The Lawyer’s Guide to AI Governance
Practical accountability, legal duties and responsible deployment across borders
Put clear responsibilities and practical oversight at the centre of AI decisions.
Put clear responsibilities and practical oversight at the centre of AI decisions.
AI governance requires decisions about responsibility, acceptable risk and oversight. This practical handbook helps lawyers structure those decisions throughout an AI system’s lifecycle, from initial assessment through procurement, deployment and monitoring.
Its international scope covers the European Union, United Kingdom, United States, Asia and Middle East. It starts with the decision that needs governing, maps the system and assigns responsibility, then connects the legal framework with workable governance arrangements.
Coverage includes impact and rights assessments, data, confidentiality and intellectual property, AI contracts, testing and evidence, generative AI and agents. Later chapters address employment, regulated services, legal teams, monitoring and remedy, transactions and disputes, and global governance programmes.
Table of contents
16 chapters, from foundations to practical implementation.
Select a chapter to explore its sections.
01 What AI Governance Requires of the Lawyer
- 1.1 Start with the decision that needs governing
- 1.2 What counts as the system
- 1.3 Separate permission, performance and accountability
- 1.4 Build a proportionate governance case
- 1.5 Use frameworks without outsourcing judgment
- 1.6 Locate the lawyer in the decision
- 1.7 Govern benefits and affected people
- 1.8 Turn the mandate into work
02 Map the System, Assign the Decisions
- 2.1 Begin with the use record
- 2.2 Follow data, outputs and actions
- 2.3 Identify who can change the outcome
- 2.4 Make the lifecycle a series of decisions
- 2.5 Write controls that can be observed
- 2.6 Make human review real
- 2.7 Preserve the evidence that matters
- 2.8 Operate the register and the change process
03 Build the Legal Map Across Borders
- 3.1 Map connections before collecting rules
- 3.2 Read the European Union by role and date
- 3.3 Work through the United Kingdom’s existing regimes
- 3.4 Navigate the United States at several levels
- 3.5 Distinguish the approaches across Asia
- 3.6 Treat Middle Eastern jurisdictions separately
- 3.7 Resolve overlap in a real deployment
- 3.8 Keep legal advice current and usable
04 Design the Governance Operating Model
- 4.1 Choose an operating model
- 4.2 Define the governing mandate
- 4.3 Design intake and escalation
- 4.4 Connect existing functions
- 4.5 Separate challenge from delivery
- 4.6 Fund competence and capacity
- 4.7 Write usable policies
- 4.8 Measure the program
05 Assess Impact, Rights and Risk
- 5.1 Frame the assessment
- 5.2 Identify affected people
- 5.3 Trace harms and benefits
- 5.4 Evaluate equality and accessibility
- 5.5 Choose measures and thresholds
- 5.6 Reconcile assessments
- 5.7 Design mitigation and remedy
- 5.8 Record residual decisions
06 Govern Data, Confidentiality and Intellectual Property
- 6.1 Identify material and rights
- 6.2 Establish lawful processing
- 6.3 Control training and adaptation
- 6.4 Manage retrieval and access
- 6.5 Protect privilege and secrets
- 6.6 Assess copyright and outputs
- 6.7 Move data across borders
- 6.8 Retain, delete and evidence
07 Buy, Build and Contract for AI
- 7.1 Choose the sourcing approach
- 7.2 Ask useful diligence questions
- 7.3 Define the permitted service
- 7.4 Allocate legal roles
- 7.5 Negotiate information rights
- 7.6 Allocate loss and remedy
- 7.7 Control supplier change
- 7.8 Plan exit and continuity
08 Test the System and Assess the Evidence
- 8.1 Specify success before testing
- 8.2 Read performance claims
- 8.3 Build representative evaluations
- 8.4 Test generative outputs
- 8.5 Test security and misuse
- 8.6 Assess reviewers and processes
- 8.7 Use external assurance
- 8.8 Turn results into a decision
09 Control Generative AI and Agents
- 9.1 Define generative tasks
- 9.2 Constrain sources and instructions
- 9.3 Control generated content
- 9.4 Define agent authority
- 9.5 Handle chained decisions
- 9.6 Design approval and interruption
- 9.7 Test hostile environments
- 9.8 Maintain operating evidence
10 AI in Employment and People Decisions
- 10.1 Map the employment use
- 10.2 Recruitment and selection
- 10.3 Performance and monitoring
- 10.4 Equality and accommodation
- 10.5 Consult and communicate
- 10.6 Challenge and remedy
- 10.7 Manage workforce change
- 10.8 Operate across jurisdictions
11 AI in Financial, Health and Other Regulated Services
- 11.1 Start with sector duties
- 11.2 Financial decisions
- 11.3 Health and life sciences
- 11.4 Public services
- 11.5 Critical and industrial systems
- 11.6 Education and consumer services
- 11.7 Layer sector assurance
- 11.8 Advise on borderline uses
12 Govern AI Inside the Law Firm and Legal Department
- 12.1 Define the practice uses
- 12.2 Connect professional duties
- 12.3 Approve tools and matters
- 12.4 Design review standards
- 12.5 Communicate and price fairly
- 12.6 Train and supervise
- 12.7 Use client-facing automation
- 12.8 Evidence the practice
13 Monitor, Respond and Provide Remedy
- 13.1 Choose live indicators
- 13.2 Handle reports and near misses
- 13.3 Classify incidents
- 13.4 Contain and investigate
- 13.5 Coordinate legal reporting
- 13.6 Correct decisions and effects
- 13.7 Learn without losing accountability
- 13.8 Exercise the response
14 AI in Transactions, Disputes and Corporate Accountability
- 14.1 Investigate an AI business
- 14.2 Value claims and dependencies
- 14.3 Allocate transactional risk
- 14.4 Preserve evidence for disputes
- 14.5 Analyze responsibility
- 14.6 Manage investigations
- 14.7 Advise the board
- 14.8 Integrate after a deal
15 Operate a Global AI Governance Program
- 15.1 Choose the common foundation
- 15.2 Maintain local schedules
- 15.3 Manage competing obligations
- 15.4 Control global suppliers
- 15.5 Coordinate assurance
- 15.6 Engage regulators and standards
- 15.7 Communicate across the organization
- 15.8 Review the geographic footprint
16 Make Governance Endure
- 16.1 Set a practical maturity plan
- 16.2 Improve decision quality
- 16.3 Develop the legal team
- 16.4 Monitor law and evidence
- 16.5 Prepare for changing capabilities
- 16.6 Demonstrate outcomes
- 16.7 Maintain trust through explanation
- 16.8 Take the next decision
Get your copy
Choose an individual or team licence. Pre-publication orders are charged at the time of order, with the download link emailed on release day.
Current licence options and final pricing are confirmed on Lex Books. Need to cover a whole firm? Enquire about an enterprise licence.
Other titles from Lex Books
About this report & methodology
Lex Books is a legal publisher producing research and practical guidance for law firm leaders, partners and practice managers. Its publications combine detailed research with actionable strategy for modern law firms.
This report was produced by the Lex Books editorial team, drawing on primary sources and Lex Books’ curated knowledge base. AI-assisted tools supported the research, analysis and drafting process. The final content was independently checked, edited and approved by Lex Books, which takes editorial responsibility for the publication.
