Legal / Compliance / Privacy
Owns the obligations map — and the evidence that controls ran.
You are accountable for
- Deployer duties: EU AI Act, Korea's act, state laws, sector rules
- Contract posture with AI vendors: training, retention, indemnity
- Evidence generation that stands up in audits and litigation
What keeps you up at night
- Liability for AI statements and decisions (Air Canada; Mobley v. Workday)
- A serious-incident reporting clock discovered after the incident
- Marketing claims about AI the controls cannot substantiate
Decisions you own
- Build the jurisdiction-by-jurisdiction obligations calendar with owners
- Set contractual red lines for AI procurement
- Define the impact-assessment trigger and template (ISO 42005 shape)
Your layers of the stack
Questions you should be asking
- Which systems fall into which regulatory categories — and says who?
- What evidence exists that human oversight actually happens?
- Do our vendor contracts cover training use, retention, residency, indemnity?