Legal and compliance
Legal and compliance work on the Portfolio, not on individual deals. They define clauses, acceptable use and governance once, at Portfolio level, and these are then used without renegotiation for each deal. Neither function has a direct line to sales, the Centres of Excellence or the customer in day-to-day work.
Why responsibility cannot be passed on
Under GDPR and the EU AI Act, the business delivering the AI service is the data controller and carries the liability for a breach. Vendors will not indemnify it against prosecution or fines. Accountability therefore stays in-house, and legal and compliance have to be set up to carry it.
Legal
Legal manages contracts in both directions.
- With vendors: closing indemnity gaps wherever possible.
- With customers: setting liability limits for harm caused by AI or by data handling, through standard clauses held in the Portfolio and used in proposals and engagement agreements.
Where a vendor will not accept terms that protect the business, legal escalates to the board member who holds AI accountability. See Board.
Compliance
Compliance:
- sets acceptable use boundaries and maintains the list of models and tools permitted under the organisation's AI policy
- writes and maintains the AI governance framework, covering accountability, transparency, human oversight and audit trails, fairness and bias monitoring, privacy by design and harm prevention
- owns incident response, meaning what counts as a breach, the escalation path, notification, investigation and remediation
- confirms that the tools and models chosen by the Centres of Excellence meet regulatory standards
These standards are agreed once and adopted across the business. Teams work within them in the same way they work within the Portfolio.
Disagreements
Where legal and compliance cannot agree on whether a risk is acceptable, the decision goes to the board-level AI owner.
Evidence status
Evaluated against an illustrative scenario. Not yet tested in a live organisation.