Most companies now have some form of AI governance: a committee, a Chief AI Officer, a policy, an inventory or a risk review. Legal's role in it is often unclear. Make it explicit.
What legal brings
- Contracts: vendor and customer AI terms.
- Data: privacy, confidentiality and trade secrets.
- IP: ownership, infringement and open-source licences.
- Regulation: AI laws, sector rules and their dates.
- Liability and claims: product liability, consumer protection, discrimination, AI marketing claims and disclosures.
- Investigations and incidents: privilege, notification and regulator contact.
Common models
- Legal as committee member: a seat on the AI governance committee with review rights on high-risk uses.
- Legal as gate: legal sign-off required for defined triggers (new AI vendor with sensitive data, AI in products, automated decisions about people, public AI claims).
- Legal as co-owner: in some companies the General Counsel chairs AI governance, especially where regulation is the main driver.
Use recognized frameworks
Frameworks give governance a shared language: the NIST AI Risk Management Framework (Govern, Map, Measure, Manage) and ISO/IEC 42001, the AI management system standard. Legal's job is to connect them to actual legal obligations.
AI claims and disclosures
Legal should review what the company says about its AI, in marketing, investor materials and filings. In March 2024 the SEC charged two investment advisers for "AI washing", false and misleading statements about their use of AI, with $400,000 in total civil penalties.