The regulatory map every general counsel needs now

A single associate at a 300-lawyer firm feeds a client contract into a generative AI tool to draft a redline. The client is a German manufacturer, the matter touches a California subsidiary, and the associate is barred in New York. Before that document is saved, at least three regulatory regimes have a claim on what just happened. Most GCs (general counsel, the firm's chief legal officer for its own risk) cannot name all three off the top of their head. That gap is the subject of this lesson.

Why one AI tool triggers multiple regimes at once

AI regulation for law firms is not one law. It is a stack:

• The EU AI Act governs the tool itself, based on what it does and who it affects.
• US state disclosure and privacy laws govern what firms must tell clients, employees, and consumers about AI use.
• Bar association ethics opinions govern the lawyer's professional duties, regardless of what the software vendor promises.

These regimes were not designed to talk to each other. A firm operating in the EU, the US, and a common law jurisdiction like the UK can be simultaneously compliant with one and exposed under another.

Layer 1: the EU AI Act's risk tiers

The EU AI Act (entered into force 2024, obligations phasing in through 2026 to 2027) classifies AI systems by risk, not by industry:

• Unacceptable risk: banned outright (e.g., social scoring). Rarely relevant to law firms.
• High risk: subject to conformity assessments, documentation, and human oversight. This is the tier that matters most. AI systems used in "administration of justice" contexts, and certain HR or credit-scoring tools a firm might use internally, can fall here.
• Limited risk: transparency obligations only (e.g., users must be told they are interacting with AI).
• Minimal risk: largely unregulated.

A generative AI drafting assistant used purely for internal document review is typically limited or minimal risk. But the same tool, repurposed to score litigation outcomes or screen job candidates, can jump into the high risk tier. Classification depends on use case, not brand name.

Practical consequence: a firm cannot certify a tool once and forget it. Each new use case needs its own risk classification.

Layer 2: US state disclosure and privacy laws

The US has no single federal AI law. Instead, a patchwork of state statutes creates disclosure and consent obligations:

• California's CCPA/CPRA (California Consumer Privacy Act, as amended) gives clients rights over personal data, including data fed into AI tools, and increasingly requires disclosure when automated decision-making affects them.
• Colorado's AI Act (effective 2026, one of the first comprehensive state AI laws) requires "reasonable care" to avoid algorithmic discrimination in high risk AI systems, with duties on both developers and deployers.
• Illinois, New York City, and others have narrower rules, often targeting AI in employment decisions (relevant when a firm uses AI in its own hiring).

None of these statutes were written with law firms specifically in mind. But a firm using AI to review resumes, score associates, or process client intake data is a "deployer" under several of them.

Practical consequence: the same AI tool can require a public-facing disclosure in California, a documented risk assessment in Colorado, and nothing at all in a state with no relevant statute yet. Firms serving clients across states must comply with the strictest applicable rule, not the average.

Layer 3: bar association ethics opinions

Separate from statute, every US lawyer is bound by professional conduct rules, and multiple state bars have issued formal guidance on generative AI. The American Bar Association's Formal Opinion 512 (2024) is the most cited: it holds that lawyers using AI must maintain competence (Model Rule 1.1), protect client confidentiality (Rule 1.6), supervise the tool like a junior associate (Rules 5.1/5.3), and, in many cases, disclose AI use to clients and courts.

Key friction points:

• Confidentiality: feeding client data into a third-party AI tool can violate Rule 1.6 if the vendor's terms allow that data to train future models. This is a contract review problem, not just an ethics problem.
• Competence: a lawyer who does not understand how the tool can hallucinate (generate plausible but false content) is arguably not meeting the competence standard.
• Candor to the tribunal: several federal courts now have standing orders requiring disclosure of AI use in filings, following widely reported cases of fabricated citations.

Practical consequence: even a tool that is fully compliant with the EU AI Act and every relevant US state law can still expose a lawyer to bar discipline if confidentiality or supervision duties are not documented.

Where the three layers collide: a worked example

Take the opening scenario: a German client, a California subsidiary, a New York-barred associate, one AI drafting tool.

Passing one test does not pass the others. A firm-wide AI policy has to run all three checks for every matter that crosses jurisdictions, which in an international practice is most matters.

The guardrails to run before any deployment

A minimal pre-deployment checklist, drawn from how leading firms are structuring AI governance in 2026:

1. Classify the use case under the EU AI Act tiers, even if the firm has no EU office (clients often do).
2. Map applicable US state laws based on where clients, employees, and data subjects are located, not just where the firm is headquartered.
3. Review vendor contracts specifically for data retention and model-training clauses. This is the single most common confidentiality failure point.
4. Document human oversight: who reviews AI output before it reaches a client or court, and how is that review logged.
5. Check court-specific disclosure rules, since individual judges increasingly impose their own AI disclosure orders.
6. Run a bias and hallucination spot-check on outputs relevant to the practice area (contract review, litigation research, due diligence).

A simple internal risk score can help triage:

risk_score = (jurisdiction_count * 1) 
           + (personal_data_involved * 2) 
           + (client_facing_output * 2) 
           + (automated_decision_component * 3)

# score >= 6 triggers mandatory partner sign-off before deployment

This is illustrative, not a legal standard, but it forces the right questions before a matter starts, not after a mistake surfaces.

Key Takeaways

• No single law governs AI use in a law firm. The EU AI Act classifies the tool, US state laws govern disclosure and data rights, and bar ethics opinions govern the lawyer's individual conduct. All three can apply to one matter.
• Risk classification is use-case specific, not tool specific. The same AI product can be low risk in one matter and high risk in another, depending on what decision it feeds into.
• Vendor contract terms, especially around data retention and model training, are the most common source of confidentiality breaches under bar ethics rules like ABA Formal Opinion 512.
• Cross-jurisdictional matters require compliance with the strictest applicable regime, not an average or a single home-jurisdiction standard.
• A documented pre-deployment checklist (classification, jurisdiction mapping, vendor review, human oversight, court rules, bias check) is now closer to a professional necessity than a best practice.