Law for technologies still being defined.

What I do

• AI Act role and risk classification
• AI governance frameworks and policies
• Model, API and AI vendor terms
• Transparency, labelling and human oversight design
• AI clauses in customer contracts and DPAs
• Agentic AI: authority, logging and liability

Questions I often hear

• “Are we a provider or a deployer under the EU AI Act?”
• “Can we fine-tune on customer data?”
• “What do we need to tell users about our AI features?”

Laws & frameworks

• EU AI Act
• NIST AI RMF
• ISO/IEC 42001
• India IT Rules (synthetic content)
• Colorado SB 26-189
• California ADMT rules

What I do

• GDPR and UK GDPR compliance
• US state privacy laws (CCPA/CPRA and others)
• India DPDP Act and Rules readiness
• Privacy notices, consent and preference flows
• DPAs, subprocessors and international transfers
• DPIAs, breach response and data subject requests

Questions I often hear

• “Can we send EU customer data to our US cloud provider?”
• “Are we a controller or a processor for this customer?”
• “Which privacy laws apply if we launch in the EU, US and India at once?”

Laws & frameworks

• GDPR
• UK GDPR & DUAA 2025
• CCPA/CPRA & US state laws
• EU–US Data Privacy Framework
• India DPDP Act & Rules
• ePrivacy

What I do

• Token and product classification
• MiCA scoping and CASP authorisation questions
• Multi-market licensing maps with local counsel
• AML, KYC and Travel Rule obligations
• Token, DAO and community structures
• Terms of service and risk disclosures

Questions I often hear

• “Is our token a crypto-asset under MiCA?”
• “Which licences do we need to serve users in several markets?”
• “What changes if we custody user assets?”

Laws & frameworks

• EU MiCA
• FATF Travel Rule
• Singapore, UAE & other VASP regimes
• India VDA & PMLA rules

What I do

• SaaS terms, MSAs and order forms
• Enterprise negotiations and security addenda
• AI vendor and model licence review
• Open-source and model licence compliance
• IP assignment for founders, staff and contractors
• Liability, indemnity and SLA positions

Questions I often hear

• “Can we accept unlimited liability for data breaches?”
• “Who owns the outputs of our AI feature?”
• “Is this open-weights model licence safe for commercial use?”

Laws & frameworks

• Governing law & dispute forums
• Open-source & open-weights licences
• EU Data Act
• Cross-border IP ownership

What I do

• Feature and launch reviews
• Fundraising diligence preparation
• Board and investor updates on regulatory risk
• Policies: acceptable use, AI use, security
• Incident escalation and regulator correspondence
• Fractional counsel on a monthly cadence

Questions I often hear

• “What will investors ask about our data practices?”
• “Do we need a policy for staff using AI tools?”
• “What should we fix before our Series A?”

Laws & frameworks

• Investor diligence norms (US, UK, EU, India)
• Cross-border structures
• Sector regulators as relevant

What I do

• Market-entry risk assessments
• Multi-regime compliance mapping
• Regulatory change monitoring
• Cross-border data and payments questions
• Coordination with local counsel
• Regulator-facing documentation

Questions I often hear

• “Which rules apply if we launch in the EU and the US at once?”
• “Do we need a local entity or representative?”
• “What is changing in the next twelve months?”

Laws & frameworks

• EU digital rulebook
• UK data & online safety rules
• US federal & state rules
• India IT & data laws
• APAC & Middle East via local counsel