In this EU AI Act Forum session, Moderators Professor Andrej Savin, Professor at Copenhagen Business School (CBS), and Sid Ali Boutellis, Co-Founder of Expanse, examined a practical legal and risk perspective on the discussion, particularly around AI adoption, cybersecurity, insurance, and the challenges facing law firms. Together, their discussion focused on moving beyond traditional compliance thinking towards a practical approach to managing AI risk, uncertainty and accountability.

Overview

The discussion highlighted the shift from traditional box-ticking compliance to risk-based regulation. Savin explained that AI compliance is particularly complex because it involves models, systems, products and supply chains. He also distinguished between risk and uncertainty: while risk can often be measured, AI presents unknowns that organisations cannot reliably predict.

For organisations building a compliance framework, the speakers emphasised starting with the EU AI Act: identify prohibited uses, understand the relevant category and establish the minimum requirements. Organisations should also know what AI tools are being used across the business and determine what residual risk they are prepared to accept rather than waiting for regulation to become completely settled.

The session also explored third-party AI tools, insurance and accountability. Contractual protections can help but cannot eliminate uncertainty. Boutellis highlighted the importance of due diligence, monitoring and human oversight, particularly within law firms. Both speakers stressed that effective AI governance ultimately depends on clear accountability and strong AI literacy across the organisation.

Key Takeaways

• Treat AI compliance as an ongoing governance issue, not a box-ticking exercise. Models, systems, suppliers and use cases all require consideration.
• Distinguish risk from uncertainty. AI outcomes may be too unpredictable to assign reliable probabilities using conventional risk models.
• Start with the legal baseline. Identify prohibited uses, understand how the AI system is classified, and establish the minimum obligations that follow.
• Know what AI your organisation is using. Maintain an inventory of tools, models, suppliers and use cases before building a wider governance framework.
• Manage rather than assume you can transfer risk. Contracts, monitoring, due diligence and cooperation with providers all have a role where complete indemnification is unrealistic.
• Build AI literacy alongside human oversight. Partners and junior lawyers may need different training, but both need a shared understanding of AI’s limitations, risks, and appropriate use.