Guide · For companies
Hire when a named statute or regulator attaches a clock the general counsel cannot hold. A DPO is a designation, a CPO is an officer, a committee is not a filing. Specialist files in this book: 19 days to shortlist, nine weeks to an accepted offer.
A company should hire privacy or AI-governance counsel when a statute, regulator or customer contract attaches a filing clock the general counsel cannot personally hold. Until then, a GC overlay plus a committee is a legitimate design. IAPP found 39 percent of organisations already have an AI-governance committee; 8 percent were recruiting.
| Trigger | Seat to open | Clock that binds | Source |
|---|---|---|---|
| GDPR Article 37 DPO duty attaches | Designated DPO (may be dual-hat at small controllers) | Independence + highest management | GDPR Art. 37 |
| GDPR Article 33 incident clock has already been missed once | Privacy counsel to the GC, not a policy DPO | 72 hours from awareness | GDPR Art. 33 |
| First US comprehensive state privacy law + product telemetry | Privacy counsel reporting to the GC | State statute + vendor contracts | IAPP / ACC 2026 (privacy 40%) |
| High-risk AI system under EU AI Act Annex III | AI-governance counsel or CPO overlay | Act calendar (see s04) | Regulation (EU) 2024/1689 |
| Board wants an AI inventory; no product AI in production | GC overlay + committee; no specialist seat yet | Committee is not a filing officer | IAPP 2025: 39% have a committee |
| Dual-regulated financial services + model risk | Privacy counsel in Legal; CCO/DPO split as the examiner requires | Sector examiner + ECCP | DOJ ECCP Sept 2024; IAPP 2025 |
| CPO already in post; 69% picked up AI governance as extra duty | Separate AI-governance counsel once volume exceeds overlay | Added duty is not a requisition | IAPP Privacy Governance Report 2024 |
| EU users or establishment + US employment-AI tools | Privacy counsel (US file) plus DPO designation (EU file) | Two clocks, two seats or a dual-domain hire | GDPR + NYC LL 144 / state AI employment rules |
Do not open a CPO search because a competitor did. Open it because one of these triggers is live. A GC overlay is a real design until volume or a statutory designation forces a seat.
Source: GDPR; Regulation (EU) 2024/1689; IAPP AI Governance Profession Report 2025 and Privacy Governance Report 2024; ACC CLO Survey 2026; Sartori specialist-counsel clock (19 days / 9 weeks).
GDPR Article 37 requires a controller to designate a data protection officer where the core activities consist of regular and systematic monitoring of data subjects on a large scale, or of large-scale processing of special categories. The officer must have expert knowledge of data-protection law and practice, must be involved properly and in a timely manner, and must report to the highest management level. The statute does not require a law degree. It does require independence. A general counsel who is also the DPO in a small controller can be lawful; a CISO-DPO or marketing-DPO is the conflict the guidance has been warning about for years.
A chief privacy officer is an officer of the company. IAPP's 2025-26 salary report puts global CPO average base at $280,000. That is an IAPP membership sample, not a US proxy median, and it is not a large-cap GC TOTAL. The CPO owns the privacy programme, the vendor stack, the incident pipeline and, in 69 percent of IAPP's 2024 privacy-governance respondents, AI governance as an added duty. An added duty is not a requisition. When the added duty starts missing clocks, you open an AI-governance counsel search rather than rewriting the CPO title again.
A GC overlay is the most common design IAPP actually measured: 23 percent of AI-governance departments reported to the general counsel or head of legal, the single most common line, ahead of the CEO at 17 percent and the CIO at 14 percent. Primary responsibility sat with legal and compliance at 22 percent, tied with privacy, ahead of IT at 17 percent. That is supervision. It works until the first examination or the first 72-hour clock. Then the overlay becomes the reason you are reading this page.
Regulation (EU) 2024/1689 (the AI Act) was published in the Official Journal on 13 July 2024. The Commission's policy page is the live calendar: prohibitions and AI-literacy obligations from 2 February 2025; general-purpose AI obligations from 2 August 2025; transparency obligations and AI-Office enforcement from 2 August 2026. Annex III high-risk systems in Chapter III run later (the Digital Omnibus on AI, Regulation (EU) 2026/1744, moved the Chapter III high-risk date to 2 December 2027; Annex I embedded systems to 2 August 2028). A company that is a provider or deployer of a high-risk system is not waiting for a strategy offsite. It needs someone who can inventory the system, name the Annex, and hold the documentation.
That someone is not always a new C-suite. For an EU insurer that needed GDPR plus model-risk, the brief in this book was bilingual privacy and AI-governance counsel. Shortlist in 19 days; accepted offer in eight weeks — inside the specialist-counsel clock, not the CCO clock. The EU AI Act liability briefing is the instrument page; this page is the hiring decision.
From the specialist files
Timeline: Shortlist 19 days; accepted offer week 8 (specialist counsel clock).
IAPP's AI Governance Profession Report 2025, published 16 April 2025 from spring 2024 fieldwork, is 671 respondents in 45 countries. Seventy-seven percent were working on AI governance. Thirty-nine percent reported a committee. Eight percent were recruiting. Ninety-eight percent expected to need more people on it in the following twelve months, with an average of 9.8 people to be tasked. Ten respondents, 1.5 percent, said they would need no additional staff. The fall from 77 percent working on it to 8 percent recruiting is the same sample. It is not two studies disagreeing.
The salary companion, IAPP's Salary and Jobs Report 2025-26 (more than 1,600 respondents, March–April 2025, published 3 August 2025), puts average base for AI-governance legal and compliance professionals at $190,000. Dual-domain privacy-plus-AI respondents cleared a median above $169,700; AI-governance-only sat below $151,800. Europe median base for privacy and AI-governance roles is $112,000 (first quartile $74,000, third $138,000). North American medians run above the global figures. Treat IAPP as a membership sample of people already in this community, not as a census of every company.
IAPP also recorded a 26 percent pay premium for its AI governance credential (AIGP) over those with no certification. That is a credential premium inside IAPP's sample, not a licence to practise. The privacy and DPO careers note is written for candidates. This page is the buyer reading of the same instruments.
IAPP's 39 percent committee figure is not a failure rate. For a company whose AI use is internal productivity tools and a vendor list, a committee that meets, inventories, and escalates to the GC is the right spend. Open a seat when the committee starts owning a statutory clock, an examination, or a product claim. The test is whether someone named can sign.
ACC's 2026 survey recorded privacy under majority CLO oversight at 40 percent. That number tells you the GC already has the remit. It does not tell you the GC has the hours. Sixty-three percent of those CLOs expected legal headcount to stay flat. The privacy or AI-governance hire is often a specialist inside a frozen org chart, which is why the brief has to name the instrument. A vague “digital responsibility” requisition is how the 8 percent who are recruiting still fail to hire.
Three instruments, three jobs. IAPP $190,000 average base is the AI-governance legal and compliance population. IAPP global CPO average base $280,000 is the officer population inside that membership. ACC/Empsight median US general counsel base $330,000 (effective 1 March 2025) is the group legal seat. Proxy-disclosed general counsel compensation at the 500 largest US listed companies (SEC DEF 14A filings, 2025 season) is a $3.4 million TOTAL in a different universe and a different component set. Never blend them into a privacy-counsel offer.
Exclusive specialist searches in this book: 22–28 percent of first-year cash, six-month replacement. Interim privacy or AI intercept, where the clock is live and the seat is not yet approved: $1,600–$2,800 a day in the US. The fractional general counsel service holds that row. Conversion to a retained search credits days billed against the later fee.
An EU controller starts from Article 37 and the AI Act calendar. A US-only company starts from state comprehensive privacy laws, sector rules, and employment-AI statutes (New York City Local Law 144 has been in force since 2023; California SB 53 and several state employment-AI rules ran from 1 January 2026). A dual-use company — US employer, EU users — often needs privacy counsel in Legal and a designated officer who can be the same person only if independence is real.
Of 41 compliance and regulatory leadership placements since 2017, DPO and CPO sit in the same family as CCO, MLRO and Head of Sanctions. Do not staff a privacy-counsel search as if it were a CCO search. The CCO clock in this book is 21 days / 10 weeks with a 12-month replacement on a retained mandate. Privacy/AI-governance is specialist counsel: 19 days / 9 weeks, six-month replacement. Compliance recruiting in New York City and in-house recruiting in London are the city doors; the seat still has to be named.
If the open question is the GC seat itself, stop and read what companies look for in a new general counsel. If you are promoting a deputy instead, use promote the deputy or search outside. Privacy overlay on a GC who is about to leave is how companies buy two failed searches.
Hire when a named instrument attaches to this company and the GC cannot hold the clock. GDPR Article 33 is 72 hours; several US employment-AI rules now run on notice clocks measured in days. A committee does not file. See the trigger table in this guide and the EU AI Act liability briefing for the European calendar.
A DPO is a statutory designation under GDPR Article 37; a CPO is an officer seat; a GC overlay is supervision without headcount. Article 37 requires expert knowledge of data-protection law and independence, not a practising certificate. The in-house privacy-counsel seat is a different job: it practises law for the company, reports to the GC, and owns product, vendor and incident files. Chief privacy officer search and AI-governance counsel search are specified as those two seats, not as a dual-hat slogan.
IAPP's 2025 survey of 671 organisations found 8 percent recruiting for AI governance while 98 percent expected to need more people on it. Seventy-seven percent were already working on it; 39 percent reported a committee. That gap is the hiring decision: a seat, a rewritten GC role, or a committee that cannot file. The candidate-side reading of the same data sits at general counsel and AI governance.
Privacy and AI-governance specialist files in our book reach a shortlist in 19 days and an accepted offer in nine weeks. That clock is a subset of 96 senior and specialist in-house counsel placements since 2017, and it sits beside 41 compliance and regulatory leadership placements (CCO, MLRO, Head of Sanctions, DPO/CPO). Exclusive specialist fee 22–28 percent of first-year cash; six-month replacement. how to run a general counsel search carries the same row.
IAPP's 2025-26 salary report puts average base for AI-governance legal and compliance professionals at $190,000. The same report puts global CPO average base at $280,000; dual-domain privacy-plus-AI respondents had a median above $169,700 against below $151,800 for AI governance alone. ACC and Empsight put median US general counsel base at $330,000 as of 1 March 2025 — a different title family, not a substitute. Do not blend those instruments with proxy-disclosed general counsel compensation at the 500 largest US listed companies (SEC DEF 14A filings, 2025 season), a $3.4 million TOTAL.
In the US, start from state privacy statutes and employment-AI rules; in the EU, start from GDPR Article 37 and the AI Act calendar. Article 37 binds controllers whose core activities are regular systematic monitoring or large-scale special-category processing. A US issuer with EU users or an EU establishment still meets that test. US-only product companies more often hire privacy counsel reporting to the GC, then add AI-governance as volume requires. Company hiring and in-house counsel recruiting are the doors into that brief.
IAPP figures are membership samples of privacy and AI-governance professionals, not a census of every company. ACC 2026 measures chief legal officers. Sartori clocks: 19 days / 9 weeks; 41 compliance leadership; 96 specialist counsel; 230+ in-house placements. The $3.4 million figure is proxy-disclosed TOTAL compensation at the 500 largest US listed companies and is not used as a privacy or CPO base.
The officer seat: programme, vendors, incidents, board paper. Not a dual-hat slogan.
Open CPO searchThe specialist seat when the AI Act calendar or a US employment-AI clock is live.
Open AI-governance searchThe instrument page this hiring guide does not duplicate: calendar, liability, documentation.
Read the Act briefingMost organisations expect to need more AI-governance people. Almost none were recruiting.
Privacy and AI-governance search
We run DPO, CPO and AI-governance counsel searches as specialist in-house mandates: 19-day shortlist, nine-week median close, six-month replacement. The conversation stays between us.
