The strong rivalCompliance by classification

Classification is efficient when a legal perimeter is stable. Identify the organisation’s role, whether a use is prohibited or regulated, and the controls and documentation that follow. Add supplier warranties and normal enterprise policies. This creates a defensible baseline and prevents every legal question from becoming a bespoke research project.

The rival fails when ordinary law applies regardless of AI category, the organisation changes role through modification or branding, actual use departs from intended purpose, public claims exceed evidence or supplier records cannot support investigation. Compliance with one AI regime does not extinguish privacy, consumer, employment, intellectual-property, product, professional, contractual, security or corporate-reporting questions.

The allocation graph can fail too. It becomes an encyclopaedia, counsel assumes product ownership, privilege is claimed indiscriminately, or unresolved issues block reversible learning. The map should triage material uncertainty, name qualified counsel and translate advice into disclosure, authority, evidence, contract and remedy controls. It should distinguish a possible theory from a probable claim and both from an adjudicated duty.

Seven role nodesResponsibility follows control, representation and law

Six lifecycle eventsTrace the facts that change exposure

Domain overlayIssue spotting without a global checklist

Allocation is not eliminationContract, evidence and retained duty

Start with credible scenarios rather than clause labels. Who can stop the service, preserve versions, notify the other party, identify affected decisions, support a complaint and fund remediation? A broad warranty has limited value if the enterprise lacks evidence access or the indemnity excludes the likely claim. A high cap may not address an injunctive or regulatory obligation.

Compare audit and evidence rights with incident needs. The contract should address model and component changes, evaluation scope, input and output provenance where relevant, security events, records, cooperation, privilege-sensitive material, notification timing, subcontractors, insurance, transition and deletion. Terms should be operationally testable, not merely available after litigation starts.

Indemnity allocates certain costs between parties subject to wording, facts, law and enforceability. It does not automatically transfer duties owed to a regulator, worker, consumer or other affected person. Insurance has coverage definitions, exclusions, limits, retentions and notification conditions. Record qualified review and remaining exposure instead of representing either mechanism as complete transfer.

Keep counsel ownership specific. Product and business leaders own use, evidence and intervention within advice. Procurement owns negotiation and supplier performance. Legal identifies applicable questions, protects independence and directs qualified analysis. Counsel should not become the operator whose approval substitutes for an unsafe product decision.

The legal edge recordTurn uncertainty into evidence and action

Jurisdiction and status. Record where the provider, deployer, affected person and consequential act are located; which sector and role definitions may apply; the relevant version of enacted text; and effective, application or transposition dates. A directive in force can still require Member State implementation before a particular national rule governs the event. Guidance may be under review. A withdrawn proposal is historical context, not a duty. Date the research and name the local question that qualified counsel must resolve.

Representation chain. Capture what the supplier represented to the enterprise, what sales and product materials said to customers, what managers told workers, and what the organisation disclosed to investors or regulators. Link autonomy, accuracy, safety and performance statements to the evaluated version, population, benchmark and human process. A technically correct sentence can mislead when qualification is removed or actual use exceeds evidence. Correction should reach every channel that repeated the claim.

Role and purpose change. Commercial titles do not settle statutory roles. Version the facts around modification, rebranding, integration, instructions, intended purpose, population and authority. A configuration change may leave one role analysis intact; a substantial modification or new marketed purpose may not. The change trigger should require qualified analysis before normal deployment, while a bounded canary remains possible only when local law, consequence and evidence permit it.

Control and human action. Map who selected the system, set thresholds, supplied context, accepted limitations, made the consequential decision and could intervene. A human signature matters only to the theories for which the facts make it relevant. Examine competence, evidence, time, discretion and foreseeable reliance. Do not describe nominal review as a universal defence, or automated output as breaking a causal chain without analysing actual conduct and applicable law.

Rights and derivatives. Trace disputed data or content into training sets, fine-tunes, embeddings, context stores, caches, outputs and retained evaluations. Deleting the original does not prove that derived forms are lawful, unusable or remediated. Record licence and purpose claims, reservations, confidentiality, provenance, technical deletion capability and unresolved ownership or use questions. Separate the factual lineage from qualified conclusions about infringement, lawful basis, authorship or remedy.

Claim and causation. A possible exposure is not established liability. Record potential claimant, duty or representation, alleged breach, decision path, causation theory, harm, defence, limitation and remedy under the applicable regime. Preserve competing explanations and the quality of evidence. This structure lets counsel prioritise material issues without communicating speculation as fact or treating the existence of an AI component as the cause of every adverse outcome.

Contract and recourse. Put each operational dependency beside the relevant term. If the enterprise must reconstruct decisions within hours, a generic annual audit right is not sufficient evidence access. If supplier notice begins only after confirmed breach, it may arrive too late for a suspected-harm investigation. Compare exclusions, caps, indemnity procedures and insurance conditions with the scenario, then record which operational and legal duties remain regardless of recourse.

Preservation and privilege. Decide promptly which lawyers direct which investigation and for what legal purpose, while recognising that privilege law varies. Preserve ordinary-course records without relabelling everything legal. Coordinate holds with containment so responders do not erase prompts, context, model versions, permissions, approvals or downstream state. Limit access appropriately and retain a usable factual record for correction, regulatory cooperation, defence and organisational learning.

Remedy and affected parties. Remedy design begins before a claim. Identify who can contest a decision, receive an explanation or correction, recover property or data, obtain human review, be notified where required and escalate continuing harm. Contractual reimbursement between firms is not the affected person’s remedy. Test whether the enterprise can identify the population, reverse or correct downstream actions and show why the selected remediation is proportionate to known facts.

Bounded legal uncertainty. Not every unresolved question requires stopping all learning. Narrow purpose, population, data, representations and action authority; require disclosure or consent where counsel determines it applies; preserve evidence; set expiry; and prevent external reliance while a question is resolved. Stop when exposure cannot be bounded, rights or evidence are unavailable, harm is irreversible, or remediation is not credible. The route is a business control based on qualified advice, not the Console issuing a legal conclusion.

Evidence completeness. Check whether the record covers every material version, population and downstream action rather than a convenient sample. Supplier reports may omit prompts, context, tool state or subcontractors. Enterprise logs may show a recommendation without the manager’s reason or customer communication. Mark each gap and its consequence for investigation. Absence of evidence can limit a conclusion without proving either compliance or breach.

Evidence integrity. Define ordinary records, access controls, timestamps, retention and export before dispute. Preserve original data and document transformations used for analysis. A screenshot may communicate an event while being insufficient to reconstruct it. Where privacy, confidentiality or privilege constrain access, create governed review routes rather than deleting information or circulating it broadly. Qualified counsel should decide what is necessary for the matter.

Representation consistency. Compare supplier documentation, product interfaces, internal approvals, sales proposals, customer instructions, investor statements and regulator communications. The same term may mean different things across audiences. If marketing says “autonomous” while controls require substantive human review, correct the claim and test whether prior recipients relied on it. Versioned substantiation should follow the statement through every channel.

Foreseeable use. Record actual behaviour, support requests, repeated workarounds, interface defaults and prior exceptions. Contract restrictions matter but may not describe how a product is predictably used. A foreseeable pattern can require new instructions, controls or a narrower boundary, depending on qualified analysis. It does not by itself establish liability, so keep operational evidence separate from the legal conclusion.

Causation record. Preserve alternative explanations, human reasons, independent data, timing and later interventions. Ask how the outcome would plausibly have differed without the disputed representation, output or action. In cumulative systems, several small recommendations may combine with policy or demand. A useful record allows competing theories to be tested rather than treating the presence of AI as proof of cause.

Correction scope. Determine whether an issue affects one output, a version, a population, a representation, retained derivatives or the entire use. Correct the smallest boundary supported by evidence while preventing continuing harm. Notify customers, workers, rightsholders, regulators or other parties only after applicable duties and facts are analysed, but prepare contact, trace and remedy capability so delay is not caused by missing operations.

Legal-change control. Maintain enacted-text, guidance, enforcement and national-transposition sources with dates and owners. A regulatory headline is not a change assessment. Identify which role, product, jurisdiction and event are affected; update contracts and controls; and preserve the old basis for decisions already made. Planned or withdrawn instruments may inform horizon scanning but should never be labelled as current obligation.

Decision receipt. Record the route selected, material facts, applicable questions, evidence strength, contractual position, affected parties, safeguards, unresolved issues, counsel owner and expiry. The receipt shows why a reasonable operating boundary was chosen under uncertainty. It should not contain unnecessary privileged advice or imply that a business route is a court’s conclusion. Review it when facts, law or consequence change.

Employment screening. Link supplier evaluation to the employer’s actual population, criteria, recruiter use, adverse decision, notice, accommodation, challenge and record. Contractual recourse remains a separate edge. If a material pattern appears, contain the consequential route and preserve comparable decisions while qualified employment and data-protection analysis determines scope, causation, communication and remedy.

Generated publication. Preserve input sources, licence claims, model and tool versions, editing history, human contributions, provenance checks and publication decision. These facts may support several distinct questions about rights, authorship, confidentiality, representation and contract. They do not guarantee ownership or non-infringement. Restrict release when the record cannot support the intended use and obtain qualified jurisdiction-specific advice.

Professional reliance. Define what the professional must independently establish, which evidence the assistant supplies, known limitations, time for review and the communication made to the client or patient. Monitor whether workload turns judgement into routine acceptance. When sign-off is nominal, change workflow and claims rather than presenting the signature as a complete safeguard.

Board visibility. Aggregate material role changes, public claim gaps, unresolved source rights, consequential uses with weak evidence, contract exposure above caps, incidents and remedy readiness. Preserve domain and jurisdiction differences rather than ranking them with one score. The board should see which decisions require capital, narrower scope, disclosure, supplier leverage or withdrawal, and which questions remain with qualified counsel.

Close the edge. An issue is not closed because advice was delivered. Confirm that the product control, representation, contract, record, complaint route or remedy changed; identify residual uncertainty; and set revalidation. If the business accepts an exception, record the authorised decision, affected boundary and expiry. Legal work becomes operational when the evidence and intervention can be demonstrated in production, not when a memorandum has been filed. The factual chain remains reviewable after responsible staff and suppliers change.

Negative controlsCases that expose allocation gaps

Interactive instrumentGeneral Counsel AI Liability Map Console

The Console routes a material use to evidence and counsel action. It does not provide a legal conclusion or a liability, compliance or maturity score.

The General Counsel operating agendaMake responsibility and evidence executable

Start with material decisions, actions and representations. Build the seven-node graph around actual parties and jurisdictions, then trace each lifecycle event. Record who controls purpose, population, authority, evidence, intervention and remedy. Update the map when modification, branding, supplier, use or law changes.

Create a small legal edge record linked to the operating system: jurisdiction, potential domain, representation or duty, control, evidence, contract term, allocation, unresolved issue, counsel owner, review date and change trigger. Use qualified analysis proportionate to consequence and reversibility. Do not turn every open question into a stop when a bounded, disclosed and evidenced route exists.

Review external statements against evidence. Product descriptions, customer proposals, investor communications and regulatory submissions should use consistent versioned substantiation. Correct unsupported autonomy, accuracy, safety or performance claims before they become the factual foundation of a contract, enforcement action or claimant theory.

Align contracts with intervention. Ensure material suppliers can provide timely change notice, evidence, preservation, cooperation, remedy and exit support. Compare caps and insurance with credible scenarios while recording duties and costs that remain. Test the route during an exercise, not for the first time after harm.

Coordinate incidents deliberately. Stop continuing harm, preserve the factual record, decide privilege and holds, reconstruct affected decisions, analyse notification and give affected parties an effective correction or remedy route. Overbroad privilege can obstruct operations and learning; absent direction can destroy evidence. Assign qualified counsel and record the basis.

Report uncertainty without false certainty. Boards need material role changes, unsupported representations, unresolved rights, supplier evidence gaps, exposure above allocation, incidents, remedy readiness and jurisdictional change. They do not need one liability score. The legal map adds value when business teams can act on it and affected people are not erased by the contract chain.