Legal — Charter

Legal protects the company's position: what it has agreed to, what it owns, and what it is exposed to. In an AI-operated company two things are new — liability for automated decisions, and intellectual property questions with no settled answer — and both arrive faster than legal review cycles are designed for.

The failure mode to avoid is legal as a final gate. A review that happens after everything is built either rubber-stamps or causes an expensive rebuild.

What this role owns#

Contracts. What we have committed to, and what our suppliers have committed to us.

Intellectual property. What we own, what we licensed, and what we may not own because of how it was produced.

Liability position. Including for outputs and decisions produced by automated systems.

Regulatory obligations, jointly with Compliance. Legal determines what applies; Compliance evidences that it is met.

Disclaimers and terms on everything customer-facing.

KPIs#

That last one predicts most of the others.

What is already in force#

The position as at 2026-08-04 — re-verify, because this area is moving:

EU AI Act transparency obligations applied from 2 August 2026. People must be told when they are interacting with an AI system, and AI-generated content must be labelled. This applies to ordinary chatbots and content generation, not only to systems classified as high-risk.

High-risk obligations were deferred, not removed. The Digital Omnibus package, approved by the Council on 29 June 2026, moved stand-alone high-risk systems under Annex III to 2 December 2027, and product-embedded systems under Annex I to 2 August 2028. High-risk covers employment, credit scoring, insurance, education, critical infrastructure and biometric identification.

Reading the deferral as "AI regulation was postponed" is wrong. The heavy conformity work moved; transparency did not.

Which obligations bite depends on the role you occupy for each system — you may be a provider of one and merely a deployer of another — and on where the people affected are located rather than where you are incorporated.

AI-specific questions without settled answers#

Worth holding a documented position on, even a provisional one:

• Who owns AI-generated output, and does it attract copyright at all?
• Training data provenance in the tools you use, and what you have warranted to customers about it
• Liability for an automated decision — yours, the model provider's, or shared
• Confidentiality when staff paste client material into a third-party tool
• Professional obligations where advice is partly machine-produced

The practical control: a written position per question, dated, revisited. "We have not decided" is an answer that at least records the exposure.

AI agents in this function#

Contract review assistant — first pass against your standard positions, flagging deviations. Advisory only.

Obligations extraction agent — pulls commitments, dates and notice periods out of executed contracts into a register. This is high-value and low-risk.

Regulatory monitoring agent — tracks changes in the jurisdictions you operate in, with sources.

Clause library assistant — surfaces the approved wording for a situation.

What stays human: signing anything, accepting a liability position, giving advice, and any determination about whether an obligation applies. An agent may find the clause; it does not decide what it means for you.

SOPs#

• Contract review — triage by value and risk, standard terms fast-tracked.
• Obligations register — updated on execution, not later.
• AI system legal review — before launch: what it decides, what it discloses, whose data, which jurisdiction.
• Disclaimer standard — every customer-facing output carries the appropriate wording.
• Regulatory horizon review — quarterly, with dated positions.

Templates#

Contract review checklist · obligations register · AI system legal assessment · disclaimer library · Security Checklist governance section.

Workflows#

In: contracts for review · new initiatives · regulatory changes · incidents with a legal dimension · customer complaints.

Out: executed contracts · legal positions · obligations · approved wording · go/no-go on legal grounds.

Handoffs: Compliance for evidencing · Security for incidents · Sales for customer terms · CEO for anything that changes the risk position materially.

Nothing here is legal advice. Take advice on your specific position.

FAQ#

Do we need a lawyer to use AI?#

Not to use ordinary business tools. You do need a documented position on the questions above, and you need advice before deploying anything that makes decisions about people — employment, credit, insurance and similar are exactly where obligations bite hardest.

Can AI review contracts?#

It can produce a useful first pass against your standard positions and extract obligations reliably. It cannot advise, and it should not be the only reviewer on anything material — it is confidently wrong in ways a non-lawyer cannot detect.

Who is liable when an AI system gets it wrong?#

Unsettled and jurisdiction-dependent, which is exactly why a documented position matters. In practice the deploying organisation carries most of the exposure toward its customers, whatever the supplier contract says between you and the provider.

What should we do about the August 2026 transparency rules?#

Check every customer-facing AI touchpoint discloses that it is AI, and that generated content is labelled. It is a small change and it is already required — this is not a future project.

What else is coming for Legal