AI Governance, Product Counseling & the Contracts That Follow

AI governance is the practice of mapping the laws and risks that apply to a specific AI use case and building a workable approach across your product, engineering, and legal teams. "Compliance" tends to mean a checklist against a single named law. Governance is broader: it asks what your product actually does—what it scores, ranks, filters, or generates—and then evaluates every law that touches that conduct, new and old. Done right, it is practical, not performative.

Both—and the existing ones are often the bigger exposure. We call them legacy laws: statutes that predate AI by decades, with a developed body of case law, that apply directly to what your product does. In Mobley v. Workday, an AI hiring tool was sued under the Age Discrimination in Employment Act of 1967, not under any AI-specific statute; the Court certified a class. If your product scores, ranks, or filters people, a legacy anti-discrimination statute may apply—the ADEA for age in hiring, the Fair Housing Act for housing, the Equal Credit Opportunity Act for credit—alongside privacy laws like BIPA, GLBA, and COPPA, before you ever reach the headline AI regulations.

Start by treating your data as more than one thing. In a generative-AI deal, your content can appear as input, output, training data, synthetic data, and observation data—and the vendor often wants a license to all of it. So scrutinize three things. First, the license to your inputs and prompts: you should retain ownership, and a license for the vendor to host and process your content is fine if it is bounded to operating the service and under your control—but a perpetual, transferable, sublicensable license to "fully exploit" your content to train the vendor's models, even after termination, is not. Second, data retention: the vendor should delete or return your data after termination, and watch the word "aggregated," which is not the same as "de-identified" or "anonymized." Third, third-party sharing—error reports and "report a problem" buttons quietly route your prompts to third parties, even on enterprise plans. Beyond the vendor's terms, your own customer contracts make reps and warranties about your tool and may indemnify customers against third-party suits like Mobley—so the contract has to follow from your real risk taxonomy, not a template. We cover this provision-by-provision in the AI Contracting Playbook.

Ask one question of every AI agreement: who is acting? A SaaS contract assumes the software runs and a human acts, so it measures uptime and SLAs. A generative-AI product produces and a human reviews—so the contract has to address data licensing and variance. An agent acts and a human supervises; agentic AI pursues its own goals. As you move up that spectrum, three provisions have to be rewritten rather than expanded: limitation of liability, indemnification (keyed to "misuse," not "use"), and a defined scope of authorized actions—plus audit rights and logging that survive an incident. The Model Context Protocol adds scope, supply-chain, and prompt-injection risk to manage. Our 2026 Playbook covers each with model language.

Generally, no—not the raw output alone. U.S. copyright law requires human authorship: a person must be responsible for the creative expression. The U.S. Copyright Office has refused or limited registration for purely AI-generated works (see Zarya of the Dawn and the Théâtre D'opéra Spatial decisions), and the courts have agreed (Thaler v. Perlmutter). Where a human meaningfully selects, arranges, or modifies AI-generated material, some protection may attach to those human contributions. We walk clients through where the line sits for their specific workflow.

It depends, and the law is unsettled. In Bartz v. Anthropic and Kadrey v. Meta, judges in the Northern District of California found certain training uses "transformative" and therefore fair use—but those rulings are narrow, and Bartz drew a hard line at the pirated libraries the defendant downloaded and retained. Anthropic later agreed to a proposed $1.5 billion settlement over those works. Training on data you do not have rights to is a live litigation risk; we help you assess provenance, licensing, and the safeguards to put in place before deployment.

It can. The EU AI Act reaches providers and deployers placing AI systems on the EU market, regardless of where the company sits. Obligations for general-purpose AI models carried a compliance deadline of August 2, 2025, covering transparency, technical documentation, and copyright requirements such as publishing a training-content summary. If you sell into or deploy in the EU, we assess which obligations attach and on what timeline.

The work overlaps; the structure differs. This practice covers discrete, project-based AI governance, product counseling, and contracting engagements. Our Fractional GC program embeds that same support on a predictable monthly plan, so legal becomes a continuous strategic lever rather than a one-off memo. If you are not sure which fits, the fit call will tell you.

Book a 20-minute fit call or e-mail info@ambartlaw.com. We will learn about your company, your use cases, and your governance needs, and then recommend a plan to move forward—or tell you if we are not the right fit.