AI compliance starts with the use case and the organisation’s role. A developer, importer, distributor and deployer may have different duties; rebranding or significant changes can alter the analysis. Risk classification must be based on the intended purpose and applicable rules rather than a vendor’s marketing label. Prohibited practices, AI literacy, transparency and high-risk requirements should be assessed separately, including the relevant application dates.
How we approach the matter
We map AI systems and suppliers, document intended uses, allocate internal ownership and identify the information needed from vendors. A practical governance programme connects procurement, legal review, security, data protection, training and incident escalation. Human oversight must fit the actual decision process. Documentation should record limitations and evidence, not simply declare that a product is compliant.
From classification to operational controls
Describe the actual use case before selecting a compliance checklist: the inputs, outputs, decision-making process and affected people all matter. A supplier’s product category does not settle the customer’s legal role. Allocate responsibility for documentation, human review, transparency and incident escalation. Data protection, confidentiality, copyright and sector-specific rules continue to apply alongside the AI Act.
Procurement, change and evidence
Contracts should secure the information and assistance needed to operate the system lawfully. Assess how model updates, new data sources or a change of purpose will be reviewed. Keep a record of the approved use, limitations and relevant tests; this is more useful than a general statement that the product is compliant. If a concern arises, preserve the configuration and relevant input-output examples, subject to appropriate confidentiality and personal-data safeguards.
Four practical examples
The following scenarios illustrate typical legal questions. They are not descriptions of client mandates or promised outcomes.
Staff assistant
A company rolls out a general-purpose writing assistant. We define permitted inputs, confidentiality safeguards, review requirements and staff training.
Recruitment tool
An employer evaluates automated applicant scoring. We examine intended use, risk classification, data protection and employee-representation issues before purchase.
Rebranded system
A distributor sells an AI product under its own brand. We assess whether its role and resulting obligations change.
Governance audit
Management needs an inventory of deployed systems. We organise ownership, supplier evidence and escalation paths around the actual business processes.
Preparing your enquiry
A short description of the project or dispute, the parties involved, relevant countries and any deadline helps us identify the next step. Preserve the relevant contract, publication or technical records. Please avoid sending highly sensitive material until a suitable communication channel has been agreed.
Discuss your matter with our team · Media law overview · Disputes and enforcement