ICommercial contracts
Master services agreements, order forms, reseller and marketplace terms, security exhibits, and the limitation of liability the enterprise customer will not sign. The officer still closes paper. At this stage there is often no commercial bench behind them.
IIAI governance
Whether the company is a provider, a deployer, or both. The EU AI Act became applicable on August 2, 2026. Transparency rules apply from August 2026. Annex III high-risk obligations apply from December 2, 2027. A named counsel for that file is a different search.
IIIIP
Copyright in code and in model output, the open-source policy, and who prosecutes patents. The U.S. Copyright Office will not register a work whose traditional elements of authorship were produced by a machine (88 FR 16190, March 16, 2023).
IVPrivacy
Data-processing agreements, the US state patchwork, and GDPR where the product has EU users. The IAPP report covers 19 enacted comprehensive US state privacy laws as of January 5, 2026. A statutory DPO is not the default occupant of this seat.
Commercial contracts are the file that disqualifies a generalist fastest. World Commerce & Contracting's Most Negotiated Terms 2024 drew on 937 organizations worldwide. Limitation of liability, price and changes to price, and indemnification were the three most negotiated terms. Intellectual property ranked eighth overall and sixth among the larger businesses in the sample, a group with average annual revenue of $11.6 billion and 49 percent of respondents. A separate WorldCC and Deloitte study, published in September 2024 and cited in that report, found that only 16 percent of contract negotiators believe they are negotiating the right things. A technology GC who has only reviewed outside counsel's draft of a financing will treat the MSA as a long services agreement. We ask for the last enterprise agreement the candidate personally negotiated: customer type, whether a security exhibit or a data-processing addendum moved, and whether they held the pen.
AI governance is the file that has a calendar the board can point to. Regulation (EU) 2024/1689, the AI Act, entered into force on August 1, 2024 and became applicable on August 2, 2026. Prohibited practices and AI-literacy obligations have applied since February 2, 2025. Governance rules and obligations for general-purpose AI models have applied since August 2, 2025. Transparency rules apply from August 2026. The European Commission states that, after the AI Omnibus entered into force on July 27, 2026, rules for high-risk systems in areas such as biometrics, critical infrastructure, education, employment and migration apply from December 2, 2027, and rules for high-risk AI embedded in regulated products apply from August 2, 2028. From August 2, 2026 the AI Office and Member State authorities supervise and enforce. Article 99 of the Act sets fines of up to EUR 35 million or 7 percent of worldwide turnover for prohibited practices, EUR 15 million or 3 percent, and EUR 7.5 million or 1 percent, for the tiers the article specifies. The GC does not have to be the conformity engineer. The GC does have to know which date applies to the product the company is actually shipping, and when the file should move to a named AI-governance counsel. When to split that hire is covered in when to hire privacy and AI governance counsel.
Intellectual property, for this officer, is ownership and the license-in, not a prosecution docket. The U.S. Copyright Office's registration guidance, effective March 16, 2023, states that if a work's traditional elements of authorship were produced by a machine, the work lacks human authorship and the Office will not register it. Applicants must disclose AI-generated material and disclaim it when it is more than de minimis (88 FR 16190). A software GC who cannot explain that rule to a customer asking who owns the output, or who cannot say what the open-source policy allows engineering to import, is not the officer. Patent prosecution stays with outside counsel or, once the company is large enough, with a head of IP. The GC owns the decision of which inventions to file and which code the company is not free to ship.
Privacy is the file that splits the search once the product holds personal data at scale. The International Association of Privacy Professionals, on January 5, 2026, reported that its U.S. State Comprehensive Privacy Laws report covers 19 enacted comprehensive state laws, and that comprehensive laws in Indiana, Kentucky and Rhode Island took effect on January 1, 2026, alongside California regulations on automated decision-making technology, risk assessments and cybersecurity audits. Where the product has users in the European Union, Regulation (EU) 2016/679, Article 83(5), allows administrative fines of up to EUR 20 million or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher. For a US-listed software issuer, the Securities and Exchange Commission requires an Item 1.05 Form 8-K generally within four business days after the company determines a cybersecurity incident is material (SEC, July 26, 2023). Association of Corporate Counsel data from the 2026 Chief Legal Officers Survey, fielded September 10 to November 7, 2025, and published January 29, 2026, puts a direct report to the chief executive at 84 percent of CLOs and majority oversight of compliance at 64 percent (1,049 CLOs, 20 industries, 43 countries). In a one-lawyer software company those facts collide: the GC often holds privacy, and a statutory DPO or a US chief privacy officer may have to sit outside that line. The separate officer is a chief privacy officer search. We say which search you are in during week 1.
