The legal leader's role in AI-enabled work

Start with the decision, not a generic risk list

Describe the exact work before asking legal to review it. Record who will use AI, what information enters the system, what output it produces, who relies on that output, and what happens if it is wrong. Separate experimentation from external release and low-consequence assistance from decisions that affect rights, access, money, or safety.

Classify the legal leader's relationship to each question. Legal may own interpretation of a law or contract, review a proposed control, advise the business owner, or collaborate with privacy, security, procurement, and technology. The business owner still owns the work outcome; technology owners operate the system; specialist teams retain their own responsibilities.

The NIST AI RMF actor-task appendix describes AI work as a lifecycle involving governance, operation, human factors, domain expertise, evaluation, and affected communities. It is voluntary guidance and does not assign one universal legal operating model.

Sources: [1]

Build the legal issue triage register

Create one row per material question. Capture the use-case owner, intended use, model or service, data categories, affected group, jurisdiction, source of authority, contract clause, unresolved fact, potential consequence, interim condition, accountable decision maker, legal disposition, evidence retained, and next review date.

Use distinct dispositions: proceed within stated conditions, revise and return, escalate for specialist advice, or hold until evidence exists. A disposition applies only to the recorded version and use. Changes to the model, data, geography, autonomy, audience, or consequence reopen the record.

For European contexts, the official EU AI Act text provides the legal source. Classification and obligations depend on facts, timing, role, and jurisdiction, so the register should preserve the source and question rather than convert a general summary into legal advice.

Sources: [2]

Worked artifact: a synthetic supplier-review assistant

Imagine a synthetic procurement team proposing an assistant that summarizes supplier terms before a renewal meeting. The triage register identifies procurement as the workflow owner, technology as the integration owner, and legal as reviewer of contract interpretation and provider terms. Inputs include executed agreements, amendments, negotiation notes, and personal contact information.

The first test reveals that the assistant treats a draft amendment as executed. Legal records the authority question, while procurement records the document-status failure. The interim condition permits private practice with synthetic agreements but holds use on live renewals. Technology adds a source-status field and prevents a draft from being presented as controlling language.

A second synthetic test correctly separates the executed agreement from the draft. Legal then records a bounded disposition for internal preparation only, subject to human review of the original documents. External advice, negotiation language, and automatic supplier decisions remain outside scope. The example does not establish that this process is legally sufficient in any jurisdiction.

Verify the record against real operation

Sample a use from request to release. Confirm that the stated data, configuration, source hierarchy, reviewer, and decision match what happened. Check whether teams route work through personal accounts, omit attachments, reuse an earlier approval, or expand a pilot without reopening review.

Track unresolved questions and aging conditions rather than counting approvals. A large number of approvals may signal weak scoping, while a small number may reflect unreported use. Review recurring questions to improve intake instructions and ownership.

Two Prune can observe how participants frame questions, navigate evidence, verify outputs, and escalate uncertainty in controlled simulations. It does not give legal advice, clear a customer's AI use, or make employment decisions.