Governing the Unknown: How General Counsels Can Build AI Liability Defenses Before Regulators Draw the Lines

There is a particular kind of institutional risk that lawyers find most unsettling: not the risk that is clearly prohibited, but the risk that exists in a space where the law has not yet arrived. That is precisely where artificial intelligence sits today. Companies across virtually every sector—financial services, healthcare, retail, manufacturing, human resources—are deploying AI-driven systems at scale, making consequential decisions at machine speed, while the legal frameworks governing accountability, transparency, and harm remain fractured, incomplete, and in many cases entirely absent.

For general counsels, this is not an abstract problem. It is a governance emergency unfolding in slow motion.

The Liability Landscape Is Wider Than Most Boards Appreciate

The legal exposures surrounding enterprise AI deployment do not fit neatly into any single body of law. They span civil rights statutes, intellectual property doctrine, consumer protection regulations, data privacy frameworks, and securities disclosure obligations—often simultaneously. What makes this especially challenging is that liability can attach not only to how an AI system was built, but to how it was procured, deployed, monitored, and explained to affected parties.

Three categories of exposure are drawing the most attention from outside counsel and compliance professionals.

Algorithmic discrimination is perhaps the most litigation-ready risk. When AI systems are used in hiring, lending, housing, or insurance decisions, they are subject to the same anti-discrimination obligations as any human decision-maker—arguably more so, given the scale at which they operate. The Equal Employment Opportunity Commission has already signaled its intent to apply Title VII analysis to AI-assisted hiring tools, and the Consumer Financial Protection Bureau has made clear that adverse action notice requirements apply even when the decision-maker is an algorithm. Companies that cannot explain why their AI systems produce the outcomes they do are poorly positioned to defend disparate impact claims.

Intellectual property infringement tied to AI training data represents a second, rapidly evolving front. A wave of litigation—targeting generative AI developers—has raised foundational questions about whether training large language models and image generators on copyrighted material constitutes infringement. While the primary defendants in these cases are AI developers, enterprise users who build proprietary applications on top of third-party AI infrastructure face downstream exposure that vendor indemnification clauses may not fully address. General counsels need to understand what data their AI vendors trained on, and whether those vendors have made legally defensible representations about licensing and fair use.

Algorithmic transparency and explainability is the third axis of risk. Regulators and plaintiffs alike are increasingly demanding that companies be able to articulate how automated systems reach their conclusions. The EU's AI Act—while not directly applicable to US-only operations—is already influencing how sophisticated counterparties evaluate AI governance maturity. Domestically, several states have enacted or are considering legislation requiring algorithmic impact assessments for high-risk AI applications. Companies that treat their AI systems as black boxes are accumulating disclosure and accountability risk with every passing quarter.

Why the Regulatory Gap Is Not a Safe Harbor

A common but dangerous assumption in some boardrooms is that regulatory ambiguity offers temporary protection—that companies cannot be held liable under rules that have not yet been written. This assumption misreads the enforcement environment in at least two important ways.

First, existing legal frameworks are already being stretched to reach AI-related conduct. Federal and state consumer protection statutes, civil rights laws, and common law negligence theories do not require AI-specific legislation to generate viable claims. Plaintiffs' attorneys and federal agencies are actively testing the application of existing law to AI fact patterns, and courts are beginning to issue decisions that will shape liability standards for years to come.

Second, when regulations do arrive—whether through the FTC, sector-specific agencies, or eventual federal AI legislation—enforcement agencies typically look backward at corporate conduct during the pre-regulatory period. Companies that deployed high-risk AI systems without meaningful governance structures, documentation, or oversight mechanisms will find themselves at a significant disadvantage when those standards are finally codified. The absence of a rule is not the absence of a standard; it is simply the absence of a written one.

Building a Defensible AI Governance Structure

The practical challenge for general counsels is constructing governance frameworks that are both operationally workable and legally defensible in a future enforcement environment that cannot be fully predicted. Several structural elements are emerging as foundational.

AI system inventory and risk classification. General counsels cannot govern what they cannot see. A prerequisite to any meaningful AI risk program is a comprehensive inventory of AI systems in use across the enterprise—including those embedded in third-party software and vendor platforms—along with a risk-tiering methodology that prioritizes oversight resources based on the potential for harm. Systems that make or materially influence decisions affecting individuals warrant the highest level of scrutiny.

Vendor due diligence and contractual protections. Procurement of AI tools should be treated with the same rigor as any other high-risk vendor relationship. That means reviewing vendor representations about training data provenance, model accuracy, bias testing, and indemnification scope before contracts are signed—not after a regulatory inquiry arrives. Representations that seemed adequate eighteen months ago may no longer reflect the current litigation environment.

Bias auditing and impact assessments. For AI systems used in consequential decision-making contexts, proactive bias auditing is rapidly becoming a baseline expectation. Several jurisdictions—including New York City, which enacted Local Law 144 requiring bias audits for automated employment decision tools—have made this a legal requirement. Even where it is not yet mandated, conducting and documenting algorithmic impact assessments creates a record of good-faith governance that can be meaningful in subsequent enforcement proceedings.

Human oversight protocols and escalation paths. One of the most effective liability-mitigation arguments available to companies is that consequential AI outputs were subject to meaningful human review. Building documented override and escalation procedures into AI workflows—and ensuring those procedures are actually followed—is both a governance best practice and a potential defense against claims that automated systems operated without adequate accountability.

Board-level disclosure and oversight. The SEC's recent emphasis on cybersecurity governance has established a template that is increasingly being applied to AI risk. Boards should be receiving regular briefings on material AI risks, and companies with significant AI exposure should be evaluating whether existing disclosure obligations require discussion of those risks in public filings.

The Window for Proactive Positioning Is Narrowing

Regulatory clarity on AI liability will eventually arrive. Federal legislation has been proposed, agency guidance is accumulating, and the courts are beginning to produce precedent. When that clarity does arrive, companies will be evaluated not only on what they do going forward, but on the choices they made during the period of ambiguity.

General counsels who treat the current moment as an opportunity to build durable governance infrastructure—rather than a window to defer difficult decisions—will be in a materially stronger position when enforcement agencies and plaintiffs begin drawing the lines. The companies most exposed are not necessarily those using the most advanced AI; they are those using it without documentation, oversight, or accountability.

In law, as in most things, the absence of a rule rarely means the absence of consequences. It usually just means the consequences are harder to predict.