Explainer
AI governance and law
AI governance and law covers two connected bodies of work: the law that governs artificial intelligence, and the internal structures by which organizations govern their own use of it. This page explains both, and where they meet in legal practice.
The definition
What AI governance and law means
The first body of work is the law of artificial intelligence: the statutes, regulations, court rules, and professional conduct rules that determine what an organization deploying AI may do and what it must document. The second is governance, the internal structure of policies, controls, supervision, and records by which an organization makes its own use of AI defensible under that law.
The two are discussed as one subject because neither stands alone. A statute has no effect inside an organization until governance carries it into practice, and a governance program written without reference to the law it answers is paperwork. In legal practice the connection is tighter still, because law firms both advise clients on AI law and answer for their own use of AI as regulated professionals.
The legal layer
The law governing artificial intelligence
There is no single law of artificial intelligence. The EU AI Act, Regulation (EU) 2024/1689, is the most complete statute: a risk-based regime that entered into force in August 2024 and phases in obligations for prohibited practices, high-risk systems, and general-purpose models over the years that follow. The United States has no federal statute of comparable scope, so the operative law is an accumulation of state statutes, sector regulation, and enforcement of existing law by agencies and courts.
For lawyers, the binding layer is professional responsibility. ABA Formal Opinion 512, issued in July 2024, applies the Model Rules of Professional Conduct directly to generative AI, and state bars, including the State Bar of California, have issued guidance of their own. Courts add a further layer through rules and standing orders governing AI use in and before the courts, including California Rule of Court 10.430. Voluntary instruments sit alongside the binding law: the NIST AI Risk Management Framework structures how organizations identify and treat AI risk, and ISO/IEC 42001 defines a certifiable AI management system.
01 · Statute
Binding AI statutes
The EU AI Act is the reference statute: risk-based obligations phasing in from 2024, with reach over any system placed on the EU market.
02 · State law
US state statutes
In the absence of a federal AI statute, states legislate piecemeal, from disclosure duties to automated-decision rules, and the map changes yearly.
03 · Conduct rules
Professional responsibility
ABA Formal Opinion 512 and state bar guidance apply the duties of competence, confidentiality, and supervision to AI use by lawyers.
04 · Court rules
Rules of court
Rules and standing orders on generative AI in and before the courts, including California Rule of Court 10.430.
05 · Frameworks
Voluntary risk frameworks
The NIST AI Risk Management Framework structures risk identification and treatment. Voluntary, and increasingly the reference point in procurement.
06 · Standards
Management-system standards
ISO/IEC 42001 defines a certifiable AI management system, the organizational counterpart to the legal duties above.
The governance layer
Governing AI inside legal practice
For a law firm, AI governance means turning professional duties into working controls. The duties themselves are settled: competence in the tools, protection of client confidences before anything enters an AI system, verification of output before it reaches a client or a court, supervision of the lawyers and staff who use the tools, and billing that reflects the work actually performed.
The governance program is what makes those duties operational: a firm AI policy, an approved-tool register, verification and documentation practice, supervision assignments under Model Rules 5.1 and 5.3, vendor assessment, and a defined response for the day something goes wrong. Solari's page on AI governance for law firms treats this layer in detail.
The join
Where regulation and practice meet
The field rewards people who can hold both halves at once. A general counsel reading the EU AI Act needs to know what it changes inside the company's development and procurement practice. A managing partner writing an AI policy needs to know which parts answer to Opinion 512, which to the client's regulators, and which to the courts. The questions that carry consequences sit at the join: whether a deployment is defensible under the duties that apply, and whether the records behind it would survive examination.
The work
How Solari covers the field
Solari works the field from three positions. The advisory practice designs AI governance programs for organizations in regulated environments and advises law firms on their own use. The Solari Institute publishes the Standard on AI Governance in Law, a versioned body of knowledge stating what a practitioner governing AI in legal practice must know and be able to do, and examines attorneys against it through AGL United States and AGL UAE. The research behind both runs through Solari Perspectives.
Common questions
AI governance and law, explained
What is the difference between AI governance and AI law?
AI law is external: the statutes, court rules, and professional conduct rules that bind an organization. AI governance is internal: the policies, controls, supervision, and records by which the organization meets those duties and makes its use of AI defensible.
Is AI governance legally required?
In the EU, the AI Act imposes binding obligations, including governance and documentation duties for high-risk systems. In the United States, lawyers already carry binding duties under ABA Formal Opinion 512 and state bar guidance, and regulated sectors answer to their own regulators. Voluntary instruments such as the NIST AI Risk Management Framework carry no penalty but set the reference point.
Who regulates AI in the United States?
No single agency. AI use is governed by state statutes, sector regulators, professional conduct rules for lawyers, and court rules, with existing law enforced against AI-assisted conduct. The absence of one federal statute is why US governance programs are built against a map of duties rather than a single law.
How do lawyers demonstrate competence in AI governance?
Through study, through documented practice, and through credentials examined against a published standard. The Solari Institute maintains the Standard on AI Governance in Law and issues AGL, a certification for attorneys examined on professional responsibility, governance program design, the law governing AI use, work product, and court-facing use.