Source: Bird & Bird

Artificial Intelligence is now a significant topic for in-house lawyers due to its impact across many corporate functions, including employment, marketing, research and development, and software-as-a-service engineering. A recent McKinsey study cited reports that 88% of organisations use AI in at least one business function. Concurrently, the 2025 IAPP AI Governance survey found that 49% of organisations identified a lack of understanding of AI technologies and of AI compliance governance obligations as primary challenges, which can increase organizational legal risk exposure.

AI governance is framed as a system of rules, practices, processes, and technological tools designed to ensure that an organisation’s use of AI aligns with its strategies, values, and fulfills legal requirements. Two widely referenced frameworks are described: the US National Institute of Standards and Technology (NIST) AI Risk Management Framework (RMF), a voluntary sector-agnostic framework structured around the functions Govern, Map, Measure, and Manage; and ISO/IEC 42001:2023, the first international AI management system standard, which includes AI-specific risk assessments, controls for data governance, bias mitigation, and transparency. The article further describes the fragmented and complex nature of the global AI regulatory landscape, underscoring the importance for in-house counsel of robust AI governance frameworks to manage legal risks effectively.