Questions this raises for me (making a note here to maybe research a bit later):

Does this analysis change if using on-site AI? What if the ToS is different? Is it possible to stand up a service that does get the protections required? This might also be interesting when dealing with trans-atlantic work.