AI Compliance Starter Kit™
The regulatory environment for AI is moving faster than most legal teams can track. The EU AI Act is now in force, GDPR enforcement against AI companies is increasing, and IP ownership of AI outputs remains unsettled. This kit gives you the current state and what you need to do now.
What's inside
- EU AI Act risk classification — how to determine where your AI system falls in the risk hierarchy and what it means operationally
- GPAI model obligations — what applies if you're building or fine-tuning foundation models, transparency and systemic risk requirements
- GDPR for AI companies — training data legal basis, purpose limitation, data subject rights against model weights, DPA requirements
- IP ownership of AI outputs — current US/EU positions, how to structure your process to maximize protectability
- Training data IP risks — what you can and can't use to train, scraping restrictions, licensing considerations
- AI disclosure requirements — when you must disclose you're using AI to end users, deepfake and synthetic content rules
- Data governance framework — practical data classification, access controls and documentation for AI companies
- Compliance checklist by company type — different checklists for B2B SaaS, B2C apps and AI infrastructure providers
Who this is for
Get AI Compliance Starter Kit™
Fill in the details below — we'll send it to your email immediately.
Frequently asked questions
What does the EU AI Act require for AI startups?
The EU AI Act classifies AI systems by risk level. High-risk systems face strict requirements including conformity assessment and human oversight. Most startups building general-purpose tools face transparency obligations (disclose AI interaction) but not the full high-risk regime. The kit maps where your system likely falls.
Who owns the IP in AI-generated outputs?
IP ownership of AI-generated content is unsettled. In the US and EU, purely AI-generated works without human creative input are generally not copyrightable. Practical approach: document human creative input, ensure your ToS addresses output ownership, and monitor jurisdiction-specific developments — this kit has a current summary.
Does GDPR apply to AI training data?
Yes. GDPR applies to personal data used to train AI models. Key issues: legal basis for processing, data minimization, purpose limitation, and data subject rights (deletion requests create challenges for model weights). Companies must assess their training data pipeline against GDPR requirements.
Tell us about your AI product — we'll assess your compliance posture and design the data governance framework you need.