AI Governance and Legal Risk
Practical rules for how your business actually uses AI.
Your Business Already Uses AI. The Question Is on What Terms.
Most businesses didn't decide to adopt AI. It arrived in the tools staff signed up for, the features suppliers switched on and the chatbot on the website. AI governance means knowing what's in use, what it's allowed to touch, who is accountable when it goes wrong, and what your contracts say about it.
I'm an SRA-regulated solicitor and I advise businesses on AI governance as a legal question, grounded in the contracts and the liability, not as a technology project.
Where the Legal Risk Sits
Your Contracts
In July 2026 the UK Jurisdiction Taskforce published its statement on liability for AI harms under English law. One of its conclusions is that contract will generally be the main way liability is shared out between businesses in an AI supply chain. The terms you agree with AI vendors, and offer your own customers, matter more than any policy.
What Your AI Says on Your Behalf
If your business presents a chatbot or AI tool as speaking for it, you can be responsible for what it says.
Data and Confidentiality
What staff paste into AI tools, where it goes, and whether the provider can use it to train its models.
Professional Judgement
The same UKJT statement indicates that professionals can be negligent for relying on AI when they shouldn't, and potentially for not using it when a competent peer would have.
EU Exposure
The EU AI Act applies to UK businesses whose AI systems are placed on the EU market or used in the EU, wherever the business is based.
What I Do
AI use review.
Which tools are in use, who uses them, and what data they touch.
AI policy.
A Use of AI Policy for your business: a full policy, plus a simple do's and don'ts guide your workforce will actually read.
AI procurement.
Negotiating AI vendor and SaaS terms: use of your data, training on your data, ownership of outputs, liability, security and exit.
Customer-facing AI.
Terms and disclosures where you sell or deploy AI to your own customers.
EU AI Act scoping.
Whether the Act applies to you, and what it actually requires if it does.
Board briefings.
A plain-English briefing for the leadership team on AI risk and the decisions they need to make.
How I Use AI Myself
I use AI every day, and I am open about it. Used well, it does not replace a lawyer's judgement; it sharpens it. It takes on the research, the first drafts and the administration that used to need a team of junior associates, and it gives me a sounding board for testing my own thinking. That is why one senior lawyer can now do what used to take several, without the layers of cost in between.
Two things, really. The first is the heavy lifting: legal research, first drafts of contracts, clauses and letters, comparing versions of a document to see what has moved, summarising long reports and bundles, and sifting through the volumes of data and documents that, in the pre-AI age, slowed everything down and ran up the bill. The second matters more. I use it to test my own thinking: to stress-test an argument, find the holes and contradictions in my own reasoning and in my opponent's, and surface the counterpoints I need to be ready for. It is the difference between a tool that drafts and a tool that makes the advice better.
Negotiation strategy, final advice, or any decision that turns on judgement or on knowing your business. AI can set out what the arguments are; it cannot tell me which one is right for you, or read the commercial room. That part is mine, and so is the responsibility for everything that leaves my desk.
Everything AI produces is reviewed by me before it reaches you; nothing goes out because a machine suggested it. I am careful about what goes in, too: sensitive or identifying information is minimised, anonymised, or kept out of these tools altogether, and I have set my tools so that my inputs are not used to train AI models. The convenience never comes at the expense of your confidentiality.
If your organisation has its own policy on AI, I work within it. If there are tools you would rather I did not use, or information you would rather I kept out of them, tell me, and that is how it will be.
A fair question, and the honest answer is that the tool is the commodity; the person using it is not. The same model in two sets of hands produces very different work. The advantage was never that I have AI. It is what I bring to it.
I have been using these tools seriously since 2024, across a range of models, and I know where each of them falls down. The most important thing I have learned is not to trust a confident answer. AI is prone to sycophancy: it tends to tell you what you want to hear, agree with the premise you gave it, and reinforce the bias you walked in with. Someone newer to it takes the fluent, authoritative reply at face value. I know to pressure-test it, to look for the flattery in the logic, and to override it when it is wrong. That scepticism is the difference between AI that helps and AI that quietly walks you into a mistake.
It is also why your own team using AI is a reason to instruct me, not a reason not to. The risk in a business is not the absence of AI; it is confident, unchecked AI output that nobody senior has tested. I have advised top-tier financial institutions on AI governance and on rolling out AI compliance across their workforces, so I have seen from the inside both what good AI use looks like and how it goes wrong at scale.
And there is a commercial point the rest of the market would rather not raise. AI has cut the cost of producing legal work sharply. The firms and the first-generation ALSPs have enjoyed that saving and simply not passed it on; their prices have barely moved. I have built Chord the other way round, so the efficiency goes to you, as a lower price for senior advice of the same calibre. Instructing Chord is how you capture the benefit of AI that the incumbents are keeping for themselves.
Frequently Asked Questions
Does the EU AI Act apply to UK businesses?
Yes, if your AI systems are placed on the EU market or used in the EU, regardless of where your business is based. Many UK businesses that only use everyday AI tools internally will have limited obligations, but it's worth checking rather than assuming.
When do the EU AI Act's obligations apply?
The EU AI Act applies in stages, and in 2026 the EU's Digital Omnibus pushed the most demanding obligations back. The high-risk rules now apply from December 2027 for standalone systems, and from August 2028 for AI built into regulated products. The extra time is useful, but the obligations are deferred, not removed, so businesses within scope should be preparing now rather than waiting.
Is there a UK AI law?
There's no single UK AI statute. The UK relies on existing law and sector regulators, and the UK Jurisdiction Taskforce's 2026 statement concluded that English law can generally deal with AI liability using established principles such as contract and negligence. Data protection law applies to AI just as it does to anything else.
Do we need an AI policy?
If your staff use AI tools at work, yes. It doesn't need to be long. It needs to say which tools are approved, what information can go into them, and who to ask when something isn't clear. I would recommend a simple 'do's and don'ts' which can be incorporated into e-learning, as well as a contractual policy as part of the staff handbook.
What should an AI vendor contract cover?
Whether the vendor can use your data to train its models, confidentiality and security, who owns the outputs, what the vendor promises about accuracy, liability caps, and how you get your data back when you leave.
Are you an AI governance consultant or a lawyer?
Both. I'm an SRA-regulated solicitor, so AI governance advice from CHORD is legal advice, grounded in your contracts and your liability.
Find Out Where Your AI Risk Actually Sits
Based in Warwickshire, working with clients nationally.
Call: +44 7783 534486 · Email: cam@chord.legal · Connect on LinkedIn →
“CHORD” and “Chord Legal” are trading names of CHORD Legal Limited, registered in England and Wales, company number 14820174. Registered office: 124 City Road, London, EC1V 2NX. Cam Gow is a solicitor regulated by the Solicitors Regulation Authority (“SRA”) (SRA ID 453794). CHORD Legal Limited is not authorised or regulated by the SRA. This is a structure the SRA's rules expressly permit.
© 2026 CHORD Legal Limited. All rights reserved.