EU AI Act for General Counsel.

Why the Act creates new legal exposure

The EU AI Act represents a fundamental shift in how organizations must approach AI deployment. For General Counsel, three aspects create particularly significant legal exposure:

Behavioural obligations, not just data rules

GDPR focused on how organizations handle data. The AI Act focuses on how AI systems behave and make decisions. This means legal liability now extends to algorithmic outputs, model accuracy, bias in automated decisions, and the effectiveness of human oversight mechanisms. These are areas where legal teams historically had limited visibility.

Expanded definition of “provider”

Under Article 3, organizations that substantially modify AI systems or put their name on AI products may become “providers” — assuming full compliance obligations including conformity assessment. A company that integrates a third-party AI model into a high-risk use case (employment screening, credit decisions) may inherit provider-level liability regardless of who built the underlying model.

The AI Liability Directive

The forthcoming EU AI Liability Directive will create a rebuttable presumption of causation when AI systems cause harm and the defendant cannot demonstrate compliance. This effectively shifts the burden of proof to defendants. Organizations unable to produce evidence of proper risk management, testing, and oversight will face significant disadvantages in litigation.

Key General Counsel responsibilities under the Act

Liability assessment and risk allocation

General Counsel must map AI systems across the organization and classify them according to the Act’s risk taxonomy. For each high-risk system, liability must be clearly allocated between internal teams, vendors, and partners. Key questions include:

• Who bears liability for model performance and accuracy?
• How is responsibility allocated when multiple parties contribute to a system?
• What insurance coverage exists for AI-specific liability?
• Are indemnification provisions adequate for regulatory penalties?

Contractual obligations

Vendor agreements require immediate review. Contracts with AI providers must address:

• Clear allocation of provider vs. deployer obligations
• Representations regarding risk classification and conformity status
• Audit rights for compliance verification
• Incident notification aligned with Article 73 (15-day serious incident reporting)
• Indemnification for regulatory penalties from vendor non-compliance
• Data governance warranties per Article 10
• Documentation delivery for downstream compliance

Customer terms must be updated to include appropriate AI disclosures, particularly for systems requiring transparency under Article 50 (chatbots, emotion recognition, deepfakes).

Regulatory-engagement strategy

The AI Act establishes national competent authorities in each member state, coordinated by the EU AI Office. General Counsel should develop relationships with relevant authorities before enforcement actions arise. Consider:

• Identifying which member state authorities have jurisdiction
• Monitoring regulatory guidance and codes of practice
• Participating in regulatory sandboxes where available
• Preparing for potential market surveillance activities

Evidence-preservation requirements

Article 12 requires high-risk AI systems to generate logs that enable monitoring and investigation. General Counsel must ensure:

• Logging systems capture decision-relevant data
• Retention periods meet regulatory requirements
• Legal hold procedures extend to AI system logs
• Chain of custody protocols exist for algorithmic evidence

Documentation and disclosure obligations

Article 11 mandates comprehensive technical documentation before high-risk systems enter the market. Article 13 requires transparency for users. General Counsel oversight ensures documentation is legally sound and disclosures don’t create unintended liability exposure.

Questions General Counsel should be asking the organisation

Red flags indicating legal and compliance gaps

Personal-liability considerations

While the EU AI Act primarily imposes organizational penalties, General Counsel should be aware of pathways to personal liability:

Member State Implementation

Individual member states may implement the AI Act in ways that create personal liability for directors or officers. Monitor transposition legislation in key jurisdictions where the organisation operates.

Civil Litigation

When AI systems cause harm, affected parties may pursue civil claims against executives for negligent oversight. The AI Liability Directive’s burden-shifting will make such claims easier to sustain.

Fiduciary Duties

Directors have fiduciary obligations that include overseeing material risks. AI presents board-level risks; failure to ensure adequate governance may breach fiduciary duties.

Regulatory Action Against Individuals

In egregious cases—particularly involving prohibited AI practices or willful non-compliance—regulators may pursue action against responsible individuals, especially where they can demonstrate knowledge of violations.

The Colorado intersection: SB 26-189 and ADMT transparency

US organizations subject to the EU AI Act often track Colorado as the leading US state regime. That regime changed materially in May 2026. The 2024 Colorado AI Act (SB 24-205) was repealed and replaced before it ever took effect by SB 26-189, titled “Automated Decision-Making Technology,” signed by Governor Polis on May 14, 2026. Substantive compliance commences January 1, 2027; the duties are not yet enforceable. The earlier “June 30, 2026” effective date is no longer operative.

From high-risk AI systems to covered ADMT

SB 26-189 drops the “high-risk artificial intelligence system” category and the reasonable-care framework around it. It instead regulates covered automated decision-making technology (ADMT) — technology that processes personal data to generate outputs (predictions, recommendations, classifications, rankings, scores) used to materially influence a consequential decision in domains such as education, employment, housing, financial or lending services, insurance, health-care services, and essential government services. “Materially influence” replaces SB 24-205’s “substantial factor” with a non-de-minimis-factor test; incidental or clerical uses are excluded. The Colorado Attorney General must adopt clarifying rules by January 1, 2027.

What the new regime requires — and what it dropped

The replacement is a narrower transparency-and-disclosure framework. Deployer duties are: clear-and-conspicuous pre-use notice before a covered ADMT materially influences a consequential decision; plain-language disclosure within 30 days of an adverse outcome describing the ADMT’s role and the consumer’s rights; data-correction access on request; and meaningful human review on request, to the extent commercially reasonable. Developers must supply deployers with documentation on intended uses, known limitations, and instructions for monitoring and human review, with records retained at least three years.

Several SB 24-205 obligations did not survive: the duty of reasonable care to prevent algorithmic discrimination is gone (discrimination is now handled under existing Colorado anti-discrimination law); mandatory risk-management programs and annual impact assessments are eliminated; the NIST AI RMF / ISO 42001 rebuttable-presumption safe harbor was removed with no comparable replacement; there is no size-based (fewer-than-50-employee) exemption; and the standalone “you are interacting with an AI system” chatbot disclosure does not survive — only the consequential-decision pre-use notice remains. Enforcement is exclusively by the Colorado Attorney General, with a 60-day notice-and-cure period (sunsetting January 1, 2030) and no private right of action.

Implications for EU AI Act compliance

For organizations operating under both regimes, the same evidence foundation does double duty. SB 26-189 leans on pre-use notice, post-adverse-outcome disclosure, developer documentation, and at-least-three-year recordkeeping — exactly the kind of contemporaneous, retained record the EU AI Act’s logging requirements (Article 12) and post-market monitoring obligations (Article 72) already contemplate. Following NIST AI RMF or ISO 42001 is no longer a codified Colorado defense, but remains sound practice and maps cleanly to EU technical-documentation expectations.

Evidence standards for regulatory defence

When regulators investigate or litigation arises, evidence quality determines outcomes. General Counsel must understand what constitutes defensible evidence under AI regulations:

Contemporaneous Documentation

Evidence generated in real-time carries far more weight than after-the-fact reconstruction. Timestamped logs showing controls executed at specific moments defeat arguments that compliance was merely aspirational.

Tamper-Evident Records

Regulators are sophisticated enough to question whether logs have been modified. Cryptographic attestation—evidence that hasn’t been and cannot be altered—provides the strongest foundation for defense.

Mapping to Regulatory Requirements

Evidence must clearly correspond to specific regulatory obligations. General documentation about “AI governance” is less valuable than evidence specifically demonstrating Article 9 risk management, Article 10 data governance, or Article 14 human oversight.

The “Proof Gap” Problem

Most organizations suffer from a “proof gap” — the difference between controls that exist on paper and verifiable evidence that controls actually operate. Closing this gap is essential for regulatory defense. Policy documents prove intent; operational evidence proves execution.

Working with other stakeholders

Chief Information Security Officer (CISO)

Coordinate on: logging infrastructure, data security for AI systems, cybersecurity requirements under Article 15, incident detection and response, vulnerability management for AI-specific threats.

Chief Compliance Officer (CCO)

Coordinate on: compliance program design, regulatory mapping, training and awareness, audit schedules, remediation tracking, policy development.

Business Unit Leaders

Coordinate on: AI use case identification, risk classification input, operational implementation of controls, human oversight execution, incident escalation protocols.

Data Protection Officer (DPO)

Coordinate on: GDPR/AI Act intersection, data governance under Article 10, privacy impact assessments, cross-border data considerations, subject access requests involving AI.

Board reporting on AI risk

General Counsel should ensure the board receives regular, substantive reporting on AI-related legal exposure:

Litigation-readiness checklist

How GLACIS provides defensible evidence

GLACIS addresses the core challenge General Counsel face: producing evidence that AI controls actually operate, not just documentation that they should.

Frequently asked questions

References