A Monday Morning
At 8:07 a.m. on a Monday morning, the General Counsel receives a call from the Chief Information Security Officer.
An engineer preparing a customer presentation uploaded thousands of internal design documents to a publicly available, generative AI platform. The employee intended only to summarize technical information more efficiently. They also thought the tool was secure. Instead, confidential business information, including proprietary engineering specifications and customer data was transmitted outside the company’s controlled environment.
Within hours, if not minutes, additional questions enter the fold.
- Did the uploaded materials contain trade secrets?
- Was personally identifiable information disclosed?
- Do contractual confidentiality obligations require the company to provide notice to customers?
- Must the incident be reported under applicable privacy or industry-specific regulations?
- Could these AI interactions become discoverable if litigation later arises?
- Should the board of directors be informed?
None of these questions concern machine learning. Each concerns legal risk. AI merely supplied the mechanism through which familiar legal issues surfaced.
AI should not be treated as creating entirely new legal obligations. It rarely does so. More often, it accelerates existing legal risks and exposes weaknesses in enterprise governance.
The above proposition forms the central premise of this article. The legal doctrines implicated by AI—fiduciary oversight, confidentiality, trade secret protection, employment discrimination, consumer protection, privacy, privilege, and corporate compliance—all predate modern AI by decades. What has changed is that AI can amplify existing legal risks faster, at a greater scale, and across an entire organization.
The question for General Counsel is therefore not whether artificial intelligence presents legal issues. It plainly does. The more important question is whether organizations are approaching AI as they would any other significant enterprise risk.
Asking the Right Questions
Much of the current discussion surrounding this emerging business and technological landscape begins with this question: “What are the legal risks of AI?”
For corporate counsel, that question is incomplete. The better query is: “How does AI change my company’s existing legal risk profile?” That distinction is more than semantic. It reflects the way courts, regulators, prosecutors, insurers, and shareholders are likely to evaluate organizational conduct.
Even more simply, AI does not replace existing legal principles. Trade secret law continues to govern confidential business information. Federal and state employment statutes continue to govern hiring and promotion decisions. The attorney-client privilege remains governed by longstanding principles concerning confidentiality. Consumer protection statutes continue to prohibit deceptive practices. Boards of directors remain subject to fiduciary duties of oversight. Instead, AI changes the factual circumstances under which these doctrines operate—not the doctrines themselves.
This pattern is not new. Corporate counsel has confronted similar technological shifts before. Email dramatically increased the volume of business communications and discoverable information, but familiar rules governing discovery, preservation, and confidentiality continued to apply. Cloud computing changed where and how organizations stored information, but familiar obligations concerning confidentiality, privacy, and data security remained. Cybersecurity introduced new ways in which sensitive information and business operations could be compromised, but the resulting legal issues—including regulatory compliance, fiduciary oversight, and protection of confidential information—were grounded largely in existing legal principles. Generative AI presents a similar challenge: the technology may be new, but many of the legal risks it creates or amplifies are not. That distinction matters not only for corporate counsel, but also for boards charged with overseeing significant enterprise risks. Courts have increasingly emphasized that directors must make good-faith efforts to establish and maintain appropriate oversight of such risks, particularly when they are central to the corporation’s business. See, e.g., In re Caremark Int’l Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996); Stone v. Ritter, 911 A.2d 362 (Del. 2006); Marchand v. Barnhill, 212 A.3d 805 (Del. 2019).
Artificial intelligence appears to be following the same trajectory. The technology is new, but the legal inquiry is familiar.
An Emerging Governance Consensus
The United States has not enacted a comprehensive federal statute governing artificial intelligence across all industries. Nevertheless, several authoritative sources—while differing in legal effect—reflect a growing consensus that AI should be governed through structured risk management rather than ad hoc decision-making.
For example, the National Institute of Standards and Technology’s (NIST) Artificial Intelligence Risk Management Framework (AI RMF 1.0) identifies governance as one of the framework’s four core functions and emphasizes that organizations should establish processes for managing AI-related risk throughout the enterprise. ¹
Similarly, the Department of Justice’s Evaluation of Corporate Compliance Programs instructs federal prosecutors to evaluate whether corporate compliance programs are well designed, adequately resourced, implemented in good faith, and functioning effectively in practice. ² Although the guidance is technology-neutral, its principles naturally apply when organizations deploy (purposefully or otherwise) AI systems affecting business operations.
International consensus standards point in the same direction. ISO/IEC 42001:2023—the first international management-system standard devoted specifically to artificial intelligence—requires organizations adopting the standard to establish governance structures, assign responsibilities, conduct risk assessments, monitor performance, and continually improve AI management systems. ³
Finally, in July 2024, the American Bar Association issued Formal Opinion 512 addressing lawyers’ use of generative AI. The Opinion does not prohibit AI use. Rather, it emphasizes that existing duties of competence, confidentiality, communication, supervisory responsibility, and candor apply when lawyers employ generative AI tools. The Opinion again reflects an important principle: The relevant inquiry is not whether AI may be used. It is whether attorneys understand the capabilities and limitations of the tools they use and whether client confidences remain protected.
These authorities do not impose identical legal obligations. NIST provides voluntary guidance. The DOJ’s Evaluation of Corporate Compliance Programs reflects prosecutorial expectations rather than binding regulations. ISO standards are voluntary consensus standards. But collectively they reveal an important trend. Increasingly, the relevant question is becoming not simply whether organizations use artificial intelligence, but whether they govern it responsibly. So, while organizations often frame AI as an information technology initiative, from a legal perspective AI more closely resembles enterprise risk management.
Consider the following examples:
- An engineer uploads proprietary source code into a public AI platform. The legal issue is protection of trade secrets;
- A marketing department relies upon AI-generated advertising claims that cannot be substantiated. The legal issue is consumer protection and false advertising;
- Human Resources implements AI-assisted résumé screening. The legal issue becomes potential employment discrimination and validation of employment selection procedures;
- A business unit acquires an AI vendor without negotiating appropriate contractual protections regarding confidentiality, data retention, or intellectual property. The legal issues become contract allocation of risk, data governance, and protection of proprietary information.
None of these examples turn primarily upon how one or more of the underlying algorithm functions. Each concerns the organization’s legal obligations. Artificial intelligence merely changes the context in which those obligations arise.
What the Authorities Actually Support
One should be careful not to overstate current law. No federal statute presently requires every company to maintain an AI governance committee. No generally applicable regulation requires every organization to inventory AI systems. Neither the NIST AI RMF nor ISO/IEC 42001 establishes mandatory legal duties for most private entities. Instead, these authorities consistently emphasize broader and more general governance principles:
- Governance should be proportional to organizational risk;
- Responsibilities should be clearly assigned;
- Organizations should understand where AI is used;
- Legal and operational risks should be evaluated before deployment;
- Governance should continue after implementation rather than ending at deployment; and
- Organizations should periodically reassess controls as technology evolves.
Those principles are consistent with developments in corporate compliance and enterprise risk management. They also provide useful benchmarks against which future governance decisions may be evaluated by regulators, insurers, shareholders, or courts.
Why Trial Lawyers View AI Differently
Experienced litigators tend to ask different questions than technologists. Engineers frequently ask whether an AI system functions correctly. Trial lawyers ask what evidence will exist if something goes wrong. In litigation, prior governance decisions and their results often become evidence. Plaintiffs’ counsel are unlikely to limit discovery to the AI output that allegedly caused harm. They are more likely to seek governance policies, board presentations, risk assessments, vendor due diligence, employee training materials, internal audits, approval memoranda, incident reports, and communications concerning AI deployment decisions. Those materials frequently reveal whether an organization identified foreseeable risks before and after implementation. Consequently, AI governance should be viewed not merely as a compliance exercise but as the creation of contemporaneous evidence demonstrating reasonable corporate decision-making. That perspective does not derive from any single AI statute. It stems from decades of corporate litigation, internal investigations, and regulatory enforcement.
With that context, General Counsel should resist viewing AI as simply another software acquisition. Instead, the stronger analytical framework is to treat AI as an enterprise governance issue that intersects with existing obligations involving confidentiality, cybersecurity, employment, intellectual property, commercial contracting, regulatory compliance, and board oversight. That approach is supported not because AI law requires it, but because established principles of corporate governance increasingly evaluate how organizations identify, manage, and document significant enterprise risks before disputes arise.
One Technology, Many Legal Doctrines
As introduced above, AI serves as a common factual circumstance in which numerous, well-established legal doctrines may converge. A single AI-assisted business process may simultaneously implicate contractual obligations, intellectual property rights, attorney-client privilege, employment law, consumer protection statutes, records-retention requirements, discovery obligations, fiduciary duties, and sector-specific regulatory requirements.
For General Counsel, that observation has an important consequence. Organizations should resist assigning AI exclusively to information technology departments. While technical expertise is indispensable, the legal issues presented by AI extend well beyond software implementation. They require coordinated legal judgment across multiple disciplines. Organizations should also consider whether enterprise AI platforms, contractual confidentiality provisions, and internal legal workflows adequately protect privileged information before AI becomes integrated into ordinary legal practice.
At bottom, AI is changing how organizations make decisions. It is not fundamentally changing the legal principles by which those decisions will be judged. Courts will continue to ask whether organizations acted reasonably. Regulators will continue to evaluate compliance programs. Jurors will continue to assess corporate judgment with 20/20 hindsight. Shareholders will continue to question board oversight. And technologies will evolve.
While the playing field might appear different at times, the underlying legal questions are likely to remain surprisingly familiar. For General Counsel, that realization should be reassuring. Organizations do not need to invent an entirely new legal discipline to manage artificial intelligence. They should instead apply the same disciplined principles of governance, documentation, oversight, and risk management that have long guided effective corporate compliance. Organizations that wait for courts or regulators to define “reasonable AI governance” will likely find themselves doing so in the middle of an investigation. Organizations that begin asking those questions today will be far better positioned to answer them tomorrow.
Our next provision turns from that basic legal framework to our first practical question: If AI is an enterprise governance issue, what should a legally defensible governance program actually look like?
Footnotes
1. National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework (AI RMF 1.0) (Jan. 2023), GOVERN Function.
2. U.S. Department of Justice, Criminal Division, Evaluation of Corporate Compliance Programs (updated Sept. 2024).
3. ISO/IEC 42001:2023, Information Technology—Artificial Intelligence—Management System.
Related Attorneys
Counsel
Counsel
