Regulatory counsel for the companies building and deploying AI, across the EU, Switzerland and the United Kingdom.
The regulation of AI split three ways in the space of two years: the EU built a code, Switzerland chose sectoral legislation, with a cross-sectoral core on transparency, data protection, non-discrimination and supervision, on the foundation of a Council of Europe treaty it has signed but not yet ratified, and the United Kingdom regulates through its existing authorities. Companies rarely operate in just one of the three.
Our work is translation: from regulation into role analysis, controls and documentation proportionate to the product and the risk. The same applies to the data, cyber and contract layers around an AI deployment: the GDPR and the FADP, DORA, NIS2 and the Cyber Resilience Act, and the technology contracts that allocate the risk. We act for businesses on both sides of the technology, providers building and shipping AI systems and models, and deployers embedding them into products, decisions and operations, and for the boards that have to own the risk.
The starting point is almost always the same three-step sequence: an inventory of what the organisation runs, a role and risk mapping against the applicable regimes, and a prioritised gap list that separates what is legally required now from what arrives on the published timelines.
Three regimes, one governance framework, mapped three ways.