Custom AI for the General Counsel: how we ship AI you can defend, indemnify, and disclose.

Article 22 prohibits decisions producing legal or similarly significant effects from being made solely on automated processing without one of the specified bases (contract, EU or member-state law, or explicit consent) and explicit safeguards. We classify every workflow against Article 22 in Discovery. Where the workflow falls in scope, we design a human-in-the-loop surface that is meaningful, not cosmetic. The reviewer sees the model's reasoning, the retrieved evidence, and the alternative options, and the decision logic supports a documented contestation path. The EDPB 2024 guidelines on Article 22 are reflected in the design pattern, and the audit log captures the human approval as a first-class event.

We do not train foundation models. We contract with foundation-model providers under no-training clauses on your data, and we use the providers' documented training-data position as the IP basis for the model itself. Where you supply training data for fine-tuning or retrieval, we maintain a provenance log and a licence record per source, and we refuse to ingest data without a documented licence. The full provenance chain is delivered as part of the regulator-pack at launch.

AI output ownership and infringement risk are a function of the foundation-model provider's terms, the input you supplied, and the use case. We design every system to keep the human reviewer in the signing seat for any output that constitutes original creative work, and we contract output-licence terms that flow through to your customer agreement. Where a foundation-model provider offers an indemnity for output infringement (several do), we use it. Where they do not, we structure the system to keep the human reviewer accountable for the final output.

For a high-risk system under the EU AI Act, the regulator-pack contains the Annex IV technical documentation (nine chapters), the EU declaration of conformity, the conformity-assessment evidence (Annex VI or VII route), the risk-management file, the data-governance documentation, the human-oversight design, the post-market monitoring plan, and the audit-log schema. For a limited-risk system, the pack is proportionate: transparency notice, model card, audit-log schema, and DPIA where the workflow triggers GDPR Article 35. The pack is delivered before launch, not after.

We push indemnity to the party that can carry it: foundation-model provider for training-data IP, us for engineering negligence on the build, and you for use-case decisions and the human reviewer's sign-off. The contract names each indemnity, caps each one, and exposes the audit log as the evidence basis when one is invoked. Where your customer agreements require a flow-through indemnity, we draft the back-to-back terms during Build phase, not after the first complaint.