General counsel and AI governance: a new career frontier.

IAPP’s 2025 survey asked where primary responsibility for AI governance sits. Privacy and legal and compliance tied at 22% each, ahead of IT at 17%, data governance at 10%, ethics and compliance at 6% and security at 5%. Half of AI-governance professionals in that sample were assigned to ethics, compliance, privacy or legal teams. On reporting lines, most AI-governance departments reported to the general counsel or head of legal at 23%, ahead of the CEO at 17% and the CIO at 14%. Read those two findings together and the picture is unambiguous: legal is already the supervising function in more organizations than any other, without having been given a headcount to supervise.

The load lands hardest one desk over. IAPP’s Privacy Governance Report 2024, last updated on 12 November 2024, found that more than 80% of privacy professionals had been given an additional responsibility alongside the existing day job, and that among chief privacy officers 69% had acquired additional responsibility for AI governance specifically — the same share that had picked up data governance and ethics. At team level, 55% of privacy professionals worked in functions carrying AI-governance responsibilities. IAPP also recorded, in the forward-looking cut of its 2025 survey, that the functions expecting additional AI-governance responsibility were privacy at 57%, legal at 55% and information technology at 53%. Everybody is picking up more. Nobody is being given a person.

This is not new pressure on an otherwise clear desk. ACC’s 2025 Chief Legal Officers Survey, taken from 772 CLOs across 48 countries and published on 31 January 2025, found 70% already managing at least two additional areas such as risk, compliance, privacy and ethics, and recorded AI regulatory enforcement as a significant focus for 26% of larger-company respondents. Thomson Reuters Institute’s 2025 State of the Corporate Law Department report, drawn from more than 2,400 interviews with corporate general counsel, coded the rise of AI and generative AI as high-impact or transformational for 74% of them — the highest-scoring macro influence in the study, ahead of recession, skilled-labor shortage and geopolitical instability.

And then the admission. Deloitte’s 2024 Chief Legal Officer Strategy Survey, fielded to 460 legal executives between 11 November and 18 December 2023, found 95% reporting that their organizations had already engaged with generative AI at some level, 27% believing the organization had the skills to execute on it, and 15% believing the roles, responsibilities and accountabilities for those initiatives were clearly defined. That 15% is the sentence to take to a board. Engagement is universal. Ownership is not defined in six organizations out of seven, on the account of the legal executives themselves.

Sartori’s quarterly in-house survey, running since 2019, put a narrower version of the same question to 96 New York legal departments in its second-quarter 2026 wave: who signs off before an AI system reaches a customer or a candidate. Forty-one of the 96 named no one. Twenty-nine named the general counsel personally. The remainder split between a committee, the chief information security officer and the business owner of the system. The commonest answer in a market that has spent three years discussing AI governance is still an unfilled blank.

New York City has had an operating rule on automated hiring since before most companies wrote their first AI policy. Local Law 144 of 2021, enacted on 11 December 2021 and effective 1 January 2023, makes it unlawful to use an automated employment decision tool to screen candidates or employees for hire or promotion in the City unless a bias audit by an independent auditor was completed no more than a year earlier and a summary of results is published on the employer’s website, with notice to city candidates at least ten business days before use. The Department of Consumer and Worker Protection began enforcing the law and its rule on 5 July 2023. Civil penalties run to $500 for a first violation and $500 to $1,500 for each subsequent one, with each day of use a separate violation.

Low enforcement has been widely misread as low exposure. The New York State Comptroller’s audit 2024-N-6, issued on 2 December 2025 and covering July 2023 to June 2025, found that the Department had received only two complaints about automated employment decision tools in two years, had not tested whether its complaint intake worked, and had flagged a single issue across a review of 32 company websites and bias audits where the Comptroller’s own review of the same 32 found at least 17 instances of potential non-compliance. That is a finding about detection, not about coverage. A general counsel who staffed this statute as a one-off memo in 2023 is exposed to an enforcement function that has now been told, on the record, to stop waiting for complaints.

The insurance regulator went further and named the board. New York’s Department of Financial Services issued Insurance Circular Letter No. 7 on 11 July 2024, applying to all insurers authorized in the State along with Article 43 corporations, health maintenance organizations, fraternal benefit societies and the State Insurance Fund. It expects fairness and proxy analysis, actuarial validity, a corporate governance framework for the overall outcomes of using artificial intelligence systems and external consumer data in underwriting and pricing, transparency, risk management, internal controls and third-party vendor oversight — and it states that senior management and the board are responsible for overall outcomes, with examination available under Insurance Law sections 308 and 309. Buying the model from a vendor does not move the responsibility.

Then December 2025 and January 2026 arrived together. New York’s RAISE Act was signed on 19 December 2025, requiring large developers to publish safety-protocol information and to report incidents to the State within 72 hours of determining that one occurred, with a new oversight office inside the Department of Financial Services and penalties of up to $1 million for a first violation and up to $3 million for subsequent ones. California’s Transparency in Frontier Artificial Intelligence Act, approved on 29 September 2025 and in force from 1 January 2026, requires a large frontier developer to publish and annually update a frontier AI framework, publish a transparency report at deployment, and report critical safety incidents to the Office of Emergency Services within 15 days, or 24 hours where there is imminent risk of death or serious physical injury, with civil penalties up to $1 million. Texas’s Responsible Artificial Intelligence Governance Act and Illinois House Bill 3773 both took effect on 1 January 2026, on two different standards: Texas addresses intent to discriminate through employment AI, while Illinois amends its Human Rights Act to cover discrimination flowing from AI and to require notice to employees and applicants. Connecticut’s Public Act 26-15 adds a disclosure duty from 1 October 2026 where AI contributed to a mass layoff.

Federal policy moved twice in the other direction without removing any of that. Executive Order 14110 of 30 October 2023 was revoked on 20 January 2025 and replaced three days later by Executive Order 14179; Executive Order 14365, signed 11 December 2025, directs the Attorney General to stand up an AI Litigation Task Force to challenge state AI laws and carves child safety, compute infrastructure and state procurement out of the contemplated preemption. Its companion fact sheet records that state legislatures have introduced over 1,000 different AI bills. For the federal government’s own use of AI, OMB Memorandum M-25-21 of 3 April 2025 requires agencies to designate a Chief AI Officer within 60 days and to convene a governance board within 90, with legal counsel a required member of that board rather than its named owner — which is precisely the org chart private-sector buyers keep copying without reading. Colorado is the cautionary case: its comprehensive AI Act was signed on 17 May 2024, never operated, and was repealed and replaced on 14 May 2026 by a narrower automated-decision statute dated 1 January 2027. Companies that staffed a program against the first statute rebuilt it against the second.

Enforcement under general law never paused for any of this. The Federal Trade Commission’s 19 December 2023 order against a national pharmacy chain banned facial-recognition surveillance for five years and imposed algorithmic and image deletion, a comprehensive information-security program, independent third-party assessments and an annual certification from the chief executive. The Securities and Exchange Commission settled its first AI-washing cases on 18 March 2024 with civil penalties of $225,000 and $175,000 against two investment advisers, and its enforcement director extended the warning to public issuers making claims about AI adoption. The Commission’s Operation AI Comply sweep of 25 September 2024 brought five actions, including a proposed order with $193,000 in monetary relief against a service marketed as the world’s first robot lawyer. In the Northern District of California, the screening-tool litigation in Mobley v. Workday produced a July 2024 ruling allowing an agent theory against the vendor, a May 2025 preliminary certification of a nationwide collective, a 6 March 2026 ruling that age-discrimination disparate-impact protections can reach applicants, and a 22 June 2026 ruling that California’s fair-employment statute may reach tools designed and operated from California even for jobs located elsewhere. For scope beyond the United States, Regulation (EU) 2024/1689 — the EU AI Act — entered into force on 1 August 2024 and became applicable on 2 August 2026, which for a New York company is a question about where its product and its users are, and whose desk answers it.

Across the trailing three years, Sartori’s New York in-house desk closed 24 searches, with a 93% completion rate, a typical timeline of four to seven months, counter-offer incidence of 28% and a median of 16 working days between offer and signature. Of those 24 closed searches, 7 carried an explicit AI-governance scope in the mandate document — not as the whole job, but as a named component of it. Four of the 7 closed inside the four-to-seven-month band. Three did not, and in all three cases the reason was the same: the job description was rewritten after the search had started, once to add product counsel duties, once to remove the requirement for bar admission, and once to move the reporting line from the general counsel to a newly created technology function. Every one of those delays was manufactured internally, before a candidate was ever involved.

The interview cohort says why. Across 1,675 structured interviews with New York in-house lawyers, the 388 respondents whose organizations were running AI in customer-facing production over a 24-month window split as follows: 214 said the AI remit had been added to an existing job description with no budget line attached to it; 121 said their organization had a written AI policy and no named owner for it; and 39 said a dedicated requisition had been opened or was planned. A separate cut of the same cohort — the 84 respondents who were the only lawyer in the department or one of fewer than five — produced the starkest answer: 71 of the 84 said the AI file sits with them personally, alongside contracts, employment and everything else.

Two conversations from that cohort are worth reporting as they were put to us. A general counsel at a mid-cap medical-device manufacturer said her AI file had no line in the departmental budget, and that this, rather than any question of law, was the reason she had not yet hired: she could not ask for a person for a responsibility that had never been costed. The head of legal at a private, sponsor-backed benefits administrator described three rewrites of the same requisition over five months, and observed that each rewrite was a proxy for an unresolved argument between legal, security and the product organization about who was allowed to say no.

There is one thing this desk cannot see, and it matters for how the numbers above should be read. Sartori maps roughly 67,000 lawyers in New York. That map carries firm, seat, practice and movement history; it does not carry a governance flag. There is no reliable way to look at a title and know whether the lawyer behind it already owns an AI file, because in most companies that ownership has never been written down anywhere a map could read. The counts on this page are therefore counts of what buyers and candidates told us, and of mandates we ran — not a census of a population nobody has yet defined.

The quarterly in-house survey adds the operating detail. In its second-quarter 2026 wave, 96 New York legal departments were asked who signs off before an AI system reaches a customer or a candidate: 41 named no one, 29 named the general counsel personally, and the remainder split across a committee, the chief information security officer and the business owner of the system. Companies in that wave that had already been through a regulatory examination or a customer incident were markedly more likely to name a person — which is the most expensive way to arrive at an org chart.