Fees

A documented inventory of the AI systems and tools in use across the organization, including those adopted without formal approval, each classified by risk level and by the legal obligations that attach to it. The inventory is the foundation for every other governance step, since obligations cannot be assessed for systems that have not been identified.

An internal policy governing which AI tools your personnel may use, what information may be entered into them, and what output requires human review before external use. Deliverables include the policy, a condensed version for distribution to staff, and a rollout plan. Appropriate where employees have begun using AI tools in advance of any governing policy.

A live session for your personnel or your board addressing the AI and privacy obligations applicable to your business, with written materials retained by attendees. Covers current legal requirements, anticipated developments, and the diligence questions raised by customers and investors. Tailored to your industry and to the systems in use.

California's regulations governing automated decision-making technology took effect in January 2026, and Colorado, Texas, Minnesota, and Oregon impose related requirements. This engagement determines whether your automated processing falls within scope, drafts the pre-use notice consumers are required to receive, and establishes an opt-out process your personnel can administer.

A written plan governing the response to a harmful AI output, an unintended disclosure of data, or a regulatory inquiry. Addresses escalation and notification responsibilities, evidence preservation, disclosure obligations and their deadlines, and incident documentation. Includes a tabletop exercise so the plan is tested rather than merely drafted.

A legal analysis of one AI system identifying which statutes and regulations reach it, its risk classification under the EU AI Act where that applies, and the notice, consent, disclosure, and documentation obligations that follow. This is legal analysis rather than a technical audit. Where a regime requires an independent assessment, such as a bias audit performed by a third party, this engagement covers scoping that audit and advising on its findings rather than conducting it.

A review of the AI vendors in your technology stack addressing their use of your data, whether that data trains their models, the commitments made in their contractual terms, and the allocation of liability for erroneous output. Includes a diligence checklist for evaluating prospective vendors. Scope is set by how many agreements are in review, since a company running sixty vendors is a materially different exercise than one running six.

A governance program aligned to the NIST AI Risk Management Framework. Establishes accountability for AI decisions, the review a system undergoes before deployment, documentation requirements, and the cadence for periodic reassessment. Appropriate where customers, partners, or investors require evidence of a functioning governance structure.

The public facing documents describing the personal information you collect and the purposes for which it is used. Includes the website or application privacy policy, the notice required at the point of collection, and a cookie notice reflecting the technologies your site deploys. Drafted against your product's actual data practices.

The provisions your vendor and customer agreements require once personal data or AI systems are involved. Includes a data processing agreement for distribution to counterparties, AI provisions addressing training data, output, and accountability, and negotiation guidance identifying which positions warrant being held. Drafted for reuse across transactions.

Twenty states currently enforce comprehensive privacy statutes, with additional laws taking effect each January. This assessment determines which statutes reach your business, identifies where current practice falls short, and catalogues the risk assessments and records those statutes require. Several of them oblige you to produce those records to the state attorney general on request.