Explainer
AI governance and law
AI governance and law joins two bodies of work: the law that governs artificial intelligence, and the internal structures through which an organization governs its own use of it. In legal practice the two converge, because lawyers answer both to the general law of AI and to the rules of their profession. This page explains the field, the obligations now in force in the United States, the European Union, and the UAE, and how practitioners demonstrate competence in it.
Last updated
Definition
What AI governance and law means
AI law is external. It comprises the statutes, regulations, court rules, and professional conduct rules that bind an organization when it builds, buys, or uses an AI system. AI governance is internal. It comprises the policies, controls, supervision, and records through which the organization meets those obligations and can later show that it did.
The distinction matters because the two fail differently. A gap in knowledge of the law produces a wrong answer. A gap in governance produces a right answer that no one applied, and an organization that cannot prove what it did. The court sanctions for AI-generated citations reported since 2023 are, almost without exception, failures of the second kind.
The law
The law governing artificial intelligence
There is no single body of AI law. Each jurisdiction has assembled its own combination of dedicated statutes, data-protection law, sector regulation, and soft law, and an organization operating across borders answers to several at once.
- European Union
- The AI Act, Regulation (EU) 2024/1689, is the most far-reaching comprehensive AI statute in force. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved the application of obligations for stand-alone high-risk systems from 2 August 2026 to 2 December 2027, and for high-risk systems embedded in regulated products to 2 August 2028. Obligations for general-purpose AI models and most transparency duties were not deferred.
- United States
- No federal AI statute. Obligations arise from state legislation, sector regulators, existing consumer-protection, employment, and civil-rights law applied to AI-assisted conduct, court rules and judges' standing orders on AI in filings, and, for lawyers, the rules of professional conduct. The NIST AI Risk Management Framework is voluntary but has become the common reference for program design.
- United Arab Emirates
- No standalone federal AI statute. The onshore framework combines federal data-protection law with national AI charters and ethics guidance, and in June 2026 the UAE established a Federal Authority for Artificial Intelligence and Data whose mandate includes proposing legislation. In the financial free zones, the DIFC regulates personal data processed through autonomous and semi-autonomous systems under Regulation 10 of its Data Protection Regulations, and the ADGM applies its own data-protection regime.
- Standards
- ISO/IEC 42001 specifies an AI management system against which an organization can be certified, and is increasingly used to evidence governance to clients and regulators in each jurisdiction above.
Primary sources: Regulation (EU) 2024/1689 · NIST AI Risk Management Framework · ISO/IEC 42001
Legal practice
Where AI law and professional responsibility meet
For lawyers, the general law of AI is the lesser constraint. The rules of professional conduct attach to each use of AI independently: competence in the tool, confidentiality of what is entered into it, communication with the client about it, candor in what it produces, supervision of those who use it, and fees for the work it performs. In the United States, ABA Formal Opinion 512 applies those duties to generative AI, and California has proposed amending six of its rules to address AI expressly. In the UAE, the Ministry of Justice's Guiding Principles for the Use of AI Systems by Law Firms and the DIFC Courts' guidance on generative AI in proceedings set comparable expectations.
AI governance for law firms, duty by dutyCompetence
AI governance certification and training for lawyers
Programs described as AI governance certification or AI training for lawyers differ along three lines, and the differences determine what the credential proves.
- Completion or examination
- A certificate of completion records attendance. An examined credential records that the holder demonstrated competence against a published standard, and can be withdrawn or allowed to lapse.
- General or legal practice
- General AI governance credentials address organizations across industries. A legal-practice credential is examined on the duties that bind lawyers: Opinion 512, the rules of professional conduct, court rules, and the governance of a firm.
- Global or jurisdictional
- A single global examination cannot test the rules of a specific bar. A jurisdictional credential is examined against the law of the place the holder practises, and can carry that jurisdiction's continuing-education accreditation.
AGL, AI Governance in Law, issued by the Solari Institute, is the only AI governance credential specific to legal practice and examined by jurisdiction. It is offered as AGL-US; as the California endorsement AGL USA-CA, a State Bar of California approved MCLE activity carrying 9.25 hours of credit, including 1.50 hours of legal ethics; and as AGL-UAE, a Dubai Legal Affairs Department accredited CLPD course carrying 4 CLPD points.
Comparison
AGL and the AIGP
The IAPP's Artificial Intelligence Governance Professional (AIGP) is a widely held general AI governance certification. AGL and the AIGP answer different questions, and a lawyer who advises on AI governance across industries may reasonably hold both.
| AGL | AIGP | |
|---|---|---|
| Issuer | Solari Institute | IAPP |
| Field | AI governance in legal practice | AI governance across industries |
| Examined on | Professional responsibility, firm governance, court-facing use, and the AI law of the holder's jurisdiction | AI governance principles, lifecycle risk, and the general legal and regulatory landscape |
| Jurisdiction | Examined by jurisdiction: United States, California, United Arab Emirates | One global examination |
| Continuing education | AGL USA-CA: State Bar of California approved MCLE, 9.25 hours. AGL-UAE: DLAD-accredited CLPD, 4 points. | Not tied to a specific bar's accreditation |
United Arab Emirates
AI governance and law in the UAE
The UAE has so far chosen guidance over a single statute, which places more weight on the governance an organization builds for itself. Three instruments bear directly on legal practice.
- The Ministry of Justice's Guiding Principles for the Use of AI Systems by Law Firms, launched on 29 September 2026: ten principles emphasizing human review, the lawyer's responsibility for accuracy, and confidentiality.
- DIFC Courts Practical Guidance Note No. 2 of 2023, which expects early disclosure of generative AI use in proceedings and verification of material placed before the court.
- Regulation 10 of the DIFC Data Protection Regulations, which can reach a DIFC law firm that processes client personal data through an autonomous or semi-autonomous AI system, typically as deployer, with notice and accountability obligations.
AGL-UAE is examined against this framework and is accredited by the Dubai Legal Affairs Department as a CLPD course, provider TC-2026-825.
Sources: Ministry of Justice press release (Zawya) · DIFC Courts Practical Guidance Note No. 2 of 2023
The work
How Solari covers the field
Solari works the field from two positions. Solari Advisory designs AI governance programs for law firms and for organizations in regulated environments. The Solari Institute publishes the Standard on AI Governance in Law and examines lawyers against it through AGL-US, AGL USA-CA, and AGL-UAE. The research behind both is published as Perspectives and Meridians.
Common questions
AI governance and law, explained
What is the difference between AI governance and AI law?
AI law is external: the statutes, regulations, court rules, and professional conduct rules that bind an organization. AI governance is internal: the policies, controls, supervision, and records through which the organization meets those obligations and can show that it did.
When do the EU AI Act's high-risk obligations apply?
Following the Digital Omnibus on AI, Regulation (EU) 2026/1744, obligations for stand-alone high-risk systems apply from 2 December 2027, and for high-risk systems embedded in regulated products from 2 August 2028. Obligations for general-purpose AI models and most transparency duties were not deferred.
Who regulates AI in the United States?
No single agency. AI use is governed by state statutes, sector regulators, existing law applied to AI-assisted conduct, court rules, and, for lawyers, the rules of professional conduct. US governance programs are therefore built against a map of duties rather than a single statute.
Does the UAE have an AI law?
Not a standalone federal statute. The UAE relies on federal data-protection law, national AI charters and ethics guidance, free-zone regulation such as DIFC Regulation 10, and sector guidance including the Ministry of Justice's principles for law firms.
Is there an AI governance certification for lawyers?
Yes. AGL, AI Governance in Law, issued by the Solari Institute, is the only AI governance credential specific to legal practice and examined by jurisdiction, with variants for the United States, California, and the UAE.
What is the difference between AGL and the AIGP?
The AIGP is a general AI governance certification examined globally across industries. AGL is examined on the duties that bind lawyers in a named jurisdiction, and its jurisdictional variants carry that jurisdiction's continuing-education accreditation.
Does AGL carry CLE credit?
AGL USA-CA, the California endorsement, is a State Bar of California approved MCLE activity carrying 9.25 hours, including 1.50 hours of legal ethics, approved from 9 October 2026 to 8 October 2028. AGL-UAE is a Dubai Legal Affairs Department accredited CLPD course carrying 4 CLPD points.
Solari Institute · State Bar of California MCLE provider 21051 · Dubai Legal Affairs Department accredited provider TC-2026-825