Notes from my LinkedIn feed

Most "AI governance" debates skip the part legal and regulatory teams actually need: the guardrails.

After 20+ years as a lawyer across tech, e-commerce and heavily regulated markets, and now building AI tools for legal work myself, here is the practical guardrail set I come back to before any team "adopts AI":

1) Privacy. Where does the data go, what is the lawful basis, and can you still honour KVKK/GDPR rights (access, deletion, cross-border transfer) once a model sits on top? If you cannot answer that in one paragraph, you are not ready.

2) IP and confidentiality. Who owns the output? What happens to the input: is it retained or used for training? Is privileged or confidential material leaving your perimeter?

3) Transparency and accountability. Can a human explain why the system produced an answer, and is that disclosed where disclosure is required (consumer-facing, regulator-facing)? AI drafts; a person owns the judgment.

4) Vendor risk. Model changes, sub-processors, data-retention limits and audit rights belong in the contract, not the FAQ.

The pattern I have seen work: do not ban AI, and do not rubber-stamp it. Build a "yes, if" layer: clear conditions that let teams move fast while protecting the enterprise. Governance that only says "no" gets routed around. Governance that enables adoption gets used.

What would you add to the list?

AI will not replace regulatory teams. But regulatory teams that use AI will outpace the ones that do not.

The unglamorous, high-leverage use cases I am most interested in:

• Horizon scanning: monitoring legislative and regulatory change across markets and surfacing what actually matters, faster.

• Analysis and synthesis: turning a 90-page draft regulation into a clean, business-ready brief.

• Knowledge management: making years of institutional regulatory memory searchable instead of trapped in inboxes.

The catch: every one of these needs governance baked in: privacy, IP, transparency, and a human accountable for the final call.

The line I hold: use AI to remove the grunt work, never to outsource the judgment.

I started Lexsas because I kept hitting the same wall in-house: the legal and regulatory work that is easiest to automate is also the work most exposed to privacy, IP and confidentiality risk. So the interesting problem is not "can AI do this?" It is "can AI do this safely enough that a regulated business will actually use it?"

That question, responsible AI adoption for legal and regulatory teams, is what I spend my spare cycles on now.

On June 12, the AI sitting inside a lot of everyday workflows just stopped working.

On June 26, OpenAI previewed GPT-5.6 Sol to a small group of trusted partners. OpenAI stated: "We don't believe this kind of government access process should become the long-term default."

On June 12, 2026, Anthropic removed access to its frontier AI models Fable 5 and Mythos 5. Its statement: "We are complying with the government's legal directive and are removing access to Fable 5 and Mythos 5 for all users." The controls on both models were lifted on June 30. Fable 5 returned globally on July 1. Anthropic initially restored Mythos 5 only to selected US organisations, then said in a July 1 update that access to both models had been restored for their respective approved audiences.

Epictetus sorted things into what we control and what we don't. I quote that line more often than I live by it. June was the opening scene where the camera lingers on a pistol for a moment, then moves on. We all know that pistol goes off before the credits.

My read: AI bans are joining a sanctions toolkit the world already knows. A year or two from now, a cutoff would not play out like frozen offshore accounts. It could bring ordinary life close to a standstill. An explicit AI policy and open-source fallbacks are the hedge. The next episode will show who prepared.