In this EU AI Act Forum session, Moderators Professor Andrej Savin, Professor at Copenhagen Business School (CBS), and Sid Ali Boutellis, Co-Founder of Expanse, Sid Ali Boutellis, a freelance legal technology professional with over ten years’ experience and newly acquired legal credentials, and Alexander Deicke, Legal Interim Manager at K11 Consulting GmbH. Savin, who has written extensively on bespoke AI compliance, supplied the regulatory framework. Deicke offered a view on internal and external compliance resourcing, and Boutellis drew on his work with US law firms.
Overview
Savin argued that checklist compliance fails because the AI Act is risk-based and forces organisations to decide which risks they can accept. Compliance should therefore be managed as part of firm and product strategy, not applied as a downstream filter. He compared an off-the-shelf programme with a tailored suit: it costs more and takes more fittings, but it fits properly. Many firms, especially smaller ones, are undecided about investing, since both AI and compliance breaches are expensive.
The central idea was that the Act classifies risk by use, not by technology, so one model can be high risk in one setting and minimal risk in another. A generic programme will therefore over-comply and under-comply at once. Savin’s first step is a simple spreadsheet of current uses, sorted by risk, which needs no in-house counsel. Deicke added that, unlike the GDPR, the Act affects the whole organisation, and that shadow language models resemble the familiar problem of shadow IT. Boutellis contrasted the patent teams of two large US firms using the same tools.
A bigger team passes output through many hands, while a smaller team may rely on one responsible lawyer, so their risk profiles differ. Deicke warned that compliance problems surface years later, and that lawyers who skip the research and drafting remember less about a matter when problems emerge.
On practical implications, Savin said day-to-day compliance should stay in-house, with outside counsel for specialist knowledge and validation, and with board-level ownership. He cited Boeing and Volkswagen as warnings and suggested the general counsel is best placed to coordinate DPOs, CIOs and compliance officers. Deicke saw a role for an external regulatory function, like an external DPO, but not without an internal lead. Boutellis called prohibiting junior lawyers from using AI a mistake and urged firms to give them a safe space to build tools. Important limits remain. Vendors rarely accept responsibility, and Savin said the product liability and contractual answers are unresolved. He also thought the AI Act was not written with legal privilege and confidentiality in mind.
Key Takeaways
- Start with an inventory. A basic spreadsheet of AI uses, graded by risk, is achievable now and shows where effort is needed.
- Assess risk by use, not by tool. Classify each deployment in its context, because the same model can carry very different obligations.
- Keep ownership in-house. Outside advisers can build and validate a programme, but someone internal must run it and find the shadow tools.
- Make accountability a board matter. Savin favours the general counsel as coordinator, and AI committees need real authority to intervene.
- Plan for delayed consequences. Deicke advised that law firms should review matter management, keep evidence, and have experienced people regularly check AI output, possibly alongside a second model.
- Do not assume vendors will carry the risk. Savin said suppliers rarely give indemnities, so firms should keep the human checks and responsibility themselves
