Privacy is the easy trap
Many teams reach for a privacy policy the moment data and AI appear in the same sentence, then stop there. Privacy is a real and necessary part of AI governance, but it is only one legal domain among several that apply to an AI system before it ever reaches production.
The legal surface is wider than most teams expect
Intellectual property law and copyright questions apply to training data and outputs. Contract law and trade secrets apply to how a model is licensed and used. Employment law, non-discrimination law and equality law apply the moment an AI system influences who gets hired, promoted, approved for credit or offered a service. Consumer protection law and product liability apply when an AI system gives advice or makes a claim. Sector regulation, procurement law and public sector duties apply depending on who is using the system and why.
A recruitment example makes it concrete
We use a recruitment screening scenario to teach this. An AI tool that ranks CVs and recommends interview candidates touches bias, fairness, non-discrimination law, evidence and defensibility, all before a single data protection question is asked. If the only review that happened was a privacy impact assessment, the discrimination risk would go unexamined.
Legal risk, ethical risk and operational risk are not the same thing
Separating these three matters for prioritisation. A legal risk carries statutory or regulatory consequences. An ethical risk affects trust and fairness even where no law is directly broken. An operational risk affects whether the system actually works as intended. Governance work that only asks the privacy question misses two of the three.
Where this fits in practice
A short legal risk spotting exercise, run before a system reaches production, catches most of this early. It does not require a lawyer in the room for every AI decision. It requires knowing which questions to ask and in what order.
We teach this scenario, and the wider legal landscape it sits inside, in the AI Governance, Risk & Compliance Practitioner programme.