Artificial Intelligence

AI has moved from pilot projects to core business processes. Companies now deploy AI agents that read documents, screen customers, draft communications and increasingly take part in decision-making. The question is no longer whether to use AI, but how to use it in a way that is lawful, accountable and defensible.

The EU AI Act sets a risk-based framework. It bans certain practices and imposes strict requirements on high-risk systems. It also sets transparency duties for chatbots and AI-generated content, obligations for general-purpose AI models, and AI literacy requirements for companies that use AI. Its obligations are phasing in over time. They also interact with the GDPR, product safety and liability rules, and sector-specific regulation such as MiCA, DORA and the MDR.

We don't advise on AI only from the outside. The studio builds and uses its own legal AI tools, based on model APIs and dedicated retrieval-augmented generation (RAG) systems. This hands-on experience gives us a practical understanding of how AI systems, and AI agents in particular, behave, fail and can be controlled. It also lets us bridge the gap between legal requirements and code.

How we can help

• AI Act compliance: role assessment (provider, deployer, importer), risk classification, prohibited practices, high-risk requirements and conformity assessment
• General-purpose AI models: obligations for model providers and for companies building products on third-party models, including contracts with model providers
• Transparency obligations: disclosure for chatbots and AI agents that interact with people, and labeling of AI-generated content and deepfakes
• AI governance frameworks: AI policies, inventories of AI systems, roles and responsibilities, AI literacy programs and board-level oversight
• AI agents in governance: designing the legal framework for companies and DAOs that build an AI agent into their governance, with transparent rules, open-source code, clear attribution of outputs and human decision-making
• Guardrails in code: translating legal requirements into technical controls, such as closed lists of permitted outputs, policy engines, logging and human-in-the-loop checkpoints, reviewed at code level
• Data protection and AI: GDPR compliance for training and deployment, DPIAs and fundamental rights impact assessments, and automated decision-making under Article 22
• AI contracts: agreements with AI providers, terms of use, IP in training data and outputs, and allocation of liability
• Sector-specific AI: AI in financial services, crypto, healthcare and medical devices, aligned with sector rules and supervisory expectations

AI agents inside the company

AI agents are different from traditional software. They reason, act across systems and produce outputs that can reach customers, counterparties and decision-makers. When an agent becomes part of how a company is run, the legal questions become structural. This happens, for example, when it screens applications, reviews proposals or advises the board. Who answers for what the agent does? How are its outputs attributed to the company? How can you prove that a human being was in control?

Our approach

We work at the intersection of law and technology: we read the code as well as the contract. We help you adopt AI in a way that is proportionate to the risks. That means avoiding blanket bans that push AI use out of sight as well as uncontrolled adoption that no one can account for. The goal is AI that is known, bounded and reviewable, and that your organization can defend in front of regulators, investors and courts.

Coming soon: GuardrAIl, our blog on AI governance, the AI Act and data governance. Alongside legal analysis, we will publish open-source guardrails in code on GitHub.