AI governance and liability counsel under the EU AI Act.

The same job title buys two different seats. In the European Union, Regulation (EU) 2024/1689 hands a company a dated compliance calendar, named operator duties, a conformity route for high-risk systems, and a market-surveillance authority that will one day ask for the technical file. A US group facing the same technology answers a patchwork of state statutes and enforcement discretion. This page does not unpack that stack. It stays with the European statutory seat a chief legal officer actually has to staff.

We have worked the Brussels in-house market for five years, for corporate legal departments that deploy or place AI systems on the Union market. Over the last three years that desk closed fifteen in-house searches at a 93 percent completion rate, on a typical timeline of four to seven months. The work is classification, documentation, authority interface and product-liability intake — not a generic emerging-tech hiring story, which another page already owns.

Sartori’s Brussels interview cohort shows that 61 of 74 respondents sitting as general counsel, chief legal officer or head of legal at a Union deployer or provider over a 24-month window said the first enforceable file was a prohibition or HR-tool review, not an Annex III conformity pack. The same 74-person segment is the base for a second read: 48 of those 74 could not name the Belgian market-surveillance authority they would hand a technical file to. That is not a knowledge-quiz score. It is what an unfinished designation looks like from inside a legal department.

A general counsel at a Brussels-based industrial deployer, speaking inside that 24-month window, put the mistake in one line: the Digital Omnibus had been read internally as a stay, and the workplace scoring tool was already in production. The head of legal of a Paris-headquartered universal bank’s London digital-legal book told us the AI file had been bolted onto privacy without a new headcount, and that the product-liability recast was still sitting with commercial. Two roles, two organization types, no names. Both point at the same staffing error: treating a dated calendar as a 2027 project.

The European Federation of Data Protection Officers has already described the design trap a company walks into when it appoints an “AI officer” who is also the adoption champion: the person who is measured on rollout cannot be the person who is measured on a kill-decision. The AI Act does not create that office. Article 26 of Regulation (EU) 2024/1689, as displayed by the Commission service desk, places deployer duties — instructions for use, competent human oversight, input-data quality, monitoring, six-month logs, workplace information, registration for public deployers, cooperation with authorities — on the deployer as a legal person. The internal desk is a choice. The addressee is not.

Liability arrives before conformity. Directive (EU) 2024/2853 of 23 October 2024, published in the Official Journal on 18 November 2024, defines “product” to include software. Recital language treats a developer or producer of software, including an AI system provider within the meaning of Regulation (EU) 2024/1689, as a manufacturer. Article 2 applies the Directive to products placed on the market or put into service after 9 December 2026. Article 22 requires Member States to transpose by the same date. The Commission DG GROW page states that manufacturers remain liable for defects that appear after release because of updates, upgrades or a machine-learning feature, and that an EU-based economic operator must be available for a claim. That is the liability half of the European seat: disclosure and evidence duties in a no-fault claim, joint and several exposure along the value chain, and a live duty to treat post-release learning as defect-relevant.

Do not staff a dedicated AI Liability Directive counsel. The Commission work program 2025, COM(2025) 45 final of 11 February 2025, listed the proposal in Annex IV with the reason “No foreseeable agreement.” EAPIL recorded the formal Official Journal withdrawal notice C/2025/5423 of 6 October 2025, following the Commission’s meeting on 16 July 2025. Non-contractual exposure now rides on the product-liability recast plus national tort, using the AI Act technical file as the disclosure store. The same mid-senior counsel who can read product-safety language holds both halves. A junior “AI tort” seat is a requisition written against an instrument that is no longer on the table.

The modeled compliance file is small next to the statutory maximum. COM(2021) 206 final of 21 April 2021 priced a per-system compliance increment at approximately EUR 6,000 to EUR 7,000 in 2021 prices, with human-oversight time of EUR 5,000 to EUR 8,000 a year. CEPS, with ICF and Wavestone, in the study supporting that impact assessment, put a new quality-management system at EUR 193,000 to EUR 330,000 plus about EUR 71,400 a year to maintain, and only where no QMS already exists. Article 99(3) of the AI Act sets administrative fines of up to EUR 35,000,000 or 7 percent of worldwide annual turnover, whichever is higher, for prohibited practices; Article 99(4) sets EUR 15,000,000 or 3 percent for other operator and notified-body duties; Article 99(5) sets EUR 7,500,000 or 1 percent for misleading information to authorities. Article 101 gives the Commission a parallel EUR 15,000,000 or 3 percent power over GPAI providers, with unlimited Court of Justice review. Those ceilings are legal maxima, not collected revenue. As of the pages opened in September 2026, no 2025–2026 fine table has been published. The calendar is live. The collected-fine series is not.

A first composite from the Brussels in-house book. A mid-cap industrial deployer asked for a privacy counsel who could “cover the AI Act.” The live matter was a workplace scoring pilot that needed a stop-or-redesign review under Article 5, already applicable. The search ran five months inside the four-to-seven-month band. The company hired a mid-senior in-house counsel with employment-plus-product range, reporting to the general counsel. At month twelve the product-liability rewrite of supplier and insurance terms was still sitting with commercial. The privacy overlay had closed the prohibition file. It had not closed the seat.

Name the device boundary once and leave it. Omnibus recital (42) moves Regulation (EU) 2023/1230 from Section A to Section B of Annex I, so AI-enabled machinery follows a sectoral essential-requirements path, with delegated acts to apply by 2 August 2028. A general counsel whose only AI is a safety component of a machine or a medical device is on that embedded stack; the sibling page on med-tech and digital-health regulatory counsel owns AI-enabled medical-device software. This page is the horizontal seat: stand-alone Annex III systems, GPAI, transparency, and software-as-product liability.

Financial deployers already have a second clock that is not a substitute. On 31 July 2026 the EBA, EIOPA and ESMA published a joint statement on ICT risk from frontier AI models and on DORA oversight of critical ICT third-party providers. Annex III creditworthiness rules remain dated to 2 December 2027. A London or Paris bank general counsel who hires one counsel and calls both files closed has hired a DORA lawyer and postponed the technical file.