EU AI Act for General Counsel.

Why the Act creates new legal exposure

The EU AI Act represents a fundamental shift in how organizations must approach AI deployment. For General Counsel, three aspects create particularly significant legal exposure:

Behavioural obligations, not just data rules

GDPR focused on how organizations handle data. The AI Act focuses on how AI systems behave and make decisions. This means legal liability now extends to algorithmic outputs, model accuracy, bias in automated decisions, and the effectiveness of human oversight mechanisms. These are areas where legal teams historically had limited visibility.

Expanded definition of “provider”

Under Article 3, organizations that substantially modify AI systems or put their name on AI products may become “providers,” assuming full compliance obligations including conformity assessment. A company that integrates a third-party AI model into a high-risk use case (employment screening, credit decisions) may inherit provider-level liability regardless of who built the underlying model.

The withdrawn AI Liability Directive proposal

The Commission’s 2022 proposal for an AI Liability Directive included evidence-disclosure and rebuttable-presumption mechanisms. The Commission withdrew procedure 2022/0303(COD) on 6 October 2025. It is therefore historical context, not current EU law. Existing national liability and procedural law, the revised Product Liability Directive where applicable, and sector-specific regimes still require jurisdiction-specific analysis.

Key General Counsel responsibilities under the Act

Liability assessment and risk allocation

General Counsel must map AI systems across the organization and classify them according to the Act’s risk taxonomy. For each high-risk system, liability must be clearly allocated between internal teams, vendors, and partners. Key questions include:

• Who bears liability for model performance and accuracy?
• How is responsibility allocated when multiple parties contribute to a system?
• What insurance coverage exists for AI-specific liability?
• Are indemnification provisions adequate for regulatory penalties?

Contractual obligations

Vendor agreements require immediate review. Contracts with AI providers must address:

• Clear allocation of provider vs. deployer obligations
• Representations regarding risk classification and conformity status
• Audit rights for compliance verification
• Incident notification aligned with Article 73 (generally no later than 15 days, with shorter deadlines in specified cases)
• Indemnification for regulatory penalties from vendor non-compliance
• Data governance warranties per Article 10
• Documentation delivery for downstream compliance

Customer terms must be updated to include appropriate AI disclosures, particularly for systems requiring transparency under Article 50 (chatbots, emotion recognition, deepfakes).

Regulatory-engagement strategy

The AI Act establishes national competent authorities in each member state, coordinated by the EU AI Office. General Counsel should develop relationships with relevant authorities before enforcement actions arise. Consider:

• Identifying which member state authorities have jurisdiction
• Monitoring regulatory guidance and codes of practice
• Participating in regulatory sandboxes where available
• Preparing for potential market surveillance activities

Evidence-preservation requirements

Article 12 requires high-risk AI systems to support automatic event logging appropriate to intended purpose, including events relevant to risk identification and post-market monitoring. Legal and technical teams should consider:

• Logging systems capture decision-relevant data
• Retention periods meet regulatory requirements
• Legal hold procedures extend to AI system logs
• Chain of custody protocols exist for algorithmic evidence

Documentation and disclosure obligations

Article 11 mandates comprehensive technical documentation before high-risk systems enter the market. Article 13 requires transparency for users. General Counsel oversight ensures documentation is legally sound and disclosures don’t create unintended liability exposure.

Questions General Counsel should be asking the organization

Red flags indicating legal and compliance gaps

Personal-liability considerations

While the EU AI Act primarily imposes organizational penalties, General Counsel should be aware of pathways to personal liability:

Member State Implementation

Individual member states may implement the AI Act in ways that create personal liability for directors or officers. Monitor transposition legislation in key jurisdictions where the organization operates.

Civil Litigation

When AI systems cause harm, affected parties may pursue civil claims under applicable national and EU law. The withdrawn AI Liability Directive proposal does not create a current burden-shifting rule; exposure and evidentiary standards depend on the cause of action, jurisdiction, and facts.

Fiduciary Duties

Depending on the jurisdiction, organization, and materiality, existing oversight duties may require a board to address material AI risk. Whether a failure breaches a fiduciary duty requires jurisdiction- and fact-specific legal analysis.

Regulatory Action Against Individuals

The EU AI Act primarily assigns obligations and penalties to operators. Any individual liability or regulator action depends on applicable national law, the person’s role, the conduct, and the facts; do not infer it from the AI Act alone.

The Colorado intersection: SB 26-189 and ADMT transparency

US organizations subject to the EU AI Act often track Colorado as the leading US state regime. That regime changed materially in May 2026. The 2024 Colorado AI Act (SB 24-205) was repealed and replaced before it ever took effect by SB 26-189, titled “Automated Decision-Making Technology,” signed by Governor Polis on May 14, 2026. Substantive compliance commences January 1, 2027; the duties are not yet enforceable. The earlier “June 30, 2026” effective date is no longer operative.

From high-risk AI systems to covered ADMT

SB 26-189 drops the “high-risk artificial intelligence system” category and the reasonable-care framework around it. It instead regulates covered automated decision-making technology (ADMT), defined as technology that processes personal data to generate outputs (predictions, recommendations, classifications, rankings, scores) used to materially influence a consequential decision in domains such as education, employment, housing, financial or lending services, insurance, health-care services, and essential government services. “Materially influence” replaces SB 24-205’s “substantial factor” with a non-de-minimis-factor test; incidental or clerical uses are excluded. The Colorado Attorney General must adopt clarifying rules by January 1, 2027.

What the new regime requires. What it dropped.

The replacement is a narrower transparency-and-disclosure framework. Deployer duties are: clear-and-conspicuous pre-use notice before a covered ADMT materially influences a consequential decision; plain-language disclosure within 30 days of an adverse outcome describing the ADMT’s role and the consumer’s rights; data-correction access on request; and meaningful human review on request, to the extent commercially reasonable. Developers must supply deployers with documentation on intended uses, known limitations, and instructions for monitoring and human review, with records retained at least three years.

Several SB 24-205 obligations did not survive: the duty of reasonable care to prevent algorithmic discrimination is gone (discrimination is now handled under existing Colorado anti-discrimination law); mandatory risk-management programs and annual impact assessments are eliminated; the NIST AI RMF / ISO 42001 rebuttable-presumption safe harbor was removed with no comparable replacement; there is no size-based (fewer-than-50-employee) exemption; and the standalone “you are interacting with an AI system” chatbot disclosure does not survive. Only the consequential-decision pre-use notice remains. Enforcement is exclusively by the Colorado Attorney General, with a 60-day notice-and-cure period (sunsetting January 1, 2030) and no private right of action.

Implications for EU AI Act compliance

For organizations operating under both regimes, the same evidence foundation does double duty. SB 26-189 leans on pre-use notice, post-adverse-outcome disclosure, developer documentation, and at-least-three-year recordkeeping. That is exactly the kind of contemporaneous, retained record the EU AI Act’s logging requirements (Article 12) and post-market monitoring obligations (Article 72) already contemplate. Following NIST AI RMF or ISO 42001 is no longer a codified Colorado defense, but remains sound practice and maps cleanly to EU technical-documentation expectations.

Evidence standards for regulatory defense

When regulators investigate or litigation arises, evidence quality determines outcomes. General Counsel must understand what constitutes defensible evidence under AI regulations:

Contemporaneous Documentation

Contemporaneous records can reduce reliance on after-the-fact reconstruction. A timestamped event can show what a configured system recorded at a moment in time; it does not alone establish the completeness or effectiveness of the surrounding control environment.

Tamper-Evident Records

Integrity measures can make later modification detectable. Cryptographic signatures are one optional design choice, not an Article 12 mandate, and their evidentiary value depends on key custody, field selection, integration coverage and verification procedures.

Mapping to Regulatory Requirements

Evidence must clearly correspond to specific regulatory obligations. General documentation about “AI governance” is less valuable than evidence specifically demonstrating Article 9 risk management, Article 10 data governance, or Article 14 human oversight.

The “Proof Gap” Problem

Many organizations have a “proof gap” between controls described on paper and inspectable evidence from operation. Policy documents record intent; scoped operational records can make selected claims from configured control paths easier to verify. Neither artifact alone proves that a control was well designed, effective, or legally sufficient.

Working with other stakeholders

Chief Information Security Officer (CISO)

Coordinate on: logging infrastructure, data security for AI systems, cybersecurity requirements under Article 15, incident detection and response, vulnerability management for AI-specific threats.

Chief Compliance Officer (CCO)

Coordinate on: compliance program design, regulatory mapping, training and awareness, audit schedules, remediation tracking, policy development.

Business Unit Leaders

Coordinate on: AI use case identification, risk classification input, operational implementation of controls, human oversight execution, incident escalation protocols.

Data Protection Officer (DPO)

Coordinate on: GDPR/AI Act intersection, data governance under Article 10, privacy impact assessments, cross-border data considerations, subject access requests involving AI.

Board reporting on AI risk

General Counsel should ensure the board receives regular, substantive reporting on AI-related legal exposure:

Litigation-readiness checklist

How GLACIS provides defensible evidence

GLACIS addresses the core challenge General Counsel face: producing evidence that AI controls actually operate, not just documentation that they should.

Frequently asked questions

References