andrew Clark (@arjclark) suggestion above and would welcome further advice from our legal team on whether the stronger wording of previous iterations helps in any potential liability. From my reading of it I don't think you are expecting any greater level of responsibility from contributors than in any other open source code contribution context, only reminding them of their existing obligations to not violate IPR and license stipulations, and adding a requirement to attribute AI usage. It would be good to ensure that agrees with legal view.

[Jean-Christophe Rioual (mo-jcrioual)]

I am happy with the current iteration. It's important that we get this right so thank you for leading on this. I think we have to accept that it's an evolving picture and that there are still some grey zones.