Practice · AI governance and regulatory
AI governance and regulatory counsel for AI startups selling to enterprises
Enterprise buyers and lead investors ask AI startups about AI governance before a regulator does. Penwell Law prepares the AI use policy, the model and vendor risk assessments, the audit-ready documentation and the regulatory strategy behind them for AI companies shipping from California.
What enterprise buyers ask an AI vendor for
They request a consistent set of AI governance documents: an AI use policy governing the company's own use of third-party models; a model inventory with intended use, known limitations and the evaluation record; vendor risk assessments for each model and data provider; a data governance record of what the model was trained on and under what rights; incident and escalation procedures for model failures; and customer-facing disclosures and disclaimers that match those procedures. Penwell Law maps a company's practices to the NIST AI Risk Management Framework and writes the documents for the company's team to maintain.
The EU AI Act, FTC Section 5 and California's AI statutes
The EU AI Act reaches a U.S. company when its AI system is placed on the European market or its output is used in the EU. Penwell Law counsels U.S. companies on risk classification, the general-purpose AI model obligations and the transparency duties as compliance exposure, starting with the product's risk tier and the documentation that tier requires.
Section 5 of the FTC Act reaches a company's claims about what its AI does, and the Commission has treated unsubstantiated AI performance claims and undisclosed training uses as deceptive. Advertising and consumer protection law apply to the marketing copy, the onboarding flow and the pricing page, and Penwell Law reviews launch copy before release.
California's CCPA and CPRA govern the data side, including the California Privacy Protection Agency's automated decision-making regulations. California also regulates AI directly through the AI Transparency Act (SB 942, as amended by AB 853) and its provenance and disclosure duties, AB 2013's training-data disclosures for generative AI developers, and the Transparency in Frontier Artificial Intelligence Act (SB 53) for developers of frontier models.
Other U.S. states have their own AI and privacy statutes; Penwell Law tracks them for companies selling nationally and advises directly on federal and California law.
Trust and safety: the policies a platform runs on
A platform needs its trust and safety framework in place before its first abuse report, takedown notice or regulator inquiry. Penwell Law drafts the acceptable-use policies, community guidelines, and content-moderation and escalation frameworks that platforms operate at scale, covering user-generated-content governance, transparency reporting, the notice-and-action duties that reach U.S. hosting services under the EU Digital Services Act, and the systemic-risk assessments required of very large online platforms. For generative AI products, the framework also covers rights, output safety and product design, and Penwell Law sets the escalation path for sensitive content before launch.
What is in force and what is pending
The GDPR has years of enforcement behind it, the CCPA and CPRA have final regulations and a dedicated agency, the FTC has addressed AI claims through enforcement, and the EU AI Act's obligations take effect on a published schedule. Penwell Law tracks pending legislation, agency rulemaking, enforcement actions and litigation in Sacramento, Washington and Brussels. Clients learn of a requirement at the proposal stage, with an assessment of whether it will apply to them and what to build before it takes effect. Where a question is open, Penwell Law says so, states the position the company is taking and why, and documents it; for recurring questions, it trains product and engineering teams on that written position.
Common questions
Frequently asked questions
Does the EU AI Act apply to a U.S. startup?
It can. The Act applies to providers placing AI systems on the EU market and to systems whose output is used in the EU, regardless of where the provider sits. Penwell Law counsels U.S. companies on that exposure: risk classification, general-purpose model obligations and the documentation each tier requires.
What AI governance documents do enterprise customers ask for?
Most requests converge on an AI use policy, a model inventory, vendor risk assessments for models and data providers, a training-data governance record, incident procedures and customer-facing disclosures. The practice drafts them to align with the NIST AI Risk Management Framework.
Can the FTC act against an AI startup?
Yes, under Section 5 of the FTC Act. The usual pre-launch steps are to match each performance claim in the marketing copy to the evaluation record, and to disclose any training use of customer data before the data is collected, not through a later change to the terms.
Writing
Liam writes on the legal questions behind building and shipping technology: AI governance, privacy, and content rights. Read the blog →
Start the conversation
Based in Burlingame, California, working with clients and teams across Silicon Valley, the Bay Area, and nationally.
Inquiries