For companies · Specialist counsel

AI governance and liability counsel search

The in-house lawyer who classifies systems, owns the technical file, and answers the supervisor. Not a committee. Not a legal-ops hire.

Brief a search See the methodology
01 The seat

A named counsel, a committee, or a privacy overlay. Pick one.

A company that places or deploys AI systems needs a counterpart for classification, the technical file, and a market-surveillance request. Regulation (EU) 2024/1689 names the company as addressee; it does not name an officer. The general counsel still has to decide who holds the file.

What this search is
A retained or exclusive search for the in-house lawyer who classifies AI systems, owns the technical file, and answers a market-surveillance request. It is not a legal-operations hire and not a standing committee.
Seat, committee, overlay
A named counsel when kill-decisions cannot wait for a panel. A cross-functional committee when the company deploys but does not place models. A privacy overlay only where the DPO is associated, never as chef de file.
Sartori clock
Privacy and AI-governance counsel: 19 days to shortlist, 9 weeks median to accepted offer, on the specialist-counsel clock (of 96 senior and specialist in-house placements since 2017).
Article 99
EU AI Act administrative fines of up to EUR 35 million or 7 percent of worldwide turnover for prohibited practices, whichever is higher (Regulation (EU) 2024/1689).
IAPP 2025-26 pay
Half of respondents working solely in AI governance sit below USD 151,800 base. Technical AI-governance roles in technology report a median of USD 221,000 (survey March-April 2025, published 3 August 2025).
Guarantee
Six-month replacement on specialist in-house searches. Twelve months only when the seat is retained as Head of Legal. Off-limits: 24 months on the client's legal department.

Three structures show up in briefs, and they are not interchangeable. A named AI-governance counsel (sometimes Head of AI Governance) owns classification, Annex IV documentation, and the conversation with the conformity body. A committee of legal, risk, product and security can govern use-policies when the company is a deployer of third-party tools and no product can force a same-day stop. A privacy overlay associates the DPO wherever personal data is processed; it does not make that person chef de file for the Act. The CNIL said so in November 2025.

Legal operations is a fourth, and the wrong one. Intake, e-billing and a model-governance tool are the legal operations recruiting brief. This seat answers a supervisor. If you flatten it into ops, you will hire a programme manager and still lack a lawyer who can stop a ship.

The parent mandate remains in-house and general counsel recruiting. Compliance leadership that already owns model-risk sits on compliance and regulatory recruitment. Privacy leadership that must stay a statutory DPO is a Chief Privacy Officer search. This page is the named AI-governance and liability counsel.

02 The calendar

The obligations are dated. The hire should be too.

Prohibitions have applied since 2 February 2025. AI-Office enforcement has applied since 2 August 2026. High-risk conformity moved; the live files did not. A GC who cannot name the counterpart for a technical-file request is already late on the inventory.

EU AI Act and product-liability calendar as applied to an in-house brief (dated 10 September 2026). High-risk dates follow the Digital Omnibus on AI (Regulation (EU) 2026/1744). Penalties in Article 99 are separate from the calendar.
ObligationAppliesWhy it sits on this brief
Prohibitions and AI literacy2 Feb 2025Art. 5 bans already apply
GPAI obligations2 Aug 2025General-purpose model duties
Transparency; AI Office enforcement2 Aug 2026Live supervisory file
Product-liability recast applies9 Dec 2026Directive (EU) 2024/2853
Annex III high-risk (Ch. III)2 Dec 2027Conformity for listed uses
Annex I embedded high-risk2 Aug 2028Embedded-product systems

Article 99 ceilings: up to EUR 35 million or 7% of worldwide turnover (prohibited practices); EUR 15 million or 3%; EUR 7.5 million or 1%. GPAI providers: EUR 15 million or 3%.

Source: Regulation (EU) 2024/1689; Commission AI Act policy page; Directive (EU) 2024/2853.

$151,800
Half of IAPP respondents working solely in AI governance earn below this base.
IAPP Salary and Jobs Report 2025-26, 3 August 2025
$221,000
Median base for technical AI-governance roles in the technology sector.
IAPP Salary and Jobs Report 2025-26, 3 August 2025
$169,700
Half of respondents working in both privacy and AI governance earn above this base.
IAPP Salary and Jobs Report 2025-26, 3 August 2025
EUR 35m / 7%
Article 99 ceiling for prohibited AI practices, whichever is higher.
Regulation (EU) 2024/1689, Article 99
03 The profile

Privacy counsel, product counsel, regulatory technologists.

The title is new. The people are not. We map three adjacent desks and test for ownership of a system inventory, not for a year of AI in the job heading.

01

Privacy counsel stepping across

GDPR, CCPA/CPRA and automated-decision files already sit on their desk. They can associate the DPO where personal data is processed. They still need a product counterpart for the technical file and for Directive (EU) 2024/2853 from 9 December 2026.

02

Product counsel who has stopped a ship

They have killed or redesigned a feature under legal instruction, not written a policy after launch. The brief is classification, Annex IV documentation, and a working relationship with engineering. Title language varies; the kill-decision does not.

03

Regulatory technologists

Counsel or adjacent lawyers who can read a model card, a quality-management file and a conformity-assessment plan. IAPP AIGP is a market signal, not a statutory gate. Lived ownership of a system inventory beats the credential.

The statutory addressee remains the company. Public 2025-2026 advertisements show the work arriving as privacy-plus-AI, as a head of AI governance next to risk, or as product-facing regulatory counsel. We read the regime, then the résumé. For how sitting GCs are absorbing the same file, see general counsel and AI governance. For the privacy desk this overlay most often comes from, see privacy and DPO careers.

04 The clock

Nineteen days to a shortlist. Nine weeks to an accepted offer.

Privacy and AI-governance counsel runs on the specialist-counsel clock: 19 days to shortlist, 9 weeks median to accepted offer. Senior counsel as a whole, of 96 placements since 2017, sits at 18 days and 8 weeks. GC and CLO searches are a different book: 24 days and 11 weeks, of 38. The clock starts when the Mandate Blueprint is signed, not when someone first emails.

Offer acceptance across corporate mandates is 96 percent. Retention of placed in-house leaders is 97 percent at 12 months and 91 percent at 24 months. Specialist searches carry a six-month replacement window. We do not approach anyone we placed for as long as they stay, and we do not recruit from a client's legal department for 24 months after a mandate.

  1. Week 1 Mandate Blueprint

    Name the addressee: seat, committee or privacy overlay. Lock the regulators, the system inventory, and whether the hire reports to the GC or sits beside risk.

  2. Weeks 1-2 Total-market mapping

    Privacy counsel, product counsel and regulatory technologists who have owned a classification file, not a slide deck. Brussels, London, New York and California first.

  3. Weeks 2-4 Private outreach

    Blind both ways until mutual interest. No CV leaves us without written candidate consent. Conflicts checked before the first call.

  4. Weeks 3-4 Shortlist dossiers

    Assessment files that name systems classified, files owned, and examinations sat. Privacy/AI-governance shortlist: 19 days.

  5. Weeks 5-9 Interviews and offer

    Offer engineering against the seat. Specialist counsel median to accepted offer: 8 weeks; privacy/AI-governance median: 9 weeks.

  6. Close Start and 90-day checks

    Notice, onboarding, 90-day check-ins. Six-month replacement on this specialist search. Off-limits on the department for 24 months.

05 A closed search

GDPR and model-risk on one bilingual desk.

Insurance · Euronext-listed · Brussels

Privacy and AI-governance counselRead the case study

Situation
An EU insurer needed a bilingual counsel who could hold GDPR and model-risk on the same desk after prohibitions applied. The DPO was already in post and could not own the technical file.
Approach
Mapped privacy counsel and product-facing regulatory lawyers in Brussels and neighbouring markets. Shortlist bilingual. Specialist-counsel process, not a legal-ops overlay.
Outcome
Accepted offer in 8 weeks. The hire still reports to the GC, with a dotted line into model-risk. Of 96 senior and specialist in-house placements since 2017.

Timeline: 8 weeks, brief to accepted offer

That Brussels file is one specialist placement, not a template. The same desk in California is usually product-facing; the same desk in London is often a privacy overlay with a dotted line into operational risk. What does not change is the test: has this person classified systems, owned a file, and sat a supervisor. The longer briefing is the AI governance and liability counsel note on the EU AI Act.

06 Where we search

Hubs that already hold this file.

Sartori & Partners has completed 230+ in-house and corporate placements since 2017, including 41 compliance and regulatory leadership seats and 96 senior and specialist counsel. Corporate mandates have run in 23 countries and 41 cities. Brussels opened as a network in 2019; London in 2025; New York in 2023; California in 2024. Team languages include English, French, Italian, German, Spanish, Farsi, Arabic and Vietnamese.

Start from the artificial intelligence industry page if the company is a model provider or a heavy deployer. Start from in-house counsel recruiting in New York City or in-house recruiting in Houston if the seat sits inside a wider GC build. Cohort sizes in the Sartori research programme (New York: 1,675 structured interviews) are cited separately from placement counts.

Sources

4 references
  1. Regulation (EU) 2024/1689 (AI Act), Article 99 eur-lex.europa.eu ↗
  2. European Commission, AI Act regulatory framework digital-strategy.ec.europa.eu ↗
  3. Directive (EU) 2024/2853 on liability for defective products eur-lex.europa.eu ↗
  4. IAPP Salary and Jobs Report 2025-26 iapp.org ↗

Statutory and IAPP figures only. Sartori clocks and placement counts are programme constants in the claims sidecar.

Questions companies ask about AI-governance counsel

Who are the best AI governance counsel?

A ranking of AI-governance counsel does not exist. The usable test is whether the person has classified systems, owned a technical file, and sat a supervisory request. Sartori has completed 230+ in-house placements since 2017, of which 96 are senior and specialist counsel; privacy and AI-governance sits on that specialist clock. Read the EU AI Act counsel briefing before you freeze the brief.

Do we need a dedicated seat, or will a committee suffice?

A committee works when no system forces a same-day stop decision. A named counsel is the hire when classification, the technical file, or a market-surveillance answer cannot wait for a panel to be instructed. Folding the file into legal operations is a category error: ops runs intake and tooling; this seat answers the regulator. The parent mandate is still in-house and general counsel recruiting.

Can the DPO or CPO own the AI Act file?

Not as a default. The CNIL has said involving the DPO is not the same as making that person chef de file. Article 27 pulls the DPO into a fundamental-rights impact assessment where one applies. The product-liability recast and the GPAI notification file do not live in that office. If you want the privacy leader first, start with Chief Privacy Officer and DPO search.

Who actually has this profile today?

Most hires come from privacy counsel, product counsel, or regulatory technologists. Very few people have a long AI-specific track record, which is why we map adjacent desks instead of waiting for a title match. IAPP AIGP is a signal among survey respondents, 77 percent of whom held at least one IAPP credential; it is not a statutory requirement. The artificial intelligence industry page sets the sector context.

How long does an AI-governance counsel search take?

Nineteen days to shortlist; nine weeks median to an accepted offer. That is the privacy/AI-governance clock inside the specialist-counsel book (96 placements since 2017). Senior counsel as a whole sits at 18 days and 8 weeks. The clock starts when the Mandate Blueprint is signed. City work such as in-house recruiting in London uses the same process.

What does Article 99 of the EU AI Act actually fine?

Article 99 allows fines of up to EUR 35 million or 7 percent of worldwide turnover for prohibited practices, whichever is higher. Lower ceilings apply to other breaches: EUR 15 million or 3 percent, and EUR 7.5 million or 1 percent, under the same article. GPAI providers face a separate EUR 15 million or 3 percent ceiling. Those figures are statutory. They are why the GC, not HR, owns this brief.

Is this a retained search?

Specialist AI-governance counsel is retained or exclusive contingency, agreed in writing before outreach. Head of Legal and GC seats stay retained only, in three instalments: engagement, shortlist, start. Exclusive specialist terms sit at 22-28 percent of first-year cash with a six-month replacement window. Read how we run a search before you sign.

Where do you actually complete these mandates?

Corporate mandates have run in 23 countries and 41 cities since 2017. Brussels is the EU-law desk; London, New York and California carry product and platform files. See in-house recruiting in San Francisco, compliance recruitment in New York City, and the company hiring hub.

AI governance counsel

Brief the seat before you freeze the title.

Tell us whether this is a named counsel, a committee, or a privacy overlay. We map the field from there. No obligation.