Working with Legal and Compliance on AI Governance

Overview
In the PMI Cognitive Project Management for AI (PMI-CPMAI) framework, the domain Support Responsible and Trustworthy AI Efforts expects the AI project manager to bring legal, compliance, privacy and risk professionals into the project. They should help shape how AI is built, deployed and monitored, not only sign off at the end. This guide explains why that matters, what it involves, how it works across the CPMAI lifecycle, and how to answer exam questions on it.

1. Why It Is Important

Regulatory exposure is growing fast. AI is now covered by specific and broad rules, including:

• the EU AI Act, with risk tiers of prohibited, high-risk, limited and minimal risk;
• GDPR and its rules on automated decision-making and data subject rights;
• CCPA/CPRA;
• sector rules such as HIPAA, fair lending laws (ECOA), and the SR 11-7 model risk guidance in banking;
• employment and anti-discrimination laws;
• emerging state and local laws, such as New York City's rules on automated hiring tools.

Non-compliance can bring fines, injunctions, forced shutdown of a model, or reputational damage.

AI creates new legal risks. These include:

• biased outcomes that become discrimination claims;
• opaque decisions that breach transparency or explanation obligations;
• training data used without proper consent or license, raising privacy and IP problems;
• generative AI producing infringing, defamatory or confidential content;
• unclear liability when AI-driven decisions cause harm.

Trust and adoption depend on it. Customers, regulators and employees are more willing to accept an AI solution when the organization can show it is lawful, fair, accountable and auditable.

It prevents costly rework. Finding a legal blocker after a model is trained or deployed can mean re-collecting data, retraining or abandoning the project. Early engagement is far cheaper. This is a core CPMAI principle: address data and governance issues in the early phases.

It supports the AI go/no-go decision. CPMAI stresses asking whether a problem should be solved with AI at all. Legal and compliance input is critical to that decision.

2. What It Is

Working with legal and compliance on AI governance means proactive, continuous collaboration between the AI project team and the organization's legal counsel, compliance officers, privacy officers or DPOs, risk management, information security, internal audit and ethics boards. Together they ensure the AI system:

• complies with applicable laws, regulations, contracts and internal policies;
• aligns with the organization's AI governance framework, such as responsible AI principles, model risk policies and acceptable use policies;
• has documented accountability, approval checkpoints and evidence of due diligence;
• is monitored after deployment for compliance drift, new regulations and incidents.

Key concepts to know:

• AI governance: the structures, policies, roles, processes and controls that direct and oversee AI use in an organization.
• Compliance: conformance with external laws and regulations and with internal policies and standards.
• Data governance: rules on data provenance, ownership, consent, retention, quality, lineage and access. It is the foundation of AI compliance.
• Privacy by design / compliance by design: building legal requirements into the solution from the start.
• Risk-based approach: classifying AI use cases by impact so that high-risk systems get stronger controls, documentation and human oversight.
• Accountability and RACI: clearly naming who owns legal review, who approves, and who is consulted and informed.
• Documentation artifacts: AI impact assessments, Data Protection Impact Assessments (DPIAs), model cards, datasheets for datasets, data lineage records, risk registers, audit trails and decision logs.
• Frameworks and standards: NIST AI Risk Management Framework (Govern, Map, Measure, Manage), ISO/IEC 42001 (AI management systems), ISO/IEC 23894 (AI risk management), OECD AI Principles, and the EU AI Act requirements.

Roles of the project manager vs. legal: The AI project manager is not expected to give legal advice or interpret the law. The PM's job is to:

• identify where legal and compliance questions arise;
• engage the right experts early;
• translate technical details so counsel can assess risk;
• build legal requirements into the plan, backlog and acceptance criteria;
• escalate unresolved issues;
• keep the evidence.

Legal and compliance interpret requirements, assess exposure and approve or set conditions.

3. How It Works Across the CPMAI Lifecycle

CPMAI follows six iterative phases. Legal and compliance involvement appears in each.

Phase I: Business Understanding

• Identify stakeholders, including legal, compliance, privacy, risk and ethics, and add them to the stakeholder register.
• Classify the use case's risk level. Does it affect people's rights, employment, credit, health or safety? Is it in a regulated sector? Is it possibly prohibited?
• Identify the regulations, contracts and internal policies that apply.
• Run an initial AI impact assessment or risk screening.
• Include legal and compliance in the go/no-go decision. If the use case is unlawful or too risky, stop or redesign it.
• Define success criteria that include compliance requirements, such as explainability, fairness thresholds and human-in-the-loop.

Phase II: Data Understanding

• Check data provenance, ownership, licensing and consent. Ask whether the data may be used for this purpose (purpose limitation).
• Identify personal, sensitive or protected-class data and any cross-border transfer restrictions.
• Conduct a DPIA where needed.
• Confirm third-party data and vendor contracts allow AI training use.

Phase III: Data Preparation

• Apply data minimization, anonymization or pseudonymization, and retention rules.
• Document lineage and transformations for auditability.
• Agree with compliance how protected attributes will be handled. They are often needed to test for bias even when excluded from model inputs.

Phase IV: Model Development

• Choose techniques that meet explainability obligations. Regulated decisions may require interpretable models or reason codes.
• Run bias and fairness testing against thresholds agreed with legal and compliance.
• Record model design decisions, trade-offs and limitations in model cards.
• For generative AI, address IP, content filtering and confidentiality.

Phase V: Model Evaluation

• Validate the model against both performance and compliance criteria.
• Get an independent review or model validation where required, for example under the model risk management practices in SR 11-7.
• Obtain formal legal and compliance sign-off before deployment, with documented conditions.
• Confirm transparency notices, user disclosures and consent mechanisms are in place.

Phase VI: Model Operationalization

• Implement monitoring for drift, bias, performance degradation and incidents.
• Establish human oversight, appeal and recourse processes for affected individuals.
• Keep audit trails and logs.
• Define an incident response and escalation path that involves legal.
• Re-review the system when regulations change, the model is retrained or the use case expands.
• Schedule periodic compliance audits. AI governance continues after go-live.

Collaboration mechanisms

• A RACI matrix with legal and compliance roles.
• Governance gates or stage-gate reviews at phase transitions.
• A shared risk register with legal and regulatory risks, owners and mitigation plans.
• An AI governance committee or responsible AI board for high-risk use cases.
• Compliance requirements written as backlog items, user stories or acceptance criteria. This works well in iterative and agile delivery.
• Regular communication and plain-language technical briefings for counsel.
• Vendor and third-party due diligence for purchased AI or foundation models.

4. Common Scenarios and Correct Responses

• Data scientists want to use customer data collected for another purpose. Pause and consult privacy and legal on purpose limitation and consent before using it.
• A regulation changes mid-project. Assess the impact with legal, update the risk register and requirements, and adjust the plan through change control.
• The business sponsor pressures the team to skip compliance review to meet a deadline. Do not skip it. Explain the risk, escalate through governance, and look for ways to fast-track the review rather than bypass it.
• A deployed model shows bias against a protected group. Follow the incident process, notify compliance and legal, consider pausing or limiting the model, investigate the root cause and remediate.
• Legal says an AI use case is high-risk. Apply stronger controls (documentation, human oversight, testing, transparency), or reconsider whether AI is appropriate.
• A vendor's AI tool is being procured. Involve legal in contract terms covering data use, IP, liability, audit rights, transparency and indemnities.
• Legal and the data science team disagree. Facilitate a discussion, document the options and trade-offs, and escalate to the governance body if needed. The PM does not overrule legal.

5. Exam Tips: Answering Questions on Working with Legal and Compliance on AI Governance

Tip 1: Early and continuous beats late and one-time. The best answer usually involves legal and compliance at the start (Business and Data Understanding) and throughout the lifecycle. Be suspicious of options that involve legal only at deployment or after a problem appears.

Tip 2: The PM facilitates, not adjudicates. Eliminate answers where the PM interprets the law, decides an issue is "probably fine," or overrides counsel. Prefer answers where the PM consults, documents, integrates requirements and escalates.

Tip 3: Never bypass governance for speed. Options like "proceed and fix later," "deploy and monitor for complaints," or "skip review because the sponsor approved" are almost always wrong. Look for answers that keep the control but streamline it.

Tip 4: Data is usually the root issue. Many AI compliance questions are really about data rights, consent, purpose limitation, privacy or provenance. When a question mentions data sources, personal data or third-party data, choose the answer that verifies legal rights to use the data before proceeding.

Tip 5: Think risk-based. Match the control to the impact. High-risk use cases (hiring, credit, healthcare, law enforcement, safety) need impact assessments, explainability, fairness testing, human oversight and formal sign-off. Avoid answers that apply one level of control to everything or ignore risk tiers.

Tip 6: Documentation and traceability win. Answers that create or update the risk register, impact assessment, DPIA, model card, data lineage or audit trail are often correct. Regulators and auditors need evidence.

Tip 7: Pause or contain when harm is found. If a compliance or ethical issue is discovered in production, the best first step is usually to assess and contain it, such as pausing or limiting the model. Then notify legal and compliance through the incident process. Do not ignore it, and do not silently retrain without telling anyone.

Tip 8: Governance continues after deployment. Choose answers that include ongoing monitoring, periodic review, re-assessment on retraining or scope change, and tracking regulatory changes.

Tip 9: Use change control for regulatory change. When laws or policies change, the answer is impact analysis with legal, then a formal change request and updated plans. Ignoring the change or making ad hoc changes is wrong.

Tip 10: Know the 'should we use AI at all?' angle. CPMAI favors questioning whether AI is the right solution. If legal risk is unacceptable, redesigning the use case or choosing a non-AI or lower-risk approach can be the best answer.

Tip 11: Watch for keywords.

• Words that usually signal a correct answer: engage, consult, collaborate, assess, document, escalate, integrate, validate, monitor, align with policy.
• Words that usually signal a distractor: assume, ignore, bypass, defer, after launch, the PM decides, legal later.

Tip 12: Pick the 'first' or 'best' action carefully. For "What should the PM do FIRST?" questions, the answer is often to assess or understand the situation, review the governance policy, or consult the appropriate expert. Rule out actions that jump straight to building, deploying or telling stakeholders that everything is fine.

Tip 13: Third parties do not transfer accountability. Using a vendor model or cloud AI service does not remove the organization's compliance obligations. Correct answers include due diligence, contractual protections and ongoing oversight of vendors.

6. Quick Summary

• Why: to reduce legal, regulatory, financial and reputational risk, avoid rework, and build trust.
• What: structured, continuous collaboration with legal, compliance, privacy and risk teams within an AI governance framework.
• How: engagement in every CPMAI phase, through RACI, stage gates, risk registers, impact assessments, documentation, sign-offs, monitoring and change control.
• Exam mindset: early, collaborative, risk-based, documented and continuous. The PM facilitates and escalates and never bypasses governance.